5 ms·

That's a neat attack, but why does anyone get an electronic safe in the first place? The batteries may die, which means there must be a physical lock as well.

by zeveb 10y ago

That's a neat attack, but why does anyone get an electronic safe in the first place? The batteries may die, which means there must be a physical lock as well. Either the physical lock is less secure than the electronic lock (in which case an attacker will focus on the physical lock) or it is more secure than the electronic lock (in which case why not rely on the physical lock?). That doesn't even begin to get into the fact that the profession of electronic locksmithing is still in its infancy and as a result electronic locks tend to be laughably insecure in the first place. The whole reason to have a safe is to keep things … safe. Why pay all that money and get nothing in return?

wlesieutre 10y ago
Put a DC barrel jack on it?
- semi-extrinsic 10y ago
  I see you're downvoted, but I know Yale's residential electronic door locks [1] have a 9V battery terminal on the outside, such that you can open the door in case of an extended power outage. (For short outages the lock has a small internal battery.) [1] http://www.yale.co.uk/en/yale/couk/productsdb/smart-locks/Keyfree-Connected-Smart-Lock/ http://www.yale.co.uk/en/yale/couk/productsdb/smart-locks/Ke...
andrewla 10y ago
From reading the underlying article, it is apparent that the power source is externally available (since they monitored power consumption). Looking at the instruction manual [1] confirms this; you do not need to open the lock to change the battery. So there is no mechanical lock fallback. The fact that you can remove the batteries (and even the number pad) without unlocking the safe does seem to present some DoS attacks, but I assume that isn't a major concern. [1] http://www.sargentandgreenleaf.com/pdf/630-302_6120_op.pdf http://www.sargentandgreenleaf.com/pdf/630-302_6120_op.pdf
crucini 10y ago
The key bypass is only on the cheapest consumer safes. Many of those can be opened just by rapping with a hammer. This vuln was found in Sargent & Greenleaf locks. These are UL-listed locks suitable for securing cash in commercial establishments. They have no key bypass. These locks have the batteries outside the safe, so there is no dead battery issue. However, this enables easy current measurements, as the hacker showed. FYI, at this level there are no "electronic safes" - just regular safes with electronic locks, which have the same form factor as mechanical safe locks. Why an electronic lock? Much faster to enter the combo, proof against robo-dialers, can maintain an audit trail of multiple employees, can issue different combinations to different employees and revoke access.
- StavrosK 10y ago
  > However, this enables easy current measurements Wouldn't a simple capacitor foil that attack?
merpnderp 10y ago
People get electronic safes because most people breaking into their house won't be hackers and combination locks are slow and tedious to open. Really tedious if it's something you keep important items in that you need daily or weekly.
ythl 10y ago
> The batteries may die, which means there must be a physical lock as well. Why not just have an A/C port somewhere so you can supply your own power if the battery dies? The worst a criminal could do at that point is try to crank a high amperage current through it and try to fry the computer, which would not unlock it.
- cmdrfred 10y ago
  The battery is on the outside.
superuser2 10y ago
>The batteries may die, which means there must be a physical lock as well I generally see a battery compartment on the exterior, so if the batteries die you just replace them and then enter the code. Sometimes the key lock does something like immobilize the dial or handle, so it's a second factor, not a bypass. >Why pay all that money and get nothing in return? On consumer-level safes, who knows. Beyond that: individually identify users, revoke specific users, have an audit trail of who opened it when, make the ACLs depend on time of day.
xorcist 10y ago
Key management. It is easy to recall and/or rotate keys.
Spooky23 10y ago
You make a great point. I think the most egregious aspect of the story is that the UL standard for this kind can apply up to TL safes. Clearly, that standard is a little ridiculous.
krisoft 10y ago
Not every electronic lock have batteries. Some of them are powered by the user spinning the dial. (for example the Kaba Mas X-10) Electronic locksmithing is not in it's infancy. The FF-L-2740B specification is already a 5 year old.
- psykpsyk 10y ago
  So, in your fairy-tale world, a 5 year old is not an infant? That was the most stupid thing I read this decade.
- nullc 10y ago
  I like the Kaba Mas locks a lot, I wish they weren't so pricey.
killerIdeas 10y ago
For 2 reasons : 1. Every mechanical lock can be opened using a tool called ITL2000. It is a robotic arm that tests all the combos of the mechanical lock. 2. The maintenance of codes in a bank using mechanical locks is very complicated and costly. When the person in a branch who knows the combo takes holidays a locksmith has to go to the branch to change the combination, for example. In an electronic lock (SG-6121) there are the master code and 9 codes, one of them opens the lock without waiting for the delay.

