10 ms·
Tourist's lucky guess cracks safe code on first try
- pferde 7y agoA combination "20 - 40 - 60" on a dial that goes from 1 to 60... Sounds like an equivalent of a factory-default admin/admin login credentials. I wonder if it really was the default combination that the safe was bought with, and the owners never bothered to change it. :)
- chrisseaton 7y ago> A combination "20 - 40 - 60" on a dial that goes from 1 to 60... Sounds like an equivalent of a factory-default admin/admin login credentials. The article explains that it was a common combination for people to use on this type of safe - "Typical combination lock, three times clockwise - 20 - two times counterclockwise - 40 - once clockwise - 60, tried the handle and it went".
- taneq 7y ago"admin", ""? Nope. "admin", "admin"? Nope. "admin", "passwd"? Yep!
- jrochkind1 7y agoSo that's a quote from the museum visitor who opened it. I don't think he knew "common combinations on this type of safe". I think he was saying what was typical was the mechanism, three times clockwise [some number], two times counter-clockwise [some number], etc. Not the numbers. We of course wouldn't have heard about it if it wasn't succesful. The real odds are "how many safes are there like this that people are trying all over the world, and what's the chance that someone at ONE of them would succeed." :)
- jmkd 7y agoHa yes, or equivalent to 'password'. Raises the point that humans interacting with machines will always display similar behaviours.
- salutonmundo 7y agoPuts me in mind of Surely You're Joking Mr Feynman...
- m463 7y agoI found that chapter really fun and I should try that... But then I think -- he was cracking safes in a military top-secret nuclear research facility!
- jperry 7y ago>The museum had previously enlisted the help of experts to crack the code, tried default combinations, and had contacted former hotel employees to see if they could help. It doesn't sound like it was the default, just a "password1" situation.
- Animats 7y agoDefinitely sounds like a default. When you turn in a container with a classic combination lock in the DoD world, you set the combination to 10-20-30-40. The next person issued the container opens it and sets it to a new combination.
- stcredzero 7y agoThe moral equivalent of "admin,password" happens all the time with physical locks. With physical goods, the key is often sold with a default bitting. (Which is the data embodied in the key equivalent to the password.) That's because just ordering the default is often cheaper, and the contractor will often just opt for the cheapest option. It wouldn't surprise me if this also happened with combination locks. https://www.youtube.com/watch?v=a9b9IYqsb_U https://www.youtube.com/watch?v=a9b9IYqsb_U
- air7 7y agoIf the code was 20-40-60 and the "enlisted help of experts" failed to crack it, then said experts are not really up to scratch.
- prvc 7y ago>The odds of Mr Mills correctly guessing the combination are pretty long, says the University of Toronto's Jeffrey Rosenthal, author of Knock on Wood: Luck, Chance, and the Meaning of Everything. >He calculated the chance of correctly guessing the combination on one try as 1 in 216,000. (His calculation assumed the safe numbers actually ran from one to 60). Glad they managed to find an expert with the calculating skill to clear up that other enigma as well.
- GCA10 7y agoJust to be cranky, shouldn't we eliminate all the permutations that use the same number three times? (i.e. 11-11-11)? My knowledge of combination locks doesn't extend much beyond goofing with Master locks in high school, but the more rudimentary designs require that the middle number be different from either of the two end ones. This doesn't sound like a super-advanced safe.
- brk 7y agoNot only different, but different by a couple of digits to account for the width of the tabs on the discs inside the lock that you are rotating with the knob.
- lostlogin 7y agoAll the safes I have used have codes that get closer to ‘0’ with each turn/direction change. This might be a low number when turning anti-clockwise or a high one when turning clockwise. These weren’t sophisticated mechanisms, so it might just be these models.
- wl 7y agoFor those who are unaware, this is a standard factory code for safes.
- jimmcslim 7y ago1 in 216000... seems like you could build some robotic device to brute force that pretty easily... or you know, introduce it to a thermic lance. EDIT: sorry, my research suggests that safe-cracking with thermic lances is plausible but not practical (source; Mythbusters, of course)
- bArray 7y ago+1 for using a robotic cracking device, I would go as far to say that a good hacker could whip something up in a weekend that would have cracked this.
