Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Robotics Security

A Robot At DEFCON Cracked A Safe Within 30 Minutes (bbc.com) 128

schwit1 shared an article from the BBC: Using a cheap robot, a team of hackers has cracked open a leading-brand combination safe, live on stage in Las Vegas. The team from SparkFun Electronics was able to open a SentrySafe safe in around 30 minutes... After the robot discovered the combination was 51.36.93, the safe popped open -- to rapturous applause from the audience of several hundred... The robot, which cost around $200 to put together, makes use of 3D-printed parts that can be easily replaced to fit different brands of combination safe. It cannot crack a digital lock -- although vulnerabilities in those systems have been exposed by other hacking teams in the past.
Though the safe had a million possible combinations using three two-digit numbers, the last number had slightly larger indents on the dial -- reducing the possible combinations to just 10,000. And in addition, "the team also discovered that the safe's design allows for a margin of error to compensate for humans getting their combination slightly wrong" -- which meant that the robot only had to check every third number. "Using this method, they could cut down the number of possible combinations to around 1,000."

"Some SentrySafe models come with an additional lock and key, but the team was able to unlock it by using a Bic pen."
This discussion has been archived. No new comments can be posted.

A Robot At DEFCON Cracked A Safe Within 30 Minutes

Comments Filter:
  • by Tulsa_Time ( 2430696 ) on Sunday July 30, 2017 @08:43PM (#54911287)

    You Tube Videos...

    • by Registered Coward v2 ( 447531 ) on Sunday July 30, 2017 @09:43PM (#54911453)
      Exactly. The stories of his safe cracking in Surely You're Joking... are great. That book and they follow-on should be required reading for anyone interested in hacking, in the old school meaning of the term.
      • by gl4ss ( 559668 ) on Sunday July 30, 2017 @10:51PM (#54911647) Homepage Journal

        They're an interesting read for anyone who doesn't want to be an idiot, really.

        even if you figured out some of the stuff yourself, reading surely you're joking gives you at least some hope in humanity and in that, no, people aren't that different despite few decades of time passing - but you don't have to let it get to you too much.

        aaaanyways also this is kinda why proper safes have delay locks.. with a home safe I would be more interested in if it keeps the stuff safe in an event of fire or whatever(the reason for the name "safe" vs. a lockbox).

        • by Ed Tice ( 3732157 ) on Monday July 31, 2017 @08:08AM (#54912783)
          There are two types of safes. Fire safes and security safes. There may be safes that combine both sets of features but they aren't sold at everyday retailers. A fire safe is typically made up of insulating material and you could probably cut through it pretty easily. A security safe tends to be made of high-strength materials. As a DIY measure, I guess you could put a security safe inside of a fire safe! I wouldn't do the other way around as the fire might prevent the security safe from opening.
          • You forgot the 3rd type - "flimsy metal locking box", which is what almost every Sentry safe is.

            Hint - if it doesn't have an Underwriters Lab listing, it isn't worth the $...

            If you *really* need a safe (I delayed for ages due to cost, sucked it up and instead of buying another rifle I bought a safe - with UL cert - to put the rest of 'em in) check the deal at Big Box Stores - Lowes, Home Depot, Rural King, Tractor Supply.

            Most of these give veterans a discount, sometimes you can catch a sale, sometimes you c

  • by Anonymous Coward on Sunday July 30, 2017 @08:46PM (#54911305)

    was broken into in the less than twenty minutes between when someone kicked in my door and the Seattle police responded. They took everything in it. Sentry makes horrible safes.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      The police have no legal duty to protect citizens not already in custody. Many don't realize that. Burglary is considered little more than a nuance in many locales and treated much like a noise complaint. The police likely won't come, and even if they do, may do little to no investigating.

      On a related note, often the places with the tightest gun restrictions have very poor police response. In my view, if the police have no legal obligation to protect the public, then the public should have the right to be

      • by Anonymous Coward

        Burglary is considered little more than a nuance in many locales and treated much like a noise complaint. The police likely won't come, and even if they do, may do little to no investigating.