by zeveb 10y ago

wlesieutre 10y ago

Put a DC barrel jack on it?

semi-extrinsic 10y ago
I see you're downvoted, but I know Yale's residential electronic door locks [1] have a 9V battery terminal on the outside, such that you can open the door in case of an extended power outage. (For short outages the lock has a small internal battery.) [1] http://www.yale.co.uk/en/yale/couk/productsdb/smart-locks/Keyfree-Connected-Smart-Lock/ http://www.yale.co.uk/en/yale/couk/productsdb/smart-locks/Ke...

andrewla 10y ago

From reading the underlying article, it is apparent that the power source is externally available (since they monitored power consumption). Looking at the instruction manual [1] confirms this; you do not need to open the lock to change the battery. So there is no mechanical lock fallback. The fact that you can remove the batteries (and even the number pad) without unlocking the safe does seem to present some DoS attacks, but I assume that isn't a major concern. [1] http://www.sargentandgreenleaf.com/pdf/630-302_6120_op.pdf http://www.sargentandgreenleaf.com/pdf/630-302_6120_op.pdf

crucini 10y ago

The key bypass is only on the cheapest consumer safes. Many of those can be opened just by rapping with a hammer. This vuln was found in Sargent & Greenleaf locks. These are UL-listed locks suitable for securing cash in commercial establishments. They have no key bypass. These locks have the batteries outside the safe, so there is no dead battery issue. However, this enables easy current measurements, as the hacker showed. FYI, at this level there are no "electronic safes" - just regular safes with electronic locks, which have the same form factor as mechanical safe locks. Why an electronic lock? Much faster to enter the combo, proof against robo-dialers, can maintain an audit trail of multiple employees, can issue different combinations to different employees and revoke access.

StavrosK 10y ago
> However, this enables easy current measurements Wouldn't a simple capacitor foil that attack?

merpnderp 10y ago

People get electronic safes because most people breaking into their house won't be hackers and combination locks are slow and tedious to open. Really tedious if it's something you keep important items in that you need daily or weekly.

ythl 10y ago

> The batteries may die, which means there must be a physical lock as well. Why not just have an A/C port somewhere so you can supply your own power if the battery dies? The worst a criminal could do at that point is try to crank a high amperage current through it and try to fry the computer, which would not unlock it.

cmdrfred 10y ago
The battery is on the outside.

superuser2 10y ago

>The batteries may die, which means there must be a physical lock as well I generally see a battery compartment on the exterior, so if the batteries die you just replace them and then enter the code. Sometimes the key lock does something like immobilize the dial or handle, so it's a second factor, not a bypass. >Why pay all that money and get nothing in return? On consumer-level safes, who knows. Beyond that: individually identify users, revoke specific users, have an audit trail of who opened it when, make the ACLs depend on time of day.

xorcist 10y ago

Key management. It is easy to recall and/or rotate keys.

Spooky23 10y ago

You make a great point. I think the most egregious aspect of the story is that the UL standard for this kind can apply up to TL safes. Clearly, that standard is a little ridiculous.

krisoft 10y ago

Not every electronic lock have batteries. Some of them are powered by the user spinning the dial. (for example the Kaba Mas X-10) Electronic locksmithing is not in it's infancy. The FF-L-2740B specification is already a 5 year old.

psykpsyk 10y ago
So, in your fairy-tale world, a 5 year old is not an infant? That was the most stupid thing I read this decade.
nullc 10y ago
I like the Kaba Mas locks a lot, I wish they weren't so pricey.

killerIdeas 10y ago

For 2 reasons : 1. Every mechanical lock can be opened using a tool called ITL2000. It is a robotic arm that tests all the combos of the mechanical lock. 2. The maintenance of codes in a bank using mechanical locks is very complicated and costly. When the person in a branch who knows the combo takes holidays a locksmith has to go to the branch to change the combination, for example. In an electronic lock (SG-6121) there are the master code and 9 codes, one of them opens the lock without waiting for the delay.