On 2012-10-09, Ecnerwal <MyName...@ReplaceWithMyVices.Com.invalid> wrote:
>
> Read Feynman's books - they are worth the time.
>
> He noted the last number from inspecting open safes (actually "secure
> file cabinets" IIRC). It was a flaw in the design.
:-)
Yes -- you need to know the offset from the last digit dialed
to the extra rotation needed to withdraw the bolt, of course. Pretty
much a constant within a single brand of safe and lock.
> He found (IIRC without re-reading the book right now) that the numbers
> were not overly precise - so 100 numbers might really be 25-33 if
> running trials. This is a pretty common flaw of 100 number safe dials,
> at least on the lower end. If the spec says 100 numbers, they put on 100
> numbers, but if the numbers are all off by one or two, the safe still
> opens...
At least the setting dials (hub rotates within the disc when
unlocked by a special key from the inside in the S&G locks) do have 100
different points on the knurling, so you can set them that precisely.
It is all down to how tight a fit the projection on the withdrawal lever
is to the notches -- and it has to be at least a certain degree of
loose, because the lever swings instead of moving in linearly, so there
has to be a certain amount of slop.
> He pointed both of these flaws out to security, which rather than fixing
> them, responded in typical idiotic fashion - at least until they needed
> him.
Of course. "You are not a security expert! We don't have to
listen to you." :-)
> He also used the same tricks that any password cracker uses now - common
> numbers people might choose - anniversaries, children's birthdays,
> numbers scribbled on the desk drawers, etc.
Indeed so.
> And if he cracked one in 20 minutes, he made sure to read something for
> another couple of hours before opening the office door, so as to not
> make it look too easy.
:-)
> For a safe you actually own, the correct way to computerize the process
> would be a robot dial-spinner - doesn't need to sleep and won't fudge up
> the numbers if it's built right. But you do need to know the correct
> directions to spin for that model of safe (no matter what you are
> using.) Just the thing for a spare servo (or stepper) motor and
> controller, plus a linear actuator or something for the handle part. Let
> it grind away until it pops, and figure some way to note when it pops so
> you save the right numbers. The you could re-run trials to see how wide
> the band of numbers that work is to figure what the center numbers (ie,
> the real combination) should be.
Once you have it open -- you can (if necessary) disassemble the
lock and set the combination to what you want. If you have the S&G style
of lock, you re-dial the combination which worked to a different index
line (about 10 or 15 degrees to the left of the working one), put a
special key (extruded square stock with one flange sticking out, a notch
to clear the backplate of the lock, and a pilot bearing on the inner
end), which goes through square holes in cams on the dials -- now lined
up under the hole by the re-dialing on the alternate index line) and
turn it CCW to unlock the discs from the hubs. You then dial the *new*
combination using the offset index line, turn and remove the key, test
several times that the new combination works *before* ever closing the
safe drawer or door. And make sure that you can *remember* that
combination, or expect to have to go through this again.
If you have an S&G lock apart and no known combination, turn
each of the locking cams to loose, stack them back on the spindle, and
rotate them by hand to line up with the socket for the end of the
setting key, keep something round in there while you put the backplate
back on, and then replace the round shaft with the key, dial the new
combination, and lock it in as above.
The Mosler security file cabinets had a lock which *had* to be
disassembled to change the combination. You pull four screws and remove
the works with the backplate. Then remove a C-clip and slide the discs
off the spindle. Each one is two part. The hub is splined and snaps
into a matching spline in the disc, and molded into the disc is the dial
of numbers from 0 to 99. So, you rotate the hub and snap it into the
disc to set the combination. Three times -- one for each disk. And
make sure that you assemble them in the proper order.
The above about testing that the combination *works* several
times before you ever risk closing the drawer applies as above.
> If making new combination locks now I suppose you might include some
> means of noting too much dial twiddling,
That requires memory, which requires a reliable power source,
especially to energize the solenoid to lock it against other rotation.
(You might as well make it a numeric keypad to enter the combination,
but again the need for a reliable power source comes into the game. And
what do you make it do if the power fails? Does it lock forever? Does
to fail unlocked? Do you have provisions for connecting an external
power source if the battery dies? What if someone applies too much
power to those connections, frying the circuit? All questions which
apply to a lock with memory. :-)
> but I guess the serious safes
> all went to time locks to deal with that problem anyway. Any safe you
> can pick up (with a forklift, if needed) is ultimately not all that
> serious, is it?
:-)
Actually -- you are now talking about vaults, and usually the
wall or the floor or ceiling are typically the weak points in there.
Certainly that is how I would have tried to get into the vault at the
head office of our division if necessary. (E.g. if they changed the
combination and it did not work after the door closed. :-)