I see a person that puts a personal fail online, I respect it and I like it. Few can do that.

When you pulled out the 4-pin my first thought was "I bet he's going to talk about the lock for a bit then forget to plug it back in!" :D Well done sir!

"You bloody ripper!", "Beauty!", "Bob's your uncle!","In like flin!", "Bobby dazzler!", "Winner winner chicken dinner!"

Man I love these videos. I have no actual idea what's going on but it's fun as hell to watch. I find myself wishing I had even a quarter of this guys knowledge of electronics.

Had me laughing my a** off a few times there, especially when you closed it with the power disconnected - doh! Brilliant work getting back into it, it was worth doing the video just for that!

You could also defend from power line attacks by programming the micro controller correctly. I suspect that since this lock strictly requires 6 digit pin all it does is store the numbers into memory regardless if correctness and when it sees six digits it compares the full string with the value stored in EEPROM. I could be wrong but this is how I would do it.

"I forgot to reconnect the Solenoid to the lock" You're my spirit animal.

Watching this for the second time in a few years. This is truly fascinating. As an electrical engineer myself I find great enjoyment in watching your videos. Cheers from Canada!

Dave, could you please check the patern when entering the last digit? I wouldnt expect any comparing beeng done before all digits are entered, they would just be saved. But it is possible, if the programer was lazy, that when the input string of digits is compared with the saved passcode, the comparison rutine breaks as soon as a difference is found, so you could se which of the entered digits was the first incorect one.

I thought at first that you fried the processor! Then I remembered the plug..LOL.

Cheesy, but you're sincere and I like how you explain even how you failed and show how you fixed your mistake. Really fascinating video for different methods of non-invasive attacks.

I wonder if you could just use a neodym magnet on this one too. Many electronic safes can be opened by a big magnet to trigger the solenoid inside. Takes on average 5 secs.

Do the same with a $50 safe. I know they can be physically bumped and some simple short circuit attacks but I wanna see more advance techniques!

Eeh, I don't need a safe. I live in Canada, our burglars call ahead to let us know they're dropping by, don't want to interrupt dinner or anything...

Pretty sure this was the best episode ever, Dave. I've been watching your videos for about a year and a half now, and being the noob that I am, most of them were hard to follow, but this one? This one was perfect! Understood every single bit! 🙌 Real bobby dazzler.

There's a video on KZfaq called DEF CON 21 - Melissa Elliott - Noise Floor Exploring Unintentional Radio Emissions If you have a safe-shaped antenna, you should be able to "hear" the IC checking against the known combination, even through all that metal. Hey, you could even stick an antenna inside the safe through a bolt hole and use the safe as shielding from background crap. Every time a button is pressed (or 6 numbers are entered), there will be a check in the form of a loop. During this loop, you should be able to inspect numbers inside the IC from the intensity of emissions from the data lines. Enter 4 random codes, and inspect what frequencies are the same in each emission. This should be the correct code.

This is like my favorite episode ever

Love that FAIL button!

"Bob's your your uncle!" This video was really informative and fun to watch. I look forward to catching up on your other videos mate! Thanks!

I have one of those cheap, Bunno's safes! I use it as a DECOY! :) My CMI floor safe (concreted in!) is elsewhere...

I never thought I would see Dave Jones break into a safe laparoscopically.

this is bloody brilliant! rarely have I been so entertained. I love you, Dave!

I would try to capture lock's behavior after entering all 6 digits. It's doubtful that controller compares every entered digit. I bet it reads them in a buffer and then compares. This is the time to catch it.

I did QC checks on some of the cheaper units in China prior to our acceptance of them. I found that you could open them with a bump on the top before they were installed but once bolted down you couldn't. I couldn't work out why that was so. I also had my laptop in a hotel safe and it would not open with the code I set. I asked the girl in charge if she could open it for me using the master code. She did not know whether it had one so i took a guess and used the factory code - yep it opened so then I had her get the manager and I showed her how to reset all her safes with a new code. She was really grateful, especially as i hadn't just kept quiet and opened the other safes!

Shoutout to Clint

Hey Dave, One of my main concerns with electronic locks is at the firware/code level and being guaranteed that there are no secret code or keystroke backdoors. I was hoping after IDing the micro version, that you would try to pull out the machine code listing and examine it for manufacturer backdoor entry codes. Unless these safes can be audited and proved safe (through things like code hashing), I fail to see how they can be trusted at all over, say, mechanical locks.. Tweeks

You're the best channel on KZfaq! Always brings a smile watching your videos.

