PDA

View Full Version : Safecracking 101


KenSFO
09-02-2007, 9:47 AM
Here are a few YouTube videos of how easy it is to open a few cheap home safes, a Honeywell with electronic lock, for example.

http://www.youtube.com/profile_videos?user=LockPicksPlusdotCom

Have one of these? You can be sure that you'll never have to worry about opening it if you lose the combination, just ask the corner crack head. I hope you're not keeping a pistol in one of these to keep it out of the reach of your teenager. This info will be all over the country in a few weeks, just like the Bic pen kryptonite trick.

This trick is brought to you by Mike Ornelas of Boynton Beach, FL. He's a convicted burglar and jewel thief who, along with a cop and pawn broker, ran an interstate burglary ring for a few years. He's also a former safe and vault tech who has been shunned by the entire industry for what he did.

I'm pretty sure I know how you guys feel about burglary, but how do you feel about selling this kind info to the general public? Is it a public service or a violation of trust or something else?

KenSFO

rivviepop
09-02-2007, 10:56 AM
We know how I feel about this. :) Those 3 safes (didn't watch the other three videos) are defective by design, I'm surprised at how easy it looks -- even a guy like me could probably open those. The company/companies selling the product will lose money if they told everyone about the problems, so of course they may never disclose to the public. The only person who loses is the consumer who purchased the product, not knowing they have an insecure product. Morally this is bankrupt, a security company should be ashamed - I welcome videos such as these to spread knowledge.

Aside: I notice all three are electronic safes; would this same ease-of-breakin be present with a classic dial/manual safe? It seems like the exploit in all three cases involved a defective design of one of the interwoven electronic based components (such as the weak springs used on the bolts so that an electronic mechanism can pull them back), a gut instinct on my part thinks that a manual safe would be more immune to such hacks.... no?

Fjold
09-02-2007, 11:16 AM
Interesting videos. Because the electronic safes use solenoids they are probably the easiest to get into.

If the guy would buy an electric screwdriver the videos would go quicker.

rkt88edmo
09-02-2007, 11:41 AM
Solenoids and reset switches.

If the resets were more like a mechanical safe and key driven it would make it much more difficult.

As for the solenoids, well, I suppose you would need multiple solenoids running in different directions to make it more bounceproof, which would drive up cost a bit. Also, if the lockboxes were mounted, you wouldn't be able to bounce them or access them from the rear readily.

Nothing done here is groudbreaking, just some simple reverse engineering greatly speeded up by his familiarity with safe and locks.

I think the publicity is good, people need to know that these devices are weak from a security standpoint. Relying on "semisecret industry and trade standards" or "security by obscurity" for mass produced mechanical devices is no longer feasible in this day and age.

KenSFO
09-02-2007, 12:18 PM
Every one of these cheap boxes, whatever design they use, have similar vulnerabilities. If you were to go out and buy one of each and spend half an hour experimenting, you could (and many pros have) come up with easy even covert defeats for every one of them.

Just like with gun safes, the customer is convinced that it is a "safe" because that's what the makers and sellers are calling them. Most consumers seem to be more impressed with the paint job than the attributes that actually make it a safe, or not. Add the "WalMart mentality", that most consumers seem to have adopted lately, to the sale hype formula and this is the result.

These are all what we call "open" safe designs. Conversely, electronic locking designs that are housed within a standard, retrofitable lock case i.e. "closed" designs, are less vulnerable to attack because the locks can be protected by the use of compact barriers, glass nerve plates and deflectors because there is much less physical area to protect resulting in much less cost to do so. These can be modularized for use on any safe that uses a standard footprint lock design which further reduces the cost to the maker and supposedly to the consumer.

KenSFO

KenSFO
09-02-2007, 12:34 PM
My computer keyboard is having problems and frequently drops commas resulting in poor readability if I don't do a proof/preview and go to the extra effort of reinserting the punctuation, first.

KenSFO

surprised
09-02-2007, 3:13 PM
I'm pretty sure I know how you guys feel about burglary, but how do you feel about selling this kind info to the general public? Is it a public service or a violation of trust or something else?
KenSFO
If you were to go out and buy one of each and spend half an hour experimenting, you could (and many pros have) come up with easy even covert defeats for every one of them.
KenSFO
I'm with rivviepop (what he posted in the other thread (http://calguns.net/calgunforum/showpost.php?p=729165&postcount=35) .
If the manufacturer had advertised the safe as "Can be opened by thiefs in less than a minute with tools found in your own home!", then I would argue that the disclosure of the specific mechanism is not constructive. But if the manufacturer leads the buyers to believe they are purchasing safety, I think it is worthwhile proving that is not the case. Maybe that can be done in a credible manner without revealing the specific mechanism, but I would say that the primary violation of trust is with the manufacturer.

I believe the UL standards allow a thorough inspection of the safe before attempting to open it. To me, the ultimate in safety would be if experts could affirm that they know exactly how it works, but that they still could not crack it in a reasonable time. And that's the way it is with cryptography.

KenSFO
09-03-2007, 8:18 AM
I'm with rivviepop (what he posted in the other thread (http://calguns.net/calgunforum/showpost.php?p=729165&postcount=35) .
If the manufacturer had advertised the safe as "Can be opened by thiefs in less than a minute with tools found in your own home!", then I would argue that the disclosure of the specific mechanism is not constructive. But if the manufacturer leads the buyers to believe they are purchasing safety, I think it is worthwhile proving that is not the case. Maybe that can be done in a credible manner without revealing the specific mechanism, but I would say that the primary violation of trust is with the manufacturer.

I believe the UL standards allow a thorough inspection of the safe before attempting to open it. To me, the ultimate in safety would be if experts could affirm that they know exactly how it works, but that they still could not crack it in a reasonable time. And that's the way it is with cryptography.



