No post body was provided.
How to open a safe
31–40 of 85 posts
Re: How to open a safe
#32Actually the problem here is that it's possible to reinit the PIN when the safe is still closed... so the trick to open the safe is to reinit the PIN then send the new PIN The second problem is the possibility to open the PINpad from the outside with the safe closed. It seem to me that those two problems could easily be fixed by the manufacturer... and I can't understand that they just didn't do it right upfront
The second one is very hard to avoid. The safe could of course have some form of tamper detection/response, but other than that, you can't put the PIN pad in a safe, so a determined attacker will be able to open it (using tools/force if necessary).
Re: How to open a safe
#33Sorry, german only...
Re: How to open a safe
#34I am shocked... absolutely shocked, I say, that Master Lock released a security product to the market that is so badly engineered it is trivial to open.
Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.
Finding vulnerabilities in low security locks is just an academic exercise.
If you need high security, you are buying a product very different than a master lock, and you need to consider the integrity of the entire system it is connected to.
Low security locks work mainly by deterrent, and even if they were without vulnerability, the container you’re attaching it to probably is vulnerable. Brute force attacks are the much more common scenario against low security locks, and there’s not much of a low cost solution to that; it requires expensive materials: https://youtu.be/2guvwQvElA8
If you put an unpickable lock on sheet metal box, you’re spending more money, but not actually improving security.
The reason that master locks are popular is because they are fairly reliable, easy to get keys for, have useful feature sets, etc. These are the features that commercial users often care about the most. They don’t want to spend more money to get an unpickable lock that interrupts their daily business when it inevitably gets dirty, keys are lost, etc. especially if it provides no additional resistance against an angle grinder.
Re: How to open a safe
#35To be honest, I would go with a manual dial/lock/safe/etc. I don't trust most mass produced electronic physical security stuff (consumer grade or affordable stuff anyways). The non-electronic stuff is still vulnerable, but it's not this fast to attack.
In large, high-end gun safes like Liberty, it is difficult to find them with mechanical locks anymore. They just don't make them.
Is Liberty really high-end? I would have thought they were mid-grade. I think most places have options for mechanical or electronic. Granted the electronics on those should be considerably better than the ones in the article, at least from a simple access perspective of not pulling the keypad off from the outside.
Re: How to open a safe
#36I love the idea he links at the end to implement TOTP using an arduino/esp8266 [1] inside the safe, to derive the opening PIN.
Re: How to open a safe
#37To be honest, I would go with a manual dial/lock/safe/etc. I don't trust most mass produced electronic physical security stuff (consumer grade or affordable stuff anyways). The non-electronic stuff is still vulnerable, but it's not this fast to attack.
+ Means
+ Motive
+ Opportunity
You want your thing to be very safe? Forget the safe, throw it in the ocean encased in a cement block. Very secure, will not be retrieved. Note - I said ocean, not a lake.
Biometric and pin pad locks are quick. Less secure sure but quick.
If an attacker has the triangle of means (tools, knowledge), motive and opportunity (physical access) then any lock can be defeated if only because you can torch through the lock.
Security is always a tradeoff. "More" secure is not always the correct tradeoff.
Re: How to open a safe
#38All of those electronic locks are garbage. Last year I bought a safe with a S&G mechanical spin-dial lock. Those are GSA approved. S&G also has electronic spin-dial locks, but they do not seem to be available as an option on consumer/commercial safes.
Re: How to open a safe
#39I can't even imagine what happened here. I do quite a bit of coding on front panels like this for my job engineering industrial controls. Even without the need for security, I wouldn't allow a front panel to make decisions. It has only two jobs, to accurately display what it is asked to and to report in a timely manor what keys have been pressed. Doing more than that is not only unnecessary, but it reduces the abilit…
The vulnerability is not in the front panel. It‘s the panel on the inside that accepts a code reset command without valid authentication.
It's a vulnerability in the inside panel that was covered up by requiring the front panel to do more than it should. If the front panel were just a dumb I/O device, the inside panel could not have this specific vulnerability.
Re: How to open a safe
#40I am shocked... absolutely shocked, I say, that Master Lock released a security product to the market that is so badly engineered it is trivial to open.
Judging by the fact that master lock is still widely sold, it’s not common knowledge how crap they are.
No post body was provided.