Well this turned out to be a fun episode. The road to success truly IS paved with failure.

As the battery connection is exposed, maybe it can be hacked by applying weird over-/undervoltages, negative voltages or combinations of that? You also could use near field antennas (near the keyboard) used for emv probing to sniff. You could make use of a more elaborated (low R) current sensing with higher bandwidth. You could use more elaborate data processing on the captured signals, you could correlate antenna signals and wired signals (power current). BTW, how does disconnecting the battery affect the safety lock out time? Even if it is stored in eeprom, one may detect a false attempt prematurely and shut off the power just before it can store the failed attempt lock out time in eeprom, if it does that anyway. And then you can probe the circuit at any point if you get a "sample" but not limit yourself to working with the TUA (Target Under Attack). You see, if you want to spend the time, there is a lot more one could do... May not be worth it except for the experience gained.

The code is always 6 digits, so I assume they are comparing the input with the secret key only when all digits are entered. With a sensitive enough power analysis, you should be able to detect which digit was incorrect as the micro iterates over the input and key. Even with a constant time comparison of the two, some flag or register in the micro will be set on the first wrong digit (otherwise your comparison would never fail).

Dave, this is a great video! I always enjoy your insight into the design of a system, and especially your real-time commentary when trying to hack something!

This channel is so interesting! You just know exactly what you're talking about, and it's very informative, even though I hardly know anything on the subject. Thanks!

The safe was inspected by 'Clint', must be 100% secure

Tim Hunkin has some interesting mechanical safe cracking stuff on his website and his 'Secret life of Machines' stuff is well worth tracking down. There are also some safe/lock cracking anecdotes in 'Surely you're joking Mr Feynman'.

That was quite a good experiment and very funny when you locked yourself out. First time I have discovered your channel, but I'll be back.

Dave, You mention that you can replace the keypad in the event that it breaks, so you must be able to do so without access to the interior of the safe, is that correct? If so, would it be possible for someone to replace the keypad with one containing some kind of keylogger? That individual could potentially return after the safe owner has accessed the safe and obtain the code.

You didn't try: Low voltage attack (brown out, slight power differences between the eeprom and processor, leading to "0" being read for all positions) Power glitching attack (modulating the input power to cause glitches) Power-up analysis (does it read the eeprom on initial battery attach?)

I'm only 50 seconds in, and I'm pumped for this video. Physical security and electrical engineering are some of my greatest passions, this is going to be great.

dude! that was one of your best videos. you turned a fail into a fun and educational. detour thanks for your time and your energy

Safe saga was riveting indeed. Cheers!

I couldn't stop laughing when I realised what happened (at around 8-9 min mark). We have all been in a situation like that at least once, where you just feel like the ultimate noob lol and Dave Jones' reaction was priceless :)

EEV: This lock is pretty damn secure Lock Picking Lawyer: Hold my beer

I was choking on some laughter here. A fine video sir.

Not sure if anyone else has mentioned (Dave didn't on the video) it but there is a spring loaded anti bump weight opposite the solenoid. Any impact big enough to move the solenoid plunger will also force the anti bump plunger into the hole.

I wonder how those $300+/- ebay gunsafe locks fair, I know the safe has to be bolted to the wall and floor by law but if the crooks managed to get it loose I bet they could bang it on the floor a few times and release the lock. i will have to take a poke at mine before I install it and store valuables in it, might have been a waste of money.

This was very interesting to watch ! :) Great video, Dave!

The best electronics video I've ever seen on youtube.

I love it when a push button lock has been in use for years and the buttons for unlocking it are all worn. Vegetable oil on the buttons would reveal which buttons were pushed without necessarily being noticed by the owner. This trick also works in some cases to detect if something was disturbed in your absence.

He thinks he's detected a packet -- it's just the beeper! LOL!

I genuinely love your channel sir! That said, I don't ever have time to finish one and find myself skipping through them trying to catch the good parts. If you would filter your words to just the interesting parts, I bet you could reduce your 45 minute (average) videos down to about 20 minutes. Then, I could actually manage to finish one of your videos! You pick great topics but PLEASE maybe try to make them a reasonable length! Most people in this line of work, including myself, simply don't have hours a day to spend on KZfaq. Just a polite suggestion

EEVblog - This was an incredibly entertaining and informative video. Great job rolling with the punches... I loved it!