        And yet the last couple cities I've lived in, with 200-500k people within larger metro areas, the police responded to break-ins in a couple minutes, even when it was obvious that the burglars have long since been gone. For the two incidents that were actually on my property, they spent some time taking down serial numbers, looking around for possible prints (even when it was hopeless in one case due to being a dusty garage used for woodworking... but they spent some time checking just in case they got luck

      • by ( 4475953 )

        The police have no legal duty to protect citizens not already in custody. Many don't realize that.

        They sure have that duty where I live, so let me ask someone else before I store this in the "only in the US..." category of unbelievable US exceptions in comparison to the rest of the world: Is this even remotely true?

        • by trg83 ( 555416 )
          It is, unfortunately, true for the US. Several Supreme Court rulings have decided this to be true.
        • by Anonymous Coward

          Look, if they have an obligation to protect, they can be sued when they fail. If there is no way for police to be held legally liable for not protecting any specific person, they have no obligation to protect anyone.

      • On a related note, often the places with the tightest gun restrictions have very poor police response. In my view, if the police have no legal obligation to protect the public, then the public should have the right to be armed with few restrictions. Be glad it wasn't an armed robbery. Even that doesn't necessarily guarantee a timely police response either.

        You got anything to backup this statement? We have gun control here in Canada, granted there is still gun related crimes but police response to any crime is almost immediate. At least in Peel Region, they are fast.
        Guns kill people, plain and simple. US has most number of guns per capita, yet its jails are over crowded, violence and gun-related death are probably highest in any developed nation. By your logic, guns should have eliminated all crime.

        Obviously society is not so easily contained by simplified st

      • by Bengie ( 1121981 )
        Over here, trespassing is considered a mortal threat and the resident may respond as such. If your residence is not safe, then you are not safe. My dad refused to leave my mom's driveway. Sheriff was there in minutes with lights blazing. My father almost got charged with assault just for trespassing because he refused to leave when asked. An attack on a person's property is nearly akin to an attack on the person, mostly depending on how long it drags out.
    • by Anonymous Coward

      > less than twenty minutes...Seattle police responded

      That's impressive. Usually they tell you to call back the next day. I know the last time I called 911 when someone stole my car then later kicked in my door, they told me to wait until 9am the next day to call back.

      • Police would be here in less than 4 minutes. Then again we encourage self defense, leading to so little crime that the police can respond immediately to what does occur.

        • by gl4ss ( 559668 )

          with how the police are trained in usa.. it might be better off if they come 4 hours later and the situation has chilled out already and the sun has come up so the poor sods don't get spooked so easliy.

          seriously you should just demand the police education gets tripled or quadrupled to match countries with less police shootings and less gun fatalities. and the pay level is the highest in the world for coppers so there's that too, it's not like it's not compensated for.

          also, you got some stats to back that

          • Re: (Score:3, Interesting)

            by Anonymous Coward

            This. The German rank and file police I worked with had the equivalent of a Master's degree in criminal justice. The English police had a year of training for unarmed combat.

            US police might get a few hours, but the majority of their training is at the range, so they do what they are trained to do in a heated situation; draw, aim for center of mass and empty the magazine on their duty weapon, and then fill out the paperwork while out on paid leave. That is just how the US police system works. The officer

            • Have you ever met a Japanese police officer?
              I lived in japan, and the few times I interacted with them, they were primarily skilled at filling out forms, walking around, and waving flags. To be fair, there's not a lot of crime there outside of criminal on criminal that they need to deal with.
              Once, when my bike was stolen, he was very attentive to the proper form filling out, and had me revise my form a few times due to my bad Japanese. Of course I never got the bike back.
              Another time, one accosted me in the

        • Police would be here in less than 4 minutes. Then again we encourage self defense, leading to so little crime that the police can respond immediately to what does occur.

          Where's here?