UL testing, for the most part is done by employees of UL. One exception is when they wish to test mechanical safe locks that claim a certain degree of resistance to expert manipulation. These tests are performed by highly skilled safe lock manipulators from the safe and vault industry under very strict guidelines and testing conditions. It's not just pass-fail. They manipulate until it's open or they exceed the time that UL is willing to pay for. The data from all testers is averaged and if the average exceeds the time being tested for, then the lock receives the rating. Sometimes locks are opened before the listed time and they fail. Sometimes they are opened in longer than the listed time and they pass. Sometimes they are opened in a time which is appropriate for a higher rated lock. Unfortunately that lock only receives the rating they applied and tested for.

Othe tests on locks can be done by UL personnel because they are only measuring tolerances and other physical parameters.

The vulnerabilities being exposed in the videos require no special skills to accomplish. Publicly exposing them may seem righteous or even noble to some, but serves no useful purpose, especially not to those who were already naive enough to believe that they were buying security for $199.

Anybody have strong feelings about publicly exposing serious vulnerabilities that have been found in AmSec, Fort Knox, Cannon, Liberty, Pro-Steel and other popular gun safes that claim superior security?

As I said, I don't sell gun safes, but I do sell small laptop-size boxes that makers claim are secure. These products have their place, as does the Sentry fire boxes. When somebody asks me my opinion of the security they provide, I refer to the price and say: "What do you want for $199? You don't get it unless you pay for it!"

KenSFO

rkt88edmo
09-03-2007, 9:21 AM
The vulnerabilities being exposed in the videos require no special skills to accomplish. Publicly exposing them may seem righteous or even noble to some, but serves no useful purpose, especially not to those who were already naive enough to believe that they were buying security for $199.

Anybody have strong feelings about publicly exposing serious vulnerabilities that have been found in AmSec, Fort Knox, Cannon, Liberty, Pro-Steel and other popular gun safes that claim superior security?


I still don't understand your position, you are putting down people as being "naive" for believing they are purchasing a product that will provide security. If these videos weren't out there how would "Joe Public" learn what is safe and secure and what is not? At the same you seem to be suggesting these videos, which would educate consumers, should not be distributed.

It may seem common sense to you, but most people don't take a lot of time to make an educated decision about buying safes and they rely on the companies. The more you post these the more I am convinced they are necessary.

If there are serious vulnerabilities, then yes, they should be exposed.

KenSFO
09-03-2007, 10:56 AM
I still don't understand your position, you are putting down people as being "naive" for believing they are purchasing a product that will provide security. If these videos weren't out there how would "Joe Public" learn what is safe and secure and what is not? At the same you seem to be suggesting these videos, which would educate consumers, should not be distributed.

It may seem common sense to you, but most people don't take a lot of time to make an educated decision about buying safes and they rely on the companies. The more you post these the more I am convinced they are necessary.

If there are serious vulnerabilities, then yes, they should be exposed.

Why do consumers not take the time to educate themselves about what they want to buy? Anybody with half a brain knows that a Yugo isn't the same quality as a Mercedes Benz, but the easiest way is to compare prices. If you buy a safe for $199 and don't ask the seller if it meets your expectations of security, then who's to blame? If you ask and are told by the salesman that it does, then you've got a remedy available to you under specific or implied warranties, suitability for purpose and other consumer protections.

It's a matter of harm. If, as you suggest, consumers don't care to educate themselves, then don't these videos mostly serve to educate criminals, subjecting buyers to additional risks that realistically didn't exist before. There's nothing in those videos that most locksmiths and safe technicians don't already know. We don't talk about it outside the trade because of the ethical concern that the harm outweighs the good. Why educate criminals?

If you shop for quality with a reputable, knowledgeable dealer, you may pay a little more, sometimes a lot more. I get calls all the time from people who ask about the relative quality of safes that they found on the internet. They want to know, from an expert, whether it's a good safe and a good deal. I say: Why are you asking me? Shouldn't you be asking these questions of that discount internet safe seller? Customer service is expensive!

I also get calls from people who can't get their safe open. I give them a price based on my expertise and time. They tell me that they didn't pay that much for the safe. I tell them that if it's a cheap safe, then just throw it away and buy a new one. "...but I still have to get my stuff out of it!" Ahhhhhh, there's the rub. So it's not about what you paid for it? :eek:

The axiom is that you get what you pay for. My axiom is that if you buy cheap with your eyes closed, you get much less than what you pay for.
KenSFO

metalhead357
09-03-2007, 11:22 AM
Ken,

Can ya' please confirm or dispell a myth for me? I've seen the crap about bumping on 'regular' locks with a flat key....but have only read that it can be done also with the cylindrical key types as well. Hope I'm explaining myself...I dont know the key name(s) but they're the round keys oft found on kyptonite locks, soda machines....and some generic safes/lockers.....

Are these bumpable or need I worry about one of my lockers?

rivviepop
09-03-2007, 11:29 AM
At some point the idea of disclosure starts to border on a political argument style - there are two camps of believers, and even though we debate the issue (calmly, intelligently - unlike politics :) ) there's rarely a chance one side will sway over to join the other side.

A stab at the camps in my view:

a) "secrecy" - the camp who believes that the information is best withheld from the public in concern and interest for their own wellbeing and safety, as well as to not educate the ne'er-do-well persons who would mis-use the information for nefarious gains.

b) "full disclosure" - the camp that believes camp (a) should not try and think they can protect camp (b), instead the information should be free and let the camp (b) people make their own informed choices and choose how to protect themselves - regardless of the outcome.

I'm firmly in camp (b) of course, and liken this safe disclosure matter to things like the FOIA -- do not try and protect me with what you think is best, because I do not think that is best. Give me the information and let me make my own informed decisions based on the facts in evidence.

Both camps have 100% valid viewpoints - while I don't subscribe to (a), I do understand the beliefs and that the members truly think they're doing the right thing - just like camp (b). Unfortunately we here on the forum are probably more enlightened than the average sidewalk safe buyer -- they want to trust the marketing and box information a safe seller provides them, and are led to believe that this cheaper product is just as good as the more expensive one.

