Safe-cracking: Difference between revisions
| Line 18: | Line 18: | ||
=== Guessing the combination === |
=== Guessing the combination === |
||
A safe may be compromised surprisingly often by simply guessing the combination. This results from the fact that manufactured safes often come with a manufacturer-set combination. This combination is designed to allow the owner initial access to the safe so that they may set their own new combination. |
A safe may be compromised surprisingly often by simply guessing the combination. This results from the fact that manufactured safes often come with a manufacturer-set combination. This combination (known as a try-out combination) is designed to allow the owner initial access to the safe so that they may set their own new combination. Sources exist which list manufacturers try-out combinations. |
||
Combinations are also unwittingly compromised by the owner of the safe by having the lock set to easy-to-guess combinations such as a birthdate or driver's license number. |
Combinations are also unwittingly compromised by the owner of the safe by having the lock set to easy-to-guess combinations such as a birthdate or driver's license number. |
||
Sources exist which list manufacturers try-out combinations. |
|||
=== Autodialers === |
=== Autodialers === |
||
Revision as of 04:59, 18 August 2008
Safe-cracking is the process of opening a safe, generally without the combination. It may also refer to a computer hacker's attempts to break into a secured computer system.
Physical safe-cracking
Different procedures may be used to crack a safe, depending on its construction. Different procedures are required to open different safes so safe-crackers need to be aware of the differences.
Lock manipulation
The most surreptitious way of cracking a safe is to manipulate the lock in order to obtain the combination required to open the safe without actually damaging the safe.
Some rotary combination locks can be manipulated by feel or sound in order to determine the combination required to open the safe. More sophisticated locks use wheels made from lightweight and soft materials such as nylon, which reduces this vulnerability. Another anti-manipulation mechanism is serrated wheels (false tumbler notches) that make tactile techniques much more difficult. Another defense is a clutch-type driver wheel that prevents contact of the fence to the tumblers except in one position. These locks can be identified by a "click-click" feeling in the dial or by a dial that is pushed in and turned. Manipulation is the locksmith's preferred choice in lost-combination lockouts, since it requires no repairs or damage, but can be extremely time consuming due to lock improvements over the years, and is also a difficult art to master. Some combination padlocks can also be manipulated by pulling and applying leverage on the shackle while turning each dial to determine the combination required to unlock them.
In the absence of any other information regarding the safe's combination, a combination lock may be opened by dialing every possible combination. Richard Feynman[1] discovered that many combination locks allow some "slop" in the settings of the dial, so that for a given safe it may be necessary only to try a subset of the combinations. This drastically reduces the time required to exhaust the number of meaningful combinations. A further reduction in solving time is obtained by trying all possible settings for the last wheel for a given setting of the first wheels before nudging the next-to-last wheel to its next meaningful setting, instead of zeroing the lock each time with a number of turns in one direction.
Guessing the combination
A safe may be compromised surprisingly often by simply guessing the combination. This results from the fact that manufactured safes often come with a manufacturer-set combination. This combination (known as a try-out combination) is designed to allow the owner initial access to the safe so that they may set their own new combination. Sources exist which list manufacturers try-out combinations.
Combinations are also unwittingly compromised by the owner of the safe by having the lock set to easy-to-guess combinations such as a birthdate or driver's license number.
Autodialers
A number of companies and groups have developed autodialing machines to open safes. Unlike mythical machines that can open a combination in seconds, such machines are usually specific to a particular type of lock and must cycle through thousands of combinations to open a device. A good example of such a device is a project completed by two students from the Massachusetts Institute of Technology - Kyle Vogt and Grant Jordan. Their machine, built to open a Sargent and Greenleaf 8400 lock on a Diebold Safe, found an unknown combination in 21,000 tries. [2] Lockmasters, Inc. markets two autodialing machines that work on a variety of 3 digit combination safe locks. [3]
There also exists a device called soft drill, that is like an autodialer except it listens to the lock and with the aid of a computer makes logic decision like a human manipulator would do. A success rate of 95% has been given to this type of machine.
Compromising a weak point on the safe (Drilling)
While most safes are hard to open, most are susceptible to compromise by drilling or other physical methods. Manufacturers publish drill-point diagrams for specific models of safe. These are tightly guarded by both the manufacturers and locksmithing professionals. Drilling is usually aimed at gaining access to the safe by observation or bypass of the locking mechanism. Drilling is the most common method used by locksmiths, and is the only method that can be used in cases of burglary attempts, malfunctioning locks or damaged locks.
In observational attacks, the drill hole allows the safecracker to view the internal state of the combination lock. Drill-points are often located close to the axis of the dial on the combination lock, but observation may sometimes require drilling through the top, sides or rear of the safe. While observing the lock, the locksmith manipulates the dial to align the lock gates so that the fence falls and the bolt is disengaged.
Bypass attacks involve physical manipulation of the bolt mechanism directly, bypassing the combination lock.
