The safe was made out of metal, had a combination lock, and even a ringing bell that goes of when the door is opened. It was 8"x8"x6".
So when I was bored and wanted to learn, I worked on the safe. I used tools to try to jimmy the lockig mechanism, I learned to peel the safe open as well. I learned to atack the safe by other than the front door (to bypass alarm).
When I worked in various places doing security, I always took the time to examine the lockboxes and safes used. The big safes - are almost designed exactly like the small safes. They have a strong outer casing, they have a secure locking mechanism that uses bars or rods to lock the door, and then a keypad, combo, or key lock (or two). People also tend to behave the same way around safes - how they memorize combos, hide keys, leave the safe open or unlocked.
Working in the crime lab I got to see safes that were from crime scenes - real safes taken and cracked by various levels of skilled crackers.
A safe is just like any other locking or control device - it only delays and makes theft visible. Any safe can be cracked - given enough time and tools. without a combo or key, the person is left with attacking the structure or stealing the entire safe.
Stealing the safe is almost tactic #1 - the smart theif knows he needs time and a private place to bust the safe open, so he will remove the safe from the premises. The first rule of any safe owner - is to securely install their safe so it cannot be removed!
Tactics used: ( discussed in detail below)
1. You can try to locate the key or combination lock number by searching the vincinity of the safe.
2. You can try to guess the combination lock numbers by tactile feel and playing with the combo dial.
3. You can drill.
4. You peel.
5. You explode the safe.
Tactics
1. People factor - looking for the code or keys
Most people, especially businesses that have a high turn over rate of employees, high number of employees that need to access the safe - people will write the combo number down nearby. they will hide the emergency safe key, on the keyring with all the other keys! observing people using the safe can tip you off. Safe combination numbers are at least 3 - two digit numbers, some higher security safes will use 4 - two digit numbers.
For emergencies - like a forgotten combination code, there can be a key hidden nearby to unlock the safe. Some people are lazy and use the key almost full time. Since safe keys are not standard, they appear to be high security keys - they are short, multi pin, possibly double sided keys or barrel keys. *it is possible to try to pick the lock on a safe - but double sided locks are almost impossible. Barrel key locks are easy to pick, if you have the correct tool for attacking barrel key locks.* Some business safes have a DAY LOCK, this is a setting that is switched on inside the safe door - this allows the business to use the safe quickly during business hours - they only need to enter the last digit of the combo. Instead of entering all three or four codes on the dial or keypad - they can simply enter the last code while it is in DAY LOCK mode. This is better than simply leaving the safe door unlocked, as they might on older safes. With DAY LOCK, some people will forget and leave it on overnight - thus, you only have to crack one code, a two digit number - either on the keypad or combo lock.
2. Touch and Dialing for dollars...
*contact points make 'noise' when you turn the dial. Drive cam will click and drag discs drive pins.
* the drive cam, or drive disc is attached to the dial, as you spin it, it catches on the locking discs pins depending on which direction you spin the dial.
The design of the combination lock gives inherent defects that make it possible to guess combination locks by feel. The combination lock, especially on a safe is noisy. The combination lock has disc and slots that allow a lever to fall in place and unlock the door. You can spin the disc and try to feel for the clicks made by the slots (contact points) as they contact the lever. Manufacturing tolerance are sloppy on cheap safes, they almost allow you to use the wrong combination lock by as much as 5 digits (ie "20" can be anywhere from 16 to 24 - so people can easily unlock the safe. More expensive safes with higher tolerance, you will have to be 'right on' the number to unlock it.
You will have to understand the basics of the combination lock to understand why you need to spin the dial a certain direction first (usually start spinning left), why you have to spin a certain number of times (4 spin for first number, 3 for second number, etc)
As you spin the dial, you can feel the drive disc drag on the other disc, clicks and bumps (bumps are when the lever catches and causes the dial to jump as the lever falls in place - this is the lever catching the slot on the disc)(clicks are disc nubs contacting each other). As you spin the dial left or right, you feel for the drive disc contact points, then you feel for it catching the nubs on the lock disc as you go left or right. This is where hands on experience is important, I can't explain this any other way.
A good primer on safes and their locks
Safe cracking for the computer scientist "Safe and vault security: a computer science perspective" 2.6mb
http://digitalnomad.suck-o.net/DNR/red/safelocks.pdf" onclick="window.open(this.href);return false;
Electronic key pads can be ulttaviolet marked (use black light to detect), anyone touching the keypad will leave fingerprints on the keys they used to unlock the safe.
In some cases, the lock is so worn and dirty, you can see visibly the numbers used on a keypad.
Be aware - many safe's electronic keypads WILL LOCK YOU OUT, after failed attempts within a certain time period - this means you cannot try more than 2- 3 codes during a time frame of usually 3 to 15 minutes! If you activate this security system lock out, the owner will know as he might have to use the emergency key to unlock the safe.
I would also try attacking the electronic keypad, if you can remove it intact on the safe, you would try to find the trigger wire to cause it to unlock. You would have to know voltages/wire colors so you don't fry the system when probbing it. Reading up on the specfic safe's model and manufacture will help you understand the wiring diagram for that safe. Safe scematics are harder to find than exploits for web servers, security through obscurity is in effect here.