Just like David Hannum (not PT Barnum, go look it up) said, there's a sucker born every minute - welcome to capitalism.

rkt88edmo
09-03-2007, 11:53 AM
Why do consumers not take the time to educate themselves about what they want to buy? Anybody with half a brain knows that a Yugo isn't the same quality as a Mercedes Benz, but the easiest way is to compare prices. If you buy a safe for $199 and don't ask the seller if it meets your expectations of security, then who's to blame? If you ask and are told by the salesman that it does, then you've got a remedy available to you under specific or implied warranties, suitability for purpose and other consumer protections.

It's a matter of harm. If, as you suggest, consumers don't care to educate themselves, then don't these videos mostly serve to educate criminals, subjecting buyers to additional risks that realistically didn't exist before. There's nothing in those videos that most locksmiths and safe technicians don't already know. We don't talk about it outside the trade because of the ethical concern that the harm outweighs the good. Why educate criminals?


I don't think the car analogy works - Americans generally know a lot about cars from a very young age - but most will never know much about safes EVER. New buyers have no idea what is cheap and what is expensive. I would guess that a 2 foot square box with a locking door for $200 sounds expensive to most people.

I think people are willing to educate themselves if the information is out there.

I think rivvie is pretty much right about the end argument, and I'm more on an open market and transparency guy. I do disagree with the secrecy point being just as valid.

You can't educate customers without risking educating criminals.

Satex
09-03-2007, 1:24 PM
Why do consumers not take the time to educate themselves about what they want to buy?

Are you asking a rhetorical question or do you really not know the answer? The answer is quite simple: all safe manufacturers claim their safes are fire and burglary resistant, but how is a consumer to validate that? Check out threads on this site and you will see statements like ďMy Costco safe is great Ė I have had if for 5 years nowĒ. But folks who make that statement never had a burglary attempt or fire. So to compare it to your car example, its like purchasing a car, but never driving it. So of course itís a great car.
Since comparing safe quality side by side is so difficult, people evaluate the safe based on the paint job and the internal upholstery.
Also, people donít understand that RSC doesnít mean squat. Most people donít purchase real TL safes, so we all get screwed.

BTW, how would you educate yourself? Last time I walked into a Liberty dealer and asked to look inside a door he laughted at me.

KenSFO
09-03-2007, 2:39 PM
In response, and to continue the car analogy, auto makers claim quite specific mpg figures for their cars. Has anybody EVER gotten the same milage as claimed on the window sticker?

Here's another example. Years ago, there were no controls on cigarette advertising and strict controls on prescription drug advertising. Now that situation is reversed.

Are those people who go to their doctor asking for something to treat their "restless leg syndrome" going because they were hoping there was a cure for this rarely diagnosed malady or because of the advertisement they saw on TV? If you've seen that ad, I'm sure you were thinking two things: What is RLS and isn't the cure potentially worse than the symptoms of R.L.S.?

Were those folks who continued to smoke cigarettes because they saw a "doctor" smoking and not worrying about cancer, lung and heart disease, in those '50s TV ads being duped or were they duping themselves because they really didn't want to quit?

I think we all know the answers to these questions and I'm sure we can come up with additional examples. There, I said it, so nobody has to guess if my questions are rhetorical. :-)

As I stated in my very first post on this forum, I'm here to answer questions, i.e. inform you about what I am knowledgeable and qualifed in. If that means that some of you become more informed consumers and make intelligent buying decisions, that's great. If you don't, that's OK, too. I have a satyrical sense of humor. Don't let that throw you!

There are a couple of public forums, just like this one, that are staffed and/or moderated by Locksmiths and Safe and Vault Technicians who attempt to educate the public about locks, safes and related services. Unfortunately, most questions that are posted have to do with how to open locks and safes (for free) or inquiries about the value of the old safe in their garage, but rarely about what constitutes a quality lock or safe or what is appropriate security, fire and burglary protection.

My experience is that most public info seekers don't like the answers they receive because the answers aren't easy, cheap or free, i.e. they involve costs. Cost of a better safe, cost to upgrade, cost to restore or repair a classic antique to increase it's value or usefulness, etc.

You can Google or Ask.com and usually come up with the link to this site, but here's a direct link to the longest established lock and safe site on the internet:

ClearStar Security Network
http://www.clearstar.com/public/pubboard.htm

If you wander on over and peruse the existing threads, I'm sure you will get a feel for what I've been saying. If you ask intelligent questions, you will usually receive intelligent and informative replies. A caveat is in order. Not all those who reply on that site are experts or even knowledgeable. Some answers come from the general public and some come from those who are relatively new to the trade and frequently have to ask questions on the secure "trade only" forums of that site.

KenSFO

KenSFO
09-03-2007, 3:05 PM
Ken,

Can ya' please confirm or dispell a myth for me? I've seen the crap about bumping on 'regular' locks with a flat key....but have only read that it can be done also with the cylindrical key types as well. Hope I'm explaining myself...I dont know the key name(s) but they're the round keys oft found on kyptonite locks, soda machines....and some generic safes/lockers.....

Are these bumpable or need I worry about one of my lockers?

Every pin tumbler style lock is bumpable and also pickable. The two opening methods are similar. Both take practice, but bumping was only useful to skilled locksmiths for a certain type of keyway that was small and curvy, i.e. unusually restrictive.

Better, i.e. higher-priced locks are more resistant to both methods.

The kryptonite trick you mention, what I call the BIC trick, was divulged by a locksmith just like the bump method was. Picking has been discussed on the internet for over 10 years, but because it requires more patience and skill, it hasn't caught on with street criminals.