- userbinator 7y agoAutomatic lock bruteforcers make an occasional appearance on HN and Hackaday: https://hackaday.com/2011/03/09/automatic-lock-cracker-makes-breaking-and-entering-a-breeze/ https://hackaday.com/2011/03/09/automatic-lock-cracker-makes...
- yakshaving_jgt 7y agoA brute-force robot was my first thought too. It's been done a bunch of times. https://www.youtube.com/watch?v=_fTz2D6x20U https://www.youtube.com/watch?v=_fTz2D6x20U
- jopsen 7y agoSure, but an unopened safe with mysterious contents is a better attraction :) Actually, having that and letting visitors try is really cool.
- spyder 7y agoor maybe with a handheld x-ray like this: https://www.youtube.com/watch?v=ovqJpcaWD7o https://www.youtube.com/watch?v=ovqJpcaWD7o but not with every safe: "Some modern safe locks are made of lightweight materials such as nylon to inhibit this technique, since most safe exteriors are made of much denser metals" https://en.wikipedia.org/wiki/Safe-cracking#Radiological_methods https://en.wikipedia.org/wiki/Safe-cracking#Radiological_met...
- thetrainfold 7y ago"he noted that some combination locks allow for wiggle-room and if this one had a three-digit leeway, Mr Rosenthal put the chances at 1 in 8,000, "which is still a small chance"." If this is the case, and there have been museum visitors having a go at opening the safe each day... this becomes a non story, right?
- bArray 7y agoHumans are terrible at picking random numbers, it's quite likely many people tried the same thing (more or less).
- invalidusernam3 7y agoAlso I would assume most people would try more than once.
- Theodores 7y agoThat museum is lucky to get visitors on some days. It is only open from 1pm to 5pm, May to September, week days only. Compare with Disneyland for footfall. A volunteer could have had the time whilst waiting for visitors to give it a go though.
- khendron 7y agoReminds me of the time I was playing a computer game, and right at the beginning you are presented with a door 5-digit combination lock. The objective of the game was to explore the game world and eventually discover all 5 digits of the code. First time I played the game I just randomly entered 5 digits, and the door unlocked.
- johnbellone 7y agoMyst series?
- systemtest 7y agoPerhaps you applied a buggy crack or patch.
- ThePadawan 7y agoWe have gotten to that point that so many new games are making references to "0451" being the first door code in old video games (System Shock, Deus Ex), you can pretty reliably use it as a first guess [0]. [0] https://www.ttlg.com/forums/showthread.php?t=147925 https://www.ttlg.com/forums/showthread.php?t=147925
- fivefive55 7y agoI remember my uncle playing my copy of Bioshock way back when, he walked up to a random door and typed in 0451 and it opened. My mind was blown.
- deleted 7y ago[deleted]
- hnzix 7y ago> Typical combination lock Now hands up everyone who's TSA luggage lock combination is 9-1-1. Social engineering is the most interesting cracking to me.
- brewdad 7y agoI prefer 666 as a subtle reminder to the thief that they are being naughty.
- mettamage 7y agoWhat are the chances someone will crack any safe and that it will be a news worthy item? Sounds like the newest hippest curve ball question on an interview :D
- nickthemagicman 7y agoThe chances of getting to correct number + (the number of news reporters per square mile in the town/total population per square mile)
- olalonde 7y agoIf the combination does allow for wiggle room and the 1 in 8000 figure is correct, the code could have been brute forced in a couple hours. Source: my wife has a habit of forgetting the combination to her 3 digit luggage lock and I had to brute force it a few times (it's surprisingly quick, about 15 minutes) :)
- bradhoffman 7y agoHahah I really appreciate the effort you put in with that
- emerongi 7y agoI bruteforced a 4-digit 2FA in 2 days, of course with the help of a small script instead of trying it myself. It's always fun to see dumb solutions work.
- celticmusic 7y agoif it works, it's not a dumb solution :)
- john-radio 7y agoIt is if olalonde doesn't want to have to break into his wife's luggage every couple