**************in progress
JUMP
Ok, here is a collection of safes I picked up. Real hackers know that hands-on learning is the best - these safes were brought at stores, pawn shops, and found in old buildings.
You have a plastic bodied fireproof safe, a metal cased fire proof safe, a floor mounted safe door (sitting on breifcase), and a fireproof briefcase.
The plastic bodied fire proof safe is common, most losses are by fire - not safe breaking - so insurance companies want fire proof more than theft proof.
door lever is in unlocked position, and has 100 number dial. Under the dial is a round cover for the emergency key unlock.
Inside you can see the thick walls, which contain fire retardant materials. While the safe can protect contents from swiping, it will not resist a safe break too long.
yea you can see what DNR might keep in his safe.
Here the cover on the door mechanism has been removed.
You can see the discs controlled by the combo dial, the locking bars, and the round black device on the lower part is the locking mechanism.
If you look at the insides of most safes, they all share almost the same design. Check out the bank safes, they are just bigger, heavier, stronger versions of what you see here.
You can see the dials, the locking bars, the mechanism that moves the locking bar - but the mechanism that unlocks the locking bar is hidden behind it. The white lever is the arm that unlocks this mechanism. the white lever has to fit in the slots on the dial to unlock. The white lever is in unlock position, in the dial slots.
The white lever is now in lock position, the dials moved it out of the slots.
the outermost disc is the drive disc, note its slot is different than the lock discs.
The white lever is important, not the disc. The white lever controls what unlocks the door mechanism.
The lever is locking a round wheel at the bottom of the locking bars. The White bar has to be moved (by fitting into the disc slots) to unlock the round wheel. Many safes utilize locking bars and a durable locking system - the combination lock is not meant to be very technical - the door lock is. If you can defeat the door lock mechanism - you can bypass the combination lock! The system is designed so defeating the comination dial itself - will not unlock the safe alone - you have to attack the door lock mechanism. Smart safe crackers will bypass the combination dial and just drill a hole in the door - to punch out the lever or its springs.
Lastly, this is a plastic safe - peeling it, hammering it - can probably defeat this safe and gain its contents within an hour or so.
---
Floor safe/money drop safe
This is a heavy motherfucker, it was designed to be a money drop for a bar, to leave money overnight. So it's body was sunk into a cement floor (thats why I don't have it) and the safe door removes when you unlock it with a combination code. The dial is missing. The slot is for dropping money into the safe. It weights about 30 pounds.
you can see the locking bars sticking out the sides of the safe door.
The back of the safe door you can see the strong steel design, even for the money drop slot. The key hole is to quickly unlock the safe door so it can be placed on to the safe while opened.
Just like the last safe, its internals look similar - the drive disc and locking disc, the locking bar are visible. After the combination is entered, pressing in the dial causes the spring loaded locking bars to retract.
The locking bar removed, you can see the slots in the locking discs
shown with locking bar in place, in locked position (not engaged in slots)
Since I had the back cover off, I could play with the dial to figure out the combination numbers for the slots - because I can see the disc moving. This is another tactic by safe crackers - to drill holes into the safe to use a snake camera to view the disc as you manipulate the combination dial or jimmy the locking lever.
holes can be drilled in the front or back of the safe to insert a snake camera and attempt to manipulate the lock.
-----------------------
Electronic safe
electronic safes don't have a combination lock, but instead a keypad. For backup - these safes will have a key unlock in case the power fails. This is also the emergency key unlock in case people forget the code. This safe is a better theft proof safe, while fireproof, it has a metal body and heavy steel door. This safe electronics will lock you out after 3 failed attempts, and then chirp 15 minutes later.
Inside the safe
while it has a stronger design, the locking mechanism is not as good as the above plastic safe. It only has one locking bar! The locking bar inside the door, is fake. The chrome bar is the only locking bar. The fake locking bar is to resist prying at the door to pop it off or cutting off the hinges to pop off the door.
Inside, cover off
here you can see the code reset button, the circuit board, wires, and actuator.
The wires come in through the front,
The front panel is only part of the electronics to unlock the safe - secondary parts are contained inside.
Wires are not color coded or even numbered - making it hard to figure out what wire is which if you were outside the safe. You can see the two red wires that would control the actuator - but there is apparently another actuator inside the door to push the door lock open. This exposed actuator only moves out of the way to allow the mechanism to unlock. This means electronically - you have two actuators to move, one moves out of the way, the other slides the locking bar back.
If you drilled a hole - you could simply move this lever down (key unlock direction, not electronic unlock direction - see screwdriver (the electronic actuator moves in opposite direction than key or screwdriver)
by pushing or pulling this knob down, the door is unlocked
This design of the locking mechanism being moved in a different direction than electronic unlock mechanism was maybe to prevent the electronic lock from locking the key out as well. Now, it caused a bypass to the combination keypad and electronics - you simply move the lock in the direction the key would move it.
more later...
DNR
)*photos are mine, graphical images are from "howstuffworks.com" fuck 'em