Combination lock manipulation has also been discussed on the internet for many years, but it is a very difficult skill to learn. Once learned, and like picking and impressioning, it takes continuous practice and experimentation of many brands and types of combination locks to remain proficient. I teach advanced manipulation techniques to locksmiths, safetechs and government agencies. In my experience I'd say that less than 10% of otherwise compentent locksmiths and safe technicians are competent in manipulation. Criminals are even less proficient for the same reasons and also because they have easier, more destructive means of entry to most safes. despite this, lock makers are continually coming up with ways to foil the mostly legitimate manipulators, but on the other hand continue to make cheaper safes that are more susceptible to less sophisticated, but criminal methods.

I hope I've answered your question, addressed your concerns and given you some other things to think about.

KenSFO

metalhead357
09-03-2007, 4:00 PM
yes you did answer my question. Thank you for that...might look into adding one more layer on the outsie of the locker for additional secuity....even if it does only slow 'em down another couple minutes....I pray that would be enough and/or that the additional time aint ever needed...........

savasyn
09-04-2007, 11:13 AM
Unfortunately, the old saying, "If they really want it, they'll get it." is true with safes as well. My firearms instructor(a San Bernardino County Sheriff Deputy) once told us the following story:
A family had been away for a week or so, when they returned, they discovered that they had been robbed. One of the thing missing was the massive gun safe they had bolted to the wall. As it was bolted to an outside wall, the thieves chainsawed the wall away and took the whole dang thing!

If they really want it, they'll get it.

Scarecrow Repair
09-04-2007, 2:23 PM
A family had been away for a week or so, when they returned, they discovered that they had been robbed. One of the thing missing was the massive gun safe they had bolted to the wall. As it was bolted to an outside wall, the thieves chainsawed the wall away and took the whole dang thing!

If they really want it, they'll get it.

Remember, the thief isn't after the safe, only the contents. he doesn't care what damage he does to the safe as long as can recover enough of the contents to make it worth his while. You, on the other hand, want all the contents protected, and you want the safe protected so it can continue to protect its contents. You have to look at the installation from the thief's point of view, and he doesn't care about keeping the safe pretty and in good condition, that's not what he is going to sell.

KenSFO
09-04-2007, 7:22 PM
Unfortunately, the old saying, "If they really want it, they'll get it." is true with safes as well. My firearms instructor(a San Bernardino County Sheriff Deputy) once told us the following story:
A family had been away for a week or so, when they returned, they discovered that they had been robbed. One of the thing missing was the massive gun safe they had bolted to the wall. As it was bolted to an outside wall, the thieves chainsawed the wall away and took the whole dang thing!

If they really want it, they'll get it.

I hear a great many "stories" and I enjoy each and every one!

The conditional aspect of your last statement (quote) is that they also have to have enough time, energy and the proper tools. Few opportunistic burglars come equipped with a chain saw or sawsall and a truck so they can haul the safe away. It sounds like they came prepared for exactly what they KNEW was there and did the job when they knew they'd have enough time to finish, load it up and get away.

I don't know what the value was, but even if they were able to haul away a 2100# City Safe Modul-X, they would probably still be working on it in their garage. If I didn't know what I know about them (intimate design and construction details of a specific safe), It would take me days, not minutes or hours to open it. :-)

metalhead357
09-04-2007, 9:56 PM
Amen to the "if they want it bad enough they will take it..."

I had worked security for years and even we non mall tactical ninjas learned about means, motive and opportunity.....

You will NEVER change the motives...all you can do it create harder situations to dumbfound the means, or make it so complex, big, or hard to get through the opportunity-factor is greatly diminished while thier opportunity for getting caught increases with every second they're there.

socalguns
09-05-2007, 10:15 PM
Information wants to be free :)

socalguns
09-05-2007, 10:22 PM
Ok, whats "RSC" and "TL" (I've heard of "UL")

KenSFO
09-06-2007, 8:45 AM
RSC = Residential Security Container

TL = Tool, i.e. common hand and power cutting, prying and drilling tools, but does not include torch attacks. That is "TR" as it TRTL.

rkt88edmo
09-06-2007, 9:08 AM
Ok, whats "RSC" and "TL" (I've heard of "UL")

RSC and TL-## are ratings that UL uses as described by Ken above.

Librarian
09-06-2007, 10:10 AM
Ok, whats "RSC" and "TL" (I've heard of "UL")
List of definitions (http://www.thesafesource.com/safe_ratings.htm)

The actual UL standards are available for purchase from Underwriters Labs.

12gaugederringer
09-06-2007, 2:53 PM
We don't talk about it outside the trade because of the ethical concern that the harm outweighs the good. Why educate criminals?

What are you talking about? That sounds like an argument for job security more than anything else. Borrowing from software, whenever you make anything "open source" you are making it more secure because everyone knows what the vulnerabilities are. Why is everyone always downloading Microsoft's security patches? When a task actually requires a huge amount of resources, skill and technology (like building a nuclear weapon) only then does keeping the know-how in the family work as a form of security. If the "secrets" to cracking common safes are being hoarded by a brotherhood of industry "experts" that only propagates faulty products and ensures the brothers have a job (for good or evil mind you).

KenSFO
09-06-2007, 4:16 PM
What are you talking about? That sounds like an argument for job security more than anything else. Borrowing from software, whenever you make anything "open source" you are making it more secure because everyone knows what the vulnerabilities are. Why is everyone always downloading Microsoft's security patches? When a task actually requires a huge amount of resources, skill and technology (like building a nuclear weapon) only then does keeping the know-how in the family work as a form of security. If the "secrets" to cracking common safes are being hoarded by a brotherhood of industry "experts" that only propagates faulty products and ensures the brothers have a job (for good or evil mind you).

I tend to agree. I would prefer that the junk safes would just disappear. Unfortunately, considering market forces, outsourcing trends, economic conditions and consumer attitudes, i.e the "Walmart Mentality", I don't think that's gonna happen, at least not in my lifetime. Because of profit margins and other factors, most knowledgeable and reputable dealers stay away from selling the junk. That leaves mass marketers and internet sites. These sellers aren't about to offer an hour or two's worth of service and education to a customer in order to sell a safe they're making 10 or 15% on. That means consumers will continue buying the junk because it is being called a "safe", instead of the "cabinet" or locker that it actually is.

