I can't even imagine what happened here. I do quite a bit of coding on front panels like this for my job engineering industrial controls. Even without the need for security, I wouldn't allow a front panel to make decisions. It has only two jobs, to accurately display what it is asked to and to report in a timely manor what keys have been pressed. Doing more than that is not only unnecessary, but it reduces the ability to easily re-use it as a drop in module in other products, and it makes the architecture of the system more confusing. Clearly somebody had other ideas here, but I can't see why.
How to open a safe
11–20 of 85 posts
Re: How to open a safe
#12I can't even imagine what happened here. I do quite a bit of coding on front panels like this for my job engineering industrial controls. Even without the need for security, I wouldn't allow a front panel to make decisions. It has only two jobs, to accurately display what it is asked to and to report in a timely manor what keys have been pressed. Doing more than that is not only unnecessary, but it reduces the abilit…
The vulnerability is not in the front panel. It‘s the panel on the inside that accepts a code reset command without valid authentication.
Re: How to open a safe
#13I am shocked... absolutely shocked, I say, that Master Lock released a security product to the market that is so badly engineered it is trivial to open.
Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.
Re: How to open a safe
#14I can't even imagine what happened here. I do quite a bit of coding on front panels like this for my job engineering industrial controls. Even without the need for security, I wouldn't allow a front panel to make decisions. It has only two jobs, to accurately display what it is asked to and to report in a timely manor what keys have been pressed. Doing more than that is not only unnecessary, but it reduces the abilit…
The vulnerability is not in the front panel. It‘s the panel on the inside that accepts a code reset command without valid authentication.
That is a vulnerability in the front panel. The front panel is deciding based on the reply from the 'enter factory code' command that it is ok to send the 'reset user code' command. The front panel should not be making decisions like that. The front panel should not be sending commands at all.
Re: How to open a safe
#15pretty slick. extra bump for pen used for tool housing... pen-testing :)
Re: How to open a safe
#16Does an electronic lock of the kind where the keypad is on the insecure side of the door generally contain or not contain the mechanism to open that door? How is that mechanism normally secured? Edit: I mean here it looks like that ripping off the front-panel and powering the solenoid will get you into the safe.
LockPickingLawyer actually covers this topic, from an access control system context. https://www.youtube.com/watch?v=0SEHUqkbIjU TL;DW Decision making should be on the secure side of the door, and communication should be encrypted.
Encryption alone doesn't prevent replay attacks, you need something more advanced; for example controller generates a nonce, reader hashes secret + nonce, controller compares to expected value.
Re: How to open a safe
#17I am shocked... absolutely shocked, I say, that Master Lock released a security product to the market that is so badly engineered it is trivial to open.
Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.
The more hassle involved with breaking the lock the harder it is to be steal, that makes sense. Don't forget about security by obscurity, though. Let's say a criminal with a bolt cutter finds their way to an unattended gym locker room and they can only have time to snip one or two locks. The majority of the lockers have generic Master Locks, a few have some exotic "ultra-secure" locks on them. Do they randomly snip a locker with a generic Master Lock, or do they pick the bright-orange-ultra-secure-lock-probably-hiding-a-tablet-and-laptop locker?
Re: How to open a safe
#18“ And I put all of this in a pen... to have a real pen-test tool.” perfect :)
Re: How to open a safe
#19Actually the problem here is that it's possible to reinit the PIN when the safe is still closed... so the trick to open the safe is to reinit the PIN then send the new PIN
The second problem is the possibility to open the PINpad from the outside with the safe closed.
It seem to me that those two problems could easily be fixed by the manufacturer... and I can't understand that they just didn't do it right upfront
Re: How to open a safe
#20I am shocked... absolutely shocked, I say, that Master Lock released a security product to the market that is so badly engineered it is trivial to open.
Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.
Same logic for basic deadbolts in the US (kiwkset/schlage/etc).