I've been watching this 90 seconds, and I'm already 100% behind you. A friend described his Sandleford EZ75 as "not worth the cardboard box it came in" after being burgled. Thieves just bashed it open.

Try to find the resonance frequency of the little spring and use a suboofer with this frequency. The pin should then vibrate and if you are lucky you can open the safe or damage the spring an turn it on its side. :-)

You can also try undervolting that thing to make the software crash (and possibly flip that one magic pin high; these tiny MCUs don't have any notion of memory protection; they will execute whatever crap happens to come into the instruction stream) or overvolt it. It's common for MCUs to short pins high or low when they are fried. If that doesn't work... overvolt it massively (like 10-30 kV or so) then the spark might jump to the right spot.

i think the wave form drop is from storing the number in memory. The validation is when the last number is pressed. The wave form will change depending on if the validation is wrong or correct.

*applause* what a save Dave! what's important is not how you fail, but you recover :)

11:50 YOU HAD ONE JOB. ONE!

*ROFLMA* Epic! Priceless! One of the funniest thing I ever seen on KZfaq! I wish I had 1000 thumbs up to give you Dave... but you only have 860 videos or so. ;-)

One of the cash drawers where I used to work was susceptible to bumping. A firm thump and it would open right up. Was handy for making change because the drawers would normally only open up for a transaction.

Here's a question: are the keypad pins vulnerable to this type of snooping? You can get to those if you can get the safe on its side. With some difficulty (and maybe some laparoscopic surgical tools) you could unplug the keypad, hook on some probes and plug it back in. Edit: I know that _data_ you'll be seeing on those pins will just be the keypad data, but there may be some crosstalk or something, and since they're closer to the CPU you might be able to see more noise from there.

Thanks for making us all feel human Dave

I would not expect to see much on the power line for digit entry. The software would (should) just store each digit without any judgement on the individual number until it has all six numbers and then it would do a compare in which case its too late. Its not going to decide as you type each number in. There will be a time-out between numbers so that you do need to type them in with in a certain time period before it trashed what's already been entered. But great video - loved the cheesy version of mission impossible :-)

That was such a silly thing to do but that was extremely entertainijg to watch and good on You finding a solution!

Dave This is the best video ever!!! you put all your skills to work on this one.!!

yeah you screwed up on the wire but watching you putting it back was very entertaining..it was way better than those Hollywood movies :)

LoL I bet there was a Schrodinger's connector moment for a bit...

The noise of protest the safe makes against being inspected at 1:29 is hilarious to me even months later.

there is an anti-bump mekanism next to the solenoid. its the brass thing with also a spring that sits "above" the solenoid. if you bump it so the solenoid springs away, the brass rod also spring the same direction and takes its place.

How about trying to remotely move the pin by moving a big neodymium magnet against the door?

Oh god when he had that cable unhooked I thought "I really, really hope he remembers to put it back in". Then he forgot. *palm* oh man, I did something similar on one of those cheap safes. I knew it was coming but still, painfull lol. Good thing he didn't get a TDR one.

Why assume that the beep on scope was after the key was evaluated at all? Since it beeps for EVERY keypress, no decision is needed before that. All of your analysis was BEFORE the beep but processing delay could easily be AFTER the beep in the waveform. Suggestions I liked the best from KZfaq comments: 1. get a super long screwdriver and reach through back mounting holes to unscrew entire deadbolt mechanism. (hard brittle steel rod less spring? You might want the rod to have just the right hardness/temper to be less springy!) 2. drill tiny hole from left side directly into end of deadbolt, then push it back with a steel rod. 3. undervoltage, overvoltage and kilovolt surge 4. more elaborate power analysis ( after the beep! ) 5. Malicious power conditioning (frequency) cue the Mission Impossible music... LOL I wonder how many people have put safes into their basement floor and had contents destroyed by flooding? I found this in the archive: We recently opened a safe in Rancho Mirage. The home was unoccupied this past summer and when the home owner returned they found their house was flooded with several inches of water. There had been a leak in the Plastic supply line to the refrigerator. Several months later we were called to open their floor safe which had been flooded and rusted in the flood. The safe would have been in better shape had we been called immediately after the flooding Rust had taken over most of the safe and water was stagnant. We were able to open and repair the safe to good working order but any paper work they had in the safe was destroyed. We advise customers to call us immediately after flooding to prevent water damage and rusting to the safe. We also advise customers to keep important documents that are stored in a floor safe in tight plastic Ziploc baggies to preserve the contents. Home Flooding is a common occurrence especially with part-time residents.