Here's an analogy:
Cars are expensive. To market to the bottom end of the market, internet auto dealers start marketing the equivalent of golf carts to the general public, calling them economy automobiles. They show the various models on their web site and offer free delivery. Specs are available via a download, but few buyers download them. The language of the ad, although not completely fraudulent, leads buyers, who wouldn't be able to afford a real car, to believe that these "economy" automobiles are almost as good and will meet their minimal transportation needs. Warranties are offered and disclaimers, written in tiny print, within these warranties do say that these cars will not meet DOT safety standards and won't be registerable for street or highway use, but again, few consumers absorb the details. They look at the photos and read the hype in larger, colored typestyles and suspend disbelief because they still want a "car" for less than $1000. Does that scenario sound familiar? I'm sure a few of you will find fault with my analogy, but it does seem to explain why someone who has not been educated will spend $100-300 for a "safe" that is barely more secure than a used gym locker and even brag about the savvy purchace to their friends.

From a legitimate safecracker's point of view, opening a quality safe is more interesting and certainly more profitable. From a safe dealer's point of view, I actually meet people's needs when I sell a better safe and don't have to force them to compromise because of price. Finding mostly unsatisfactory compromises is my least favorite part of selling safes!

KenSFO

12gaugederringer
09-06-2007, 4:55 PM
Yes market forces drive more people to buy more junk, I don't disagree with that. What I don't understand is why it's good to not fully disclose problems with faulty products.

rivviepop
09-06-2007, 5:19 PM
Yes market forces drive more people to buy more junk, I don't disagree with that. What I don't understand is why it's good to not fully disclose problems with faulty products.

Ken I think you accidentally responded to a different concept that what 12gaugeD here has just re-iterated; $100 junk safe or $1000 good safe, the same question/idea applies regarding full disclosure and why we don't see it more within this specific industry. I consider 12ga's points in the previous post very understandable (I'm a big open source nut so live in that world that fights this same battle every day).

capitol
09-06-2007, 5:59 PM
This thread is depressing. I feel like no matter which safe I buy its not good enough.

rivviepop
09-06-2007, 6:08 PM
This thread is depressing. I feel like no matter which safe I buy its not good enough.

haha me too! :) here I *thought* I knew what to buy, and Ken has me scouring the web looking at safes and reading the 'U.L' fine print. But I'm glad, he's educated me further and I feel more empowered to (eventually) make a better decision and buy a better safe!

Librarian
09-06-2007, 7:45 PM
I think the difference is in the sellers.

Some want to 'move product'. Some want to give buyers good value for their money.

Can't stay in business if you don't do at least some of the first.

I'm on the "tell people what they're getting" side of this. It's fine to have a limited budget and it's fine to buy/sell into that market.

I think a lot of the difficulty is from the wide range of sellers; Walmart and Sams sell gun safes just like lawn chairs and ketchup - if it's on the floor, move it through checkout and restock. They won't plan to have expertise (though a store might get lucky) in safes; they expect the buyers to do any necessary homework.

Let's look at cars: NICB Most Stolen Car List

1. Toyota Camry (1989)
2. Honda Accord (1994)
3. Honda Civic (2000)
4. Chevrolet C/K Pickup (1992)
5. Ford Full Size Pickup (1997)
6. Jeep Cherokee/Grand Cherokee (1993)
7. Oldsmobile Cutlass/Supreme/Ciara (1986)
8. Dodge Caravan/Grand Caravan (1994)
9. Ford Taurus (1996)
10. Toyota Corolla (2001)

Public info, moderately well known. People who buy these cars (a) get use from them and (b) run a relatively low risk of auto theft.

I think the same should be true for the whole category of 'gun safes'. Realizing that 'you get what you pay for' (pretty much), good, simple information on protection versus certain kinds of risks should let buyers assume as much risk as they choose or their resources require.

KenSFO
09-06-2007, 9:06 PM
Ken I think you accidentally responded to a different concept that what 12gaugeD here has just re-iterated; $100 junk safe or $1000 good safe, the same question/idea applies regarding full disclosure and why we don't see it more within this specific industry. I consider 12ga's points in the previous post very understandable (I'm a big open source nut so live in that world that fights this same battle every day).

I don't think so. Disclosure of weaknesses in locks and safes throws owners into a panic and they go out and buy new, better, more secure locks and safes just as soon as they hear about the first friend or co-worker who suffers a loss due to that exploitation, but not necessarily when it is published on the internet. Bill Gates didn't go cheap. He bought one of those big Series-4 MODUL X vaults that I sell. He's got nothing to worry about because even I couldn't open it without very specific data that can only come directly from the vault at the factory! That's why secrets are important.

Panic and insecurity is good for sellers of those better products, but bad for consumers if those weaknesses are being leaked and exploited for unscrupulous or even misguided reasons. Knowledge of weaknesses are just a tempest in a teapot, until of course it gets published on the internet and becomes an instruction manual for criminals?

How many folks here went out and spent more than $300 for their house locks and keys or more than $1000 for their safes unless they already had a loss attributable to inadequate physical security measures? How many of you have individual firearms that are worth 3 or 4 times what you paid for your gun safe?

There's not a gun safe out there that I can't get into within 15 minutes or that somebody who watched me do it couldn't get into in less than an hour, using common tools. Does that mean that I have the right or obligation to publish how to do that on the internet and maybe supply a tool list, too? Are all of you gonna go out and replace those Homaks, Granites, ProSteels and Cannons just because I know how to open them and could possibly teach criminals how to do it? Be sure to give me a call when you do. I can always use the extra business, especially in the winter months.

