Tourist's lucky guess cracks safe code on first try • Hacker News Board

Re: Tourist's lucky guess cracks safe code on first try

#91

Post by dontbenebby » Thu, Jun 27, 2019, 4:32 PM UTC

emerongi wrote: post #33

olalonde wrote: post #28

If the combination does allow for wiggle room and the 1 in 8000 figure is correct, the code could have been brute forced in a couple hours. Source: my wife has a habit of forgetting the combination to her 3 digit luggage lock and I had to brute force it a few times (it's surprisingly quick, about 15 minutes) :)

I bruteforced a 4-digit 2FA in 2 days, of course with the help of a small script instead of trying it myself. It's always fun to see dumb solutions work.

Did you vary your code, or just try the same code until it was the correct one?

Re: Tourist's lucky guess cracks safe code on first try

#92

Post by m463 » Thu, Jun 27, 2019, 4:33 PM UTC

clumpthump wrote: post #88

https://www.cbc.ca/news/canada/edmonton/vermilion-alberta-sa... The CBC article differs in two important aspects. The BBC article says they "enlisted the help of experts", when the CBC article says they just called a locksmith who gave them some combinations to try over the phone. The BBC article makes it sound like some tourist just tried a random combination, while in the CBC article, a machinist put his ear to the…

I think they both tell a similar story. Someone on the tour (a machinist) played with the safe and got it open.

The experts tried it at were at a different time in the past.

Re: Tourist's lucky guess cracks safe code on first try

#93

Post by m463 » Thu, Jun 27, 2019, 4:34 PM UTC

olalonde wrote: post #28

If the combination does allow for wiggle room and the 1 in 8000 figure is correct, the code could have been brute forced in a couple hours. Source: my wife has a habit of forgetting the combination to her 3 digit luggage lock and I had to brute force it a few times (it's surprisingly quick, about 15 minutes) :)

You are a statistically patient outlier. (however, maybe not on hacker news)

Re: Tourist's lucky guess cracks safe code on first try

#94

Post by m463 » Thu, Jun 27, 2019, 4:41 PM UTC

salutonmundo wrote: post #8

jmkd wrote: post #3

Earlier quoted context omitted.

Ha yes, or equivalent to 'password'. Raises the point that humans interacting with machines will always display similar behaviours.

Puts me in mind of Surely You're Joking Mr Feynman ...

I found that chapter really fun and I should try that... But then I think -- he was cracking safes in a military top-secret nuclear research facility!

Re: Tourist's lucky guess cracks safe code on first try

#95

Post by wtetzner » Thu, Jun 27, 2019, 4:54 PM UTC

kingkawn wrote: post #11

jnty wrote: post #4

"The fact that the combination was in a specific pattern and did not appear to be a random combination of numbers could also factor into a calculation of the odds, he added." Hehe. I guess he'll have to produce a list of non-random numbers to work those odds out.

Randomness produces patterns all the time, and if we cut out the patterns that appear, then we are selecting the pattern that we’ve labeled as ‘random.’

I think it was a joke. What would it mean to produce a list of non-random numbers?

Re: Tourist's lucky guess cracks safe code on first try

#96

Post by benj111 » Thu, Jun 27, 2019, 4:58 PM UTC

Its interesting that this is interesting.

People win the lottery all the time, they aren't newsworthy in the 'lucky guess' sense.

On the other hand whenever someone gets out a pack of cards I always try and guess the top card. Eventually I'll get it right.

Re: Tourist's lucky guess cracks safe code on first try

#97

Post by Animats » Thu, Jun 27, 2019, 5:16 PM UTC

pferde wrote: post #2

A combination "20 - 40 - 60" on a dial that goes from 1 to 60... Sounds like an equivalent of a factory-default admin/admin login credentials. I wonder if it really was the default combination that the safe was bought with, and the owners never bothered to change it. :)

Definitely sounds like a default.

When you turn in a container with a classic combination lock in the DoD world, you set the combination to 10-20-30-40. The next person issued the container opens it and sets it to a new combination.

Re: Tourist's lucky guess cracks safe code on first try

#98

Post by fivefive55 » Thu, Jun 27, 2019, 5:48 PM UTC

ThePadawan wrote: post #27

khendron wrote: post #14

Reminds me of the time I was playing a computer game, and right at the beginning you are presented with a door 5-digit combination lock. The objective of the game was to explore the game world and eventually discover all 5 digits of the code. First time I played the game I just randomly entered 5 digits, and the door unlocked.

We have gotten to that point that so many new games are making references to "0451" being the first door code in old video games (System Shock, Deus Ex), you can pretty reliably use it as a first guess [0]. [0] https://www.ttlg.com/forums/showthread.php?t=147925

I remember my uncle playing my copy of Bioshock way back when, he walked up to a random door and typed in 0451 and it opened. My mind was blown.

Re: Tourist's lucky guess cracks safe code on first try

#99

Post by larkeith » Thu, Jun 27, 2019, 5:55 PM UTC

taneq wrote: post #35

chrisseaton wrote: post #10

Earlier quoted context omitted.

> A combination "20 - 40 - 60" on a dial that goes from 1 to 60... Sounds like an equivalent of a factory-default admin/admin login credentials. The article explains that it was a common combination for people to use on this type of safe - "Typical combination lock, three times clockwise - 20 - two times counterclockwise - 40 - once clockwise - 60, tried the handle and it went".

"admin", ""? Nope. "admin", "admin"? Nope. "admin", "passwd"? Yep!

For maximum security, use username "password" with password "admin".

Re: Tourist's lucky guess cracks safe code on first try

#100

Post by cl0ckt0wer » Thu, Jun 27, 2019, 5:55 PM UTC

m463 wrote: post #92

clumpthump wrote: post #88

https://www.cbc.ca/news/canada/edmonton/vermilion-alberta-sa... The CBC article differs in two important aspects. The BBC article says they "enlisted the help of experts", when the CBC article says they just called a locksmith who gave them some combinations to try over the phone. The BBC article makes it sound like some tourist just tried a random combination, while in the CBC article, a machinist put his ear to the…

I think they both tell a similar story. Someone on the tour (a machinist) played with the safe and got it open. The experts tried it at were at a different time in the past.

You can be an expert tourist.