LOL Dave, as a locksmith here's how I would do it. You already have holes in the back. What we usually do is take a light or camera as you have with a long screwdriver and disassemble the lock from the back. That will usually give you access to the deadbolt mechanism and using long screwdrivers manipulate the bolt mechanism opening the safe!!!

wow this fail button couldn't be more appropriate, damn

Could you not apply a voltage directly to the solenoid the same way you replaced the plug?

don't know if I am correct (I never studied signals in such definition): if your keyboard sends analog signals, every key should show the same signal every time(diferent for each), if it's a digital transmision, the diference betwin 0 and 1 binary should be insignificantly small. considering the fact that you are on the analog side of the circuit, you had no chance from the start (correct me if I'm wrong, I don't have much experience at this level)

I don't know about this safe, but I've found a similar one in an abandoned building a few years ago and I got that open by applying very high voltage to the battery terminals (I think it was over 10kV). It was ruined afterwards, but it did actuate the solenoid long enough to open it.

I liked the part where Dave changed into a gynecologist.

Bear Grills ?

I'm Australian, lived in the bush, worked on farms, on the coast, multiple states and I have not once in my 24 years heard someone say "bobby dazzler". Classic, good video mate very interesting.

I was in Loss Prevention for a chain of retailers in the US. We never had a single burglary where they attempted to defeat the lock or attack the door. Always the body of the safe.

What about trying to pull the solenoid pin inwards by using a magnet from the outside?

Is there a lot of break-ins where you live?

No vulnerability discovered in the old electronic safe. Fail-to-connect cable to main-board vulnerability detected in Dave! Thanks for making another totally enjoyable video. I really enjoy how you manipulate your scope and make it look so effortless. Future video tangent using this clip as springboard. Create a powerful magnetic field outside the safe. Perhaps you could replicate the solenoid action and pull that rod to clear the little locking block.

In our house you’d be described as a “spawny git” for getting that wire back into place! Well done.

They are pretty damn secure when you forget to plug the keypad in

you have a 3d printer you could of made a tool for the job

I've always had a knack for lock picking and safe cracking. Picked my first lock on my parents front door when I was 7. I also learned really fast how worthless those lock boxes are. I used a screwdriver... a screwdriver to open up a sentry safe key lock box as well as figuring out the bump method on digital safes in my teens. I never did understand the purpose of any kind of safe aside from fire/flood protection that isn't bolted down or very heavy. Anyone who uses them is pretty much sending the message of "Hey I put all of my valuables all in one location inside an easy to carry box that can be carried off and broken into later."

Sweet video. I do post failure investigations. As part of that I find that recreating or researching possible scenarios to be extremely useful. This is exactly the sort of thing I do. To spend 3 months throwing crash test dummies out of vans to figure out the restraint failure. or a couple months on some G.F.C.I fault is pretty common.

These locks are breakable via RF analysis .but you need 2 hours.

Bob is not my uncle

I've always kind of wondered if digital safes are vulnerable to this or not. Just started the video, so it will be interesting to see how this goes.

8-bit EEVBlog Mission Impossible. Words I never thought I'd say.

I wouldn't even bother breaking and I would just take the safe with me.

Who all are here in 2020?

Haha once I seen you forgot to plug it in... I figured I'd sit back and watch the show. Good job!

Awesome video. It was nicely suspenseful in more ways than one. It was also fun seeing the mechanical engineering of the latch mechanism. It's true there's a big difference in the security of safes. My favorite bit is the made-in-China crap typically uses plastic gears and mechanisms and some are famous for the plastic bits stripping/breaking in normal use so even with the correct combination you can no longer get into your own safe.

you're the only bloke i've ever seen trying to break out of a safe :-) it must be the convict in you :-)

Genius !!! You took a medium security age and made it totally invulnerable to electronic attacks. Now the combination to get in requires a drill and metal screwdrivers.

In the States, we call the clamp forceps "Hemostats" because doctors use them to stop the flow of blood in vessels. You should see mine. much longer than what you have there. Would have come in handy. Not to worry! Great video all around, seriously. All good wishes!

Don't you just love a challenge... Particularly when it involves extricating one's self from a sitchy-ashun of one's own creation.. LOL!