Let's face it folks, except for a few ultra-secure custom Jeweler safes, the various models of even the better TL-15 and some TL-30 safes are mostly all the same and have already been well-documented within the trade. Anybody can also study indvidual safe models and exploit obscure weaknesses inherent in the designs. The same is true for every security measure or device that has ever been invented. I've seen books and CDs of data on eBay that pinpoint those weaknesses. That's why makers of premium jeweler safes (Chubb, Tann, Rosengrens, City Safe, MGM, etc.) bank ATMs and bank vaults don't divulge proprietary design and construction data to anyone except their own techs, trusted contractors, or their own customers, and only on a need-to-know basis. Non-disclosure agreements are signed by every person involved and they're vigorously enforced. Do you think they do that because security isn't inherent in secrecy, but only in expensive, foolproof designs?

On the other end of the spectrum, I know of kiosk-style ATM makers whose ATMs can be found in any convenience store and on any street corner and are even less secure than your average gun safe, as long as you know the secret. Should I publish measurements, photos and videos about how to open those, too? Might as well... now that I've told you all about it! :eek:

Freedom of speech and information can be a slippery slope. The old saying about shouting "fire" in a crowded movie theater comes to mind! Hey, if, after reading this, all you guys still refuse to acknowledge that secrecy is an integral component of security, then I will be happy to publish a trick that will send many of you running to upgrade the locks on your gun safes. I have plenty in stock and operators are standing by. It's job security! :cool:

KenSFO

KenSFO
09-06-2007, 9:30 PM
I'm on the "tell people what they're getting" side of this. It's fine to have a limited budget and it's fine to buy/sell into that market.

For the most part, reputable sellers (who also want to move product) are telling you exactly what you need to know to be a savvy safe-buyer. It's all on those labels! No label? That tells you something too, doesn't it?

BTW: just kidding about divulging that gun safe combination lock vulnerability. You'll never get me to talk, but what about those other sleazy safecracker guys lurking on the internet? :)

KenSFO

Scarecrow Repair
09-06-2007, 11:48 PM
It means reporting flaws that the crooks already know so the public can take action. It doesn't mean reporting the combinations to the safes or the specifics of every customer's installation.

No one is saying we should know the specifics of Bill Gates' safe. But when Kryptonite KNOWS their locks are defective and keeps on selling them to a public who doesn't know while crooks do, that is wrong. That's what full disclosure is.

Crypto systems have secret keys, passwords, passphrases, PINs, and all sorts of customer-specific info that needs to be kept secret. But keeping the crypto system itself secret, the inner workings of locks, the mathematics of crypto, that is insane.

I have long had a theory that the main reason the Allies won WW II and defeated the dictatorships, and the west prevailed over the USSR, is because a democracy has full disclosure of a crude sort, commonly known as elections and a free press. When politicians and bureaucrats screw up, it gets known, and they get thrown out or they fix their mistakes and learn lessons. Dictatorships have no feedback, and in fact discourage it to an extreme, and thus have no way of correcting their mistakes. That's also why the Bushies have stumbled so badly in Iraq and in recent elections, because they march in lockstep and reject feedback. Say what you will about Democrats, at least they are too bumbling and inept to ever lock themselves up like the Republicans.

That's why you have to have full disclosure. It provides feedback and it encourages fixing problems.

KenSFO
09-07-2007, 9:05 AM
I guess the what my argument boils down to is that although there are weaknesses in every design, even the basic wheel, designers and makers don't necessarily find out about them unless the people who do field service analyze the weaknesses and then report back to the designers and makers. That's not how it is.

Burglary methods and the techniques that safe techs use aren't necessarily the same. I get called to open burglarized safes fairly often. I find that few are drilled, hell, few are even opened. Brute force is what's most often used and usually unsuccessfully.

If you want to disclose weaknesses, start with the basics. Thin doors, thin formed walls and spot welded bolts are what usually fail in successful burglaries. The implements used are sledge hammers and pry bars. No rocket science being used by average criminals.

The pros don't drill either. It takes too long and makes too much noise. These guys like thermic lances. Burning at 8,000įF they cann cut a safe in half in 10 minutes. It's unpleasant, dirty work, but as effective as it is, it usually results in failure due to a lack of detailed knowledge on the part of the burner or lack of precautions when using dangerous equipment.

Explosives generally haven't been used since the late '40s.

The most common safe burglary looks like an inside job. The safe is locked when the users open it in the morning. The money, etc. is gone and nobody knows what happened. The two obvious conclusions are either an inside job or a master safecracker with manipulation skills did the deed. In fact, according to burglary investigators that I hang out with, the safe was NEVER locked. It was left on day lock all day and the custodian forgot to spin the dial off to lock the lock. Simple as that! Now that's something I don;t mind being published on the internet. I can see it: "Burglar (more likely a janitor) takes advntage of safe-owner's laziness or stupidity!"

OK, now a poll, how many of you leave your safe lock on day lock for days at a time?

KenSFO

rkt88edmo
09-07-2007, 9:13 AM
I dunno what day lock means.

KenSFO
09-07-2007, 9:44 AM
I dunno what day lock means.

Day Lock:
Leaving the combination lock essentially ready to be unlocked. The combination has been dialed, but the final turn to "stop" has not been done, i.e. the dial is backed off a little bit so that the handle can't be turned, but turning right until it stops retracts the lock bolt.

KenSFO

rkt88edmo
09-07-2007, 10:05 AM
I see. Does leaving hte lock semi-dialed like that cause any excess wear or tear on the tumbler system? Or is the main source of wear and tear spinning the dial instead of turning it?

I don't use the day lock method, I have a simplex lock box for "ready access".

KenSFO
09-07-2007, 12:04 PM
I see. Does leaving hte lock semi-dialed like that cause any excess wear or tear on the tumbler system? Or is the main source of wear and tear spinning the dial instead of turning it?

I don't use the day lock method, I have a simplex lock box for "ready access".