All but the simplest safes are designed to protect against drilling attacks through the implementation of hardplate steel (extremely wear resistant) or composite hardplate (a casting of metal such as cobalt-vanadium alloys with embedded tungsten carbide chips designed to shatter the cutting tips of a drill bit) within the safe, protecting the locking mechanism and other critical areas such as the locking bolts. The use of hardplate ensures that conventional drilling is not successful when used against the safe. Drilling through hardplate requires the use of special-purpose diamond or tungsten-carbide drill-bits. Even then, this can be a time-consuming and difficult process with safes equipped with modern composite hardplates.
Some high security safes use what is called a glass relocker. It is a piece of tempered glass mounted between the safe door and the combination lock. It has wires attached to the edges. These wires lead to randomly located, spring-loaded bolts. If an attempt is made to penetrate the safe, the drill or torch breaks the glass, releasing the bolts. These bolts block the retraction of the main locking bolts. To drill a safe with a glass relocker, side, top, or rear drilling may be necessary. Many modern high-security safes also incorporate thermal relockers in conjunction with glass-based relockers (usually a fusible link as part of the relocker cabling), which also activate when the temperature of a safe exceeds a certain level as a defense against torches and thermal lances.
Drilling is an attractive method of safecracking for locksmiths, as it is usually quicker than manipulation, and drilled safes can generally be repaired and returned to service.
Punching, peeling and using a torch are other methods of compromising a safe. Peeling involves removing the outer skin of the safe.
Plasma cutters and thermal lances are hotter than oxyacetylene torches and can be used to burn through the metal on a safe.
Brute force methods
Other methods of cracking a safe generally involve damaging the safe so that it is no longer functional. These methods may involve explosives or other devices to inflict severe force and damage the safe so it may be opened. This method requires care as the contents of the safe may be damaged. Safe-crackers can use what are known as jam shots to blow off the safe's doors.
Most modern safes are fitted with 'relockers' (like the one described above) which are triggered by excessive force and will then lock the safe semi-permanently (a safe whose relocker has tripped must then be forced, the combination or key alone will no longer suffice). This is why a professional safe technician will use manipulation rather than brute force to open a safe so they do not risk releasing the relocker.
Radiological methods
Penetrating radiation such as X-ray radiation can be used to reveal the internal angular relationship of the lock's internal mechanism to deduce the combination. Modern safe locks are made of lightweight materials such as nylon to frustrate this technique, since most safe exteriors are made of much denser metals.
Tunneling into bank vaults
Large bank vaults which are often located underground have been compromised by safe-crackers who have tunneled in using digging equipment. This method of safe-cracking has been countered by building patrol-passages around the underground vaults. These patrol-passages allow early detection of any attempts to tunnel into a vault.
History
Secured boxes have existed for centuries, but it wasn't until the late 18th century that use of cast iron became widespread and was used to create solid metal boxes. During the 19th century, safe-cracking techniques (known as box jobs[citation needed]) became widely used in bank robberies. In the 20th century, improvements in steel production and a decreasing reliance on physical currency led to a decrease in the popularity of safe cracking.
Media depictions
Movies often depict a safe-cracker determining the combination of a safe lock using their fingers or a sensitive listening device to determine the combination of a rotary combination lock. Other films also depict an elaborate scheme of explosives and other devices to open safes.
Some of the more famous movies include:
- A Retrieved Reformation (1909)
- You Only Live Twice (film) (1967)
- On Her Majesty's Secret Service (film) (1969)
- Thunderbolt and Lightfoot (1974)
- Thief (1981)
- Vabank (1981)
- Short Circuit 2 (1988)
- Die Hard (1988)
- Hudson Hawk (1991)
- Killing Zoe (1994)
- Heat (1995)
- Safe Men (1998)
- The Newton Boys(1998)
- Blue Streak (1999)
- Small Time Crooks (2000)
- Ocean's Eleven (2001)
- The Score (2001)
- The Italian Job (2003)
- Bad Santa (2003)
- Brainiac (2003) The Safe was eventually cracked by a kinetic energy round fired using a Challenger 2 Tank.
- The Ladykillers (2004)
- The Bank Job (2008)
Three safecracking methods seen in movies were also tested on the television show MythBusters, with some success. [4]
References
- ^ Richard P. Feynman as told to Ralph Leighton; edited by Edward Hutchings (1985). "Surely you're joking, Mr. Feynman!": adventures of a curious character. New York: W.W. Norton. ISBN 0-393-01921-7.
{{cite book}}:|author=has generic name (help)CS1 maint: multiple names: authors list (link) - ^ "Vogt, Kyle, On Robotics and Changing the World, retrieved 2007-05-19
{{citation}}: Cite has empty unknown parameter:|1=(help) - ^ "Safe Lock Servicing" (PDF) (Press release). Lockmasters, Inc. Retrieved 2007-05-19.
- ^ "Crimes and Myth-Demeanors 1". Mythbusters. Season 4. Episode 54. July 12, 2006.
{{cite episode}}: Check date values in:|airdate=(help); Unknown parameter|episodelink=ignored (|episode-link=suggested) (help); Unknown parameter|serieslink=ignored (|series-link=suggested) (help)