  • by mykepredko ( 40154 ) on Sunday July 30, 2017 @08:51PM (#54911317) Homepage

    I know this isn't at the level of what you'd see in a James Bond movie, but neither is the Sentry safe.

    Congratulations to the team at SparkFun!

    • I know this isn't at the level of what you'd see in a James Bond movie, but neither is the Sentry safe.

      Exactly. The story quote is:

      a leading-brand combination safe,

      My thought having worked with some mid-range GSA approved classified document safes and gun safes is that a Sentry is to safes as an inexpensive Master combination lock is to locks...

      But the idea of how it was "cracked" is nifty none the less.

  • James Bond (Score:4, Funny)

    by AHuxley ( 892839 ) on Sunday July 30, 2017 @09:08PM (#54911343) Journal
    On Her Majesty's Secret Service (1969) had that safe-cracking machine.
  • Do they at least provide some measure of flame resistance for the contents?

    Otherwise, you may as well leave your important/valuable stuff sitting in a closet.

    • by Hentes ( 2461350 )

      Every security mechanism using passcodes will be vulnerable to a bruteforce method. I imagine that if robots like this will become widespread safes will start to be equipped with timers to defeat them. Even without that though, 30 mins is still a long enough time to deter most burglers, especially with the noise this machine generates.

    • by fermion ( 181285 )
      It took 30 minutes to break into the safe using brute force. The advantage is that one can get into the safe without anyone knowing. On the other hand, safes rated for 30 minutes tend to be high end, soil there is not another faster way in, then this is a pretty good safe. But yes, most businesses I know tend to hide important documents in plain sight. Safes are mostly to discourage causal theft and protection from fire.
    • They claim they are fireproof and even give some specifications as to heat and duration.

      That's what what mine is for. It's also waterproof (I was able to test that much - I'll take their word that it's fireproof).

      I was advised once to get one but leave it unlocked - otherwise they'll just steal the whole thing. I keep it locked anyway but I don't expect it to really stop anyone burglarizing my home. (so presumably this way they'll just steal the contents? Hooray, I guess).

      • I agree with the unlocked fire safe advice. My small, $600, 300 lb. theft/fire safe was pried off the floor bolt and removed in about 30 minutes. In addition to 2 jewelry boxes, it contained lots of "fire" stuff like documents and keys. If the thieves had opened the safe they would have left half the stuff behind.
    • Some of the cheap safes do offer decent protection against fire. That's the reason I got that relatively cheap Honeywell safe for my home office. It came out pretty well in a fire test, not so well in a break-in test: it can be banged open fairly quickly. But even on this crappy cheap ass safe, the spin lock has to be turned to zero after dialing in the combination, before the door handle can be operated. This prevents someone from feeling notches on any of the rotors, including the first one.

      The loc
      • What I don't get is why the round keys are even still used. The basic Abloy style disk detainer locks have fallen out of patent for almost a century, and even a version of that like what is in the Sargent & Greenleaf Environmental padlock which uses fewer disks, would be more than good enough for a basic security container. Heck, a lever lock, which is 1700s technology, would be useful and decently secure (hell, AT&T/Ma Bell used a variant of lever locks (29B/30C) for decades which were extremely

    • A safe can provide some legal protection (kids in a house with firearms) and can bolster an insurance claim. Practically, any safe a consumer is likely to use can be defeated with 20 minutes and a $12 pawn shop grinder and cutting wheel.
  • by Anonymous Coward

    Sentry safes have long been known not to be super secure. They picked low hanging fruit for this demonstration. Forget even dealing with the locking mechanism, its not that hard to pop them open with a crowbar or some other prying device. Check out YouTube. However they do provide modest security (think locking a gun away from the kids) and are fire resistant.

    I personally have one, but its primarily for securing documents in a fire resistant manner. I would by no means store gold bullion or anything else of

  • by DontBeAMoran ( 4843879 ) on Sunday July 30, 2017 @09:24PM (#54911395)

    WTF?

    Sorry, you need Flash to play this.
    Enable it in your browser or download Flash Player here.