No. day locking does no harm to the lock, but not relocking the lock completely after each opening robs you of what limited security it does provide. Back-dialing is used by burglars because they no that mechanical combination locks are pain to dial and that some users are lazy. That's taking advntage of a weakness, isn't it?

Turning the dial 5X to the left after closing the door and extending the door bolts clears all wheels of their settings. No chance of back-dialing, then.

Electronic locks don't have any provision for day locking. The swingbolt type will lock completely each and every time you close the door and turn the handle to extend the door bolts. No brainer!

Librarian
09-07-2007, 2:42 PM
Turning the dial 5X to the left after closing the door and extending the door bolts clears all wheels of their settings. No chance of back-dialing, then.
Interesting - turning it right - clockwise - doesn't do it?

metalhead357
09-07-2007, 5:01 PM
Interesting - turning it right - clockwise - doesn't do it?


Yeah....that was gonna be my question & ya' beat me to it.... does it litterally have to be FIVE times or do ya' mean 'a couple'????

KenSFO
09-07-2007, 8:21 PM
Interesting - turning it right - clockwise - doesn't do it?

If you dial the combination like this:

4 X Left to the 1st number
3 X Right to the 2nd number
2 X left to the 3rd number
and then turn right to where the lever drops in and the a little more to about 95 where the dial stops you have to turn left because you can't turn any further right, can you. Try it on your own safe lock...

KenSFO
09-07-2007, 8:25 PM
Yeah....that was gonna be my question & ya' beat me to it.... does it litterally have to be FIVE times or do ya' mean 'a couple'????

That's how many tumbler wheels there are. In order to scramble them all, for sure, five times is necessary.

Take your lock apart and see for yourself! :-)

KenSFO

metalhead357
09-07-2007, 9:07 PM
Thank ya' Ken. Learn summin' every day 'round here:)

Librarian
09-07-2007, 10:18 PM
If you dial the combination like this:

4 X Left to the 1st number
3 X Right to the 2nd number
2 X left to the 3rd number
and then turn right to where the lever drops in and the a little more to about 95 where the dial stops you have to turn left because you can't turn any further right, can you. Try it on your own safe lock...Ah, thanks. Didn't know that. My experience with mechanicals is limited - bought an electronic lock for my safe, partly because it's hard for me to align marks and partly because I get distracted counting revolutions :)

NoTime2Shoot
09-08-2007, 8:48 AM
This thread is depressing. I feel like no matter which safe I buy its not good enough.


There is always a way.

http://www.constructioncomplete.com/cc/images/items/b_HandheldCutOffSawsHandheldCutOffSawsElectricPowe red-HitachiCCY12.jpg

:D

I got as much safe as I could afford. It's a decent quality model, but I knew there was only so much safety involved.

There's only so much you can do.

KenSFO
09-08-2007, 9:20 PM
There is always a way.

There's only so much you can do.

A grinder like that will only cut a big hole in safes that aren't designed to resist that kind of attack.

I've seen good safes resist that kind of attack with a 16" concrete cutter and multiple carbide wheels for hours. There was one burglar who spent hours cutting off the hinges, bashing the dial and spindle, breaking off the handle and trying to cut a 11" hole in the side of the safe. All he got for his trouble was a gigantic gash in his thigh and some prison time. The evidence of his involvement in this airtight case was all over the crime scene! They arrested him at Harbor Emergency. DOH!

:-)

KenSFO

saki302
09-09-2007, 12:03 AM
I always thought a good way to defeat grinders would be to use high strength glue and stick thin ceramic sharpening stones at various random intervals in the sides, top, bottom, and back of the safe. Every time the grinder hits a stone- bzzzzt! blade is done. you'd have to use a thin chisel to crack the stone, replace the blade, and start over again.. unitl you hit the next random stick :D

-Dave

paradox
09-09-2007, 6:21 AM
A grinder like that will only cut a big hole in safes that aren't designed to resist that kind of attack.

I've seen good safes resist that kind of attack with a 16" concrete cutter and multiple carbide wheels for hours. There was one burglar who spent hours cutting off the hinges, bashing the dial and spindle, breaking off the handle and trying to cut a 11" hole in the side of the safe. All he got for his trouble was a gigantic gash in his thigh and some prison time. The evidence of his involvement in this airtight case was all over the crime scene! They arrested him at Harbor Emergency. DOH!

:-)

KenSFO


How well would a good safe stand up to a brute force attack using a plasma cutter?

http://www.mylincolnelectric.com/Catalog/equipmentdatasheet.asp?p=456
http://content.lincolnelectric.com/graphics/products/catalog/00000328.jpg

KenSFO
09-09-2007, 9:25 AM
I always thought a good way to defeat grinders would be to use high strength glue and stick thin ceramic sharpening stones at various random intervals in the sides, top, bottom, and back of the safe. Every time the grinder hits a stone- bzzzzt! blade is done. you'd have to use a thin chisel to crack the stone, replace the blade, and start over again.. unitl you hit the next random stick :D

-Dave

... in my original thread about barrier fills. Including abrasion resistant minerals in the fill mix has been around for a long time. Now there's even anti-burning bar materials being included that "heal" breaches as they are burned. It's called a self-healing barrier (see attached photo). This stuff is available only on top-end safes from European companies like Bode-Panzer and will soon be incorporated in the City Safe Modul X SERIES 4 line.

I think this will also answer the question about the plasma cutter...

KenSFO

odysseus
09-20-2007, 11:31 PM
Wow, great thread everyone. Also Ken - good comments and thanks for point out the Citysafe modul-x, that is quite a piece of gear in a portable design.

Anyway, for the average person (me too), security is about layers. Obscurity, installation, perimeter, alarms, intelligence, etc... all are part of the picture. As it should be noted by now, most all gun safes don't offer you total protection - just time and some resistance. If you give a perp who is on to this object enough time, he will get there. However getting there, and how long he has while there are the layers he must deal with, and as we know brute force just not on the safe, but yourself or others has opened many a safe too.

