Is there any chance that this vulnerability was created intentionally for e.g. law enforcement access? One could imagine that the manufacturer would provide LEO a similar device and instructions.
Not that it would in any way excuse it.
How to open a safe
21–30 of 85 posts
Re: How to open a safe
#22I would really hope that people who make security tools would have the best-of-breed electronic engineers but clearly not. The crack was pretty rudimentary and would take an experienced electronics test technician about an hour by the looks of it. "No response". Understandable when you don't have any way to easily put it right, although I suppose they could have at least asked OP to keep it a secret until they could…
What do people expect when buying a mostly plastic safe?
Re: How to open a safe
#23Earlier quoted context omitted.
LockPickingLawyer actually covers this topic, from an access control system context. https://www.youtube.com/watch?v=0SEHUqkbIjU TL;DW Decision making should be on the secure side of the door, and communication should be encrypted.
Encryption alone doesn't prevent replay attacks, you need something more advanced; for example controller generates a nonce, reader hashes secret + nonce, controller compares to expected value.
Eh, the article's about a safe with a keypad.
An attacker who can intercept and replay the comms between the keypad and the controller, can probably also intercept and replay the signals from the physical buttons into the keypad's microchip. Or perhaps more likely, point a hidden camera at the keypad.
Re: How to open a safe
#24Earlier quoted context omitted.
Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.
The more hassle involved with breaking the lock the harder it is to be steal, that makes sense. Don't forget about security by obscurity, though. Let's say a criminal with a bolt cutter finds their way to an unattended gym locker room and they can only have time to snip one or two locks. The majority of the lockers have generic Master Locks, a few have some exotic "ultra-secure" locks on them. Do they randomly snip a…
Wouldn't that be a bad example? That they could still snip the better locks seems like they're not really better. In general, you would want a lock that they would need a special tool that they didn't bring. For example, maybe the thief could have cut(saw) the higher end locks, but they only brought bolt cutters because they're faster and work on 90% of the locks.
Re: How to open a safe
#25To be honest, I would go with a manual dial/lock/safe/etc. I don't trust most mass produced electronic physical security stuff (consumer grade or affordable stuff anyways). The non-electronic stuff is still vulnerable, but it's not this fast to attack.
Re: How to open a safe
#26Is there any chance that this vulnerability was created intentionally for e.g. law enforcement access? One could imagine that the manufacturer would provide LEO a similar device and instructions. Not that it would in any way excuse it.
Safes like this are more meant to be tamper-evident and hard to move than impervious, which is why you always want to bolt your safe down to something solid if you have one like this.
A warrant and a circular saw will get you through really any consumer safe in seconds so I highly doubt they would go through all that risk to make it slightly easier to access but maybe there's concern of damaging evidence with forced entry or something.
Re: How to open a safe
#27Earlier quoted context omitted.
LockPickingLawyer actually covers this topic, from an access control system context. https://www.youtube.com/watch?v=0SEHUqkbIjU TL;DW Decision making should be on the secure side of the door, and communication should be encrypted.
Encryption alone doesn't prevent replay attacks, you need something more advanced; for example controller generates a nonce, reader hashes secret + nonce, controller compares to expected value.
I was thinking the same thing. Encryption still wouldn't prevent the replay attack, just the ability to determine the card's number and flash it onto a new card.
Re: How to open a safe
#28Earlier quoted context omitted.
The vulnerability is not in the front panel. It‘s the panel on the inside that accepts a code reset command without valid authentication.
That is a vulnerability in the front panel. The front panel is deciding based on the reply from the 'enter factory code' command that it is ok to send the 'reset user code' command. The front panel should not be making decisions like that. The front panel should not be sending commands at all.
I think you are misunderstanding what old mate is saying.
The vuln is in the back of the panel because it's accepting the reset code command. The front panel isn't vulnerable because it's not a trusted component here anyway, the bypass actually just talks directly to the back panel.
You are however correct that the front panel probably shouldn't be sending an actual reset code command, but that is really a protocol level problem not specifically a front panel issue. It's possible to make that safe by having the back panel first transition into appropriate state upon being primed with existing code or valid factory code before accepting the reset command but an even better fix is to couple both the validation of the existing code + the desired new code into a single command that is validated in one shot.
Re: How to open a safe
#29Is there any chance that this vulnerability was created intentionally for e.g. law enforcement access? One could imagine that the manufacturer would provide LEO a similar device and instructions. Not that it would in any way excuse it.
Safes like this are more meant to be tamper-evident and hard to move than impervious, which is why you always want to bolt your safe down to something solid if you have one like this. A warrant and a circular saw will get you through really any consumer safe in seconds so I highly doubt they would go through all that risk to make it slightly easier to access but maybe there's concern of damaging evidence with forced…
The nice thing about this is that it's still tamper-evident, despite being opened non-violently. The PIN suddenly changed, so the owner knows that someone messed with their safe. Whether they did so by picking the backup lock or by using technology doesn't matter, the safe was obviously breached.
The safe would've lost its purpose entirely if it was possible to open the lock without resetting the PIN. I'm sure there's a vulnerability in there that allows for that (after all, the microcontroller allows for opening the safe without entering the right code, a very basic mistake to make!) but this project doesn't entirely defeat the safe yet.
Re: How to open a safe
#30To be honest, I would go with a manual dial/lock/safe/etc. I don't trust most mass produced electronic physical security stuff (consumer grade or affordable stuff anyways). The non-electronic stuff is still vulnerable, but it's not this fast to attack.
In large, high-end gun safes like Liberty, it is difficult to find them with mechanical locks anymore. They just don't make them.