    I thought the BBC was a bit more up-to-date on current technologies. I guess I was terribly wrong.

    • by tsa ( 15680 )

      That's strange. I could play the video on my iPad, which doesn't have any Flash software.

      • by gchat ( 747883 )

        That's strange. I could play the video on my iPad, which doesn't have any Flash software.

        That's because BBC like many other sites, switch to html5 on their mobile site version. Desktop version needs flash though...

    • by AmiMoJo ( 196126 ) <mojo@@@world3...net> on Monday July 31, 2017 @04:07AM (#54912221) Homepage Journal

      The BBC hasn't been at the forefront of tech for many years. They developed a lot of cool stuff back in the day, but their streaming video tech is abysmal. Flash required for BBC News embedded videos, and iPlayer's video quality is terrible ("HD" is only 720p, very low bit rate and poor encoder).

    • No there's something strange for your. I have no problem playing Flash and I even double checked to ensure it was blocked.

  • by jonwil ( 467024 ) on Sunday July 30, 2017 @11:36PM (#54911763)

    This is like all the videos showing Master padlocks opened with hammers and zip ties and things, Let me know when their fancy-pants robot can manipulate open a top-of-the-line Sargent & Greenleaf UL 768 Group 1 rated combination lock in such a short space of time and it might be noteworthy...

    All this video does is show that the Sentry Safe safes are just as crappy as any other product Master Lock makes.

    • by tsa ( 15680 )

      If it was a crappy safe it would take 30 seconds to open it, not 30 minutes.

  • Technology at its very very best. Reports suggest that the underground organizations have already devised a technique which will allow miraculous things to happen like flying a plane without fuel , or flying a car in air . Considering that powerful technologies are being kept secret, some of the effect is bound to occur in the lives of normal people. Lets hope people uses the positive aspect to a much greater use like the Team SParkFun
  • My safe is quite old and crappy and, to open it, you need to input the right combination formed by 4 numbers of 2 digits (around 100 million different possibilities) and use a key.

    Important warning for anyone feeling like cracking my safe: it doesn't contain anything of value. As clearly stated in my profile description, I am (kind of) poor and have no interest in becoming rich, in the sense of acquiring a relevant amount of assets, material goods, enjoying expensive whatever, etc. Why does a (kind of) poo
  • the safe's design allows for a margin of error to compensate for humans getting their combination slightly wrong

    Seriously? The safe is designed to say "Wrong number, but meh, close enough."

    • the safe's design allows for a margin of error to compensate for humans getting their combination slightly wrong

      Seriously? The safe is designed to say "Wrong number, but meh, close enough."

      Yes, seriously. I've opened Sentry safes before and knew I had screwed up the combination, only to find the safe opening because I was apparently close enough.

      Sadly, the safe manufacturer had to design this close-enough feature into their product because humans who want to own cheap safes can't manage to turn a dial accurately. Probably also the same reason we've gone from dials to keypads and fingerprint sensors (which will be cracked next month by a monkey armed with a pack of gummy bears)

  • Does this mean that the next Hollywood heist will contain the line "Bite my shiny metal ass!"?

  • Sentry makes fire protection boxes. Those are not safes to protect again anything but the thief who only has a couple minutes to work. You can see average joes with a prybar and a sledge hammer (to force the bar into the steel coating the concrete) open these safes in less than 15 minutes.

    In fact the mechanism of these "safes" is very much like a bicycle padlock, not a real safe or vault's lock.

  • True story: I got an old keypad safe from a company I used to work for. Nobody knew the combination or had the backup key, so it was just dead weight. When I got it home, I started running through all the possibilities that I could think of to come up with a device to crack it. Would I use an Arduino? LEGO robot? Manually push buttons until I figured it out? Nope. I just opened the battery compartment. Actually, I removed the keypad housing, too. I found a header of some sort that I thought I'd try wiring

Faith may be defined briefly as an illogical belief in the occurence of the improbable. - H. L. Mencken

Working...