Satex
09-21-2007, 2:10 AM
This thread is depressing. I feel like no matter which safe I buy its not good enough.

Actually not, this thread shows why security experts like open review of systems. When companies keep their designs secret - they are usually flawed. When a design is secret and flawed - only the bad guys know it, and thatís a no-no.

If you study the video that Ken posted, and the other videos by the same poster, you will see a series of flaws revealed. If you have a safe that has a similar flaw, you can spend 30 minutes correcting it.

The security game is a cat and mouse game, you need to stay one step ahead of your adversary. For instance, if you have a safe with the internal pushbutton, remove the panel and disconnect the pushbutton. You can also relocate it to a different point, or add another switch in series in a different location. As soon as you do that, you have turned the tables on an educated thief that would rarely expect the safe to be reconfigured.

Also, the lock bumping video is another good reason to bolt down your safe! A bolted down safe is nearly impossible to bump. The video showing the solenoid plunger manipulated via an access hole suggested that a simple hood over that area would foil that attack.

Again, keep in mind that itís a cat and mouse game, and by learning the flaws of safe systems you can significantly upgrade the safety of your system with just a bit of time and money.

saki302
09-22-2007, 4:14 AM
Speaking of bump keys- I thought of something.

That works similar to the kids' toy we all used to have- the swinging ball stack- energy gets transferred through the stack and pops out the end ball.

With our apartment projects, we use master keyed locks- these locks have three pins in some or all of the pin channels in the lock. If you design it properly, a lock of that type would be totally impervious to bumping- the bump pops up the upper pin, but the middle pin still locks it solid.
You'd have to pick it the traditional way (which takes real skill).

I've played around with lock picking for fun- the most I've managed is a file cabinet and my computer case, which arrived with the key missing! (Disc type locks- easy!). I've never been able to pick the Schlage lock on our front door yet :)

-Dave

KenSFO
12-22-2007, 9:21 PM
we use master keyed locks- these locks have three pins in some or all of the pin channels in the lock. If you design it properly, a lock of that type would be totally impervious to bumping- the bump pops up the upper pin, but the middle pin still locks it solid.
You'd have to pick it the traditional way (which takes real skill).

-Dave

Sorry, when this got archived I stopped looking at the thread and missed your reply, but I'd like to clarify your misconception.

The more master pins in a lock, the less secure it is to picking or bumping.
Masterkeying works by providing less shear line obstrutions so that more keys can operate the lock. Some masterkeyed cylinders work on a master and one change key (only one or two master pins may be necessary) or they can be designed so that it's change key and a number of other master keys will open it. Apartment complex main entry doors are a good example of what you wer talking about. They are designed so that every renter or owner's key (maybe 150 different keys) will open it.

Bumping does exactly as the word implies. It bounces the pins up at the same time as light torque is applied to the plug of the lock. This causes all the pins to be bounced up and come back down. The method known as rake picking or the use of a spring-driven pick gun, does the same thing.

When this is done with very light torque applied to the plug, the top and master pins tend to stay in the housing (or bible) and the bottom pins fall back down and are no longer under any spring tension. This is what allows the plug to turn to the unlocked position while both picking and bumping. The more small master pins that are included in each chamber, the easier it is to bump or pick because their are more opportunities, i.e. gaps in the congiguous shear line, to allow the plug to turn. More pins, more shear line gaps equals more opportunites for the plug to turn in fewer tries.

I hope I made myself understood. If it's still unclear, post a reply here or e-mail me and I'll see if I can explain it in another way.

KenSFO

trinydex
03-30-2008, 3:50 AM
Here's an analogy:
Cars are expensive. To market to the bottom end of the market, internet auto dealers start marketing the equivalent of golf carts to the general public, calling them economy automobiles. They show the various models on their web site and offer free delivery. Specs are available via a download, but few buyers download them. The language of the ad, although not completely fraudulent, leads buyers, who wouldn't be able to afford a real car, to believe that these "economy" automobiles are almost as good and will meet their minimal transportation needs. Warranties are offered and disclaimers, written in tiny print, within these warranties do say that these cars will not meet DOT safety standards and won't be registerable for street or highway use, but again, few consumers absorb the details. They look at the photos and read the hype in larger, colored typestyles and suspend disbelief because they still want a "car" for less than $1000. Does that scenario sound familiar? I'm sure a few of you will find fault with my analogy, but it does seem to explain why someone who has not been educated will spend $100-300 for a "safe" that is barely more secure than a used gym locker and even brag about the savvy purchace to their friends.

From a legitimate safecracker's point of view, opening a quality safe is more interesting and certainly more profitable. From a safe dealer's point of view, I actually meet people's needs when I sell a better safe and don't have to force them to compromise because of price. Finding mostly unsatisfactory compromises is my least favorite part of selling safes!

KenSFO

i know this is an old discussion but i think that a better anology is not that of cars, but that of aftermarket car parts.

there was a time when import car modification was only done by the most elitist of professionals. mods were heavily researched and developed mostly in japan quality was high and performance and fit were uncompromised. over the years the market has become "whored out" leading up to and rapidly after the fast and furious movies.

i had some involvement in the industry and know some "old timers" and many times the blame is put on the "kids" that joined the market. the market became bigger but a "kid's" limited budget forced the market to make everything on the cheap, knockoffs, nonresearched products, non proven products, poor quality products etc. kids also frequently lack the discipline or drive to research to know what they're doing and know what they're buying, what it does and if it's a piece of crap.

it seems that in the safe industry this "kid-like" plague or mentality is the same in the safe industry as even adults can become childish about decisions when they're faced with unfamiliar territory.

Sam Hainn
03-30-2008, 10:44 AM
So I just read through the whole reincarnation of this thread. It's very good & lots of talk about what makes a safe suck & sucky brands mentioned. Ken; could you do a simple list for us ignorant on safes about brands good to excellent, and rate them on 1-10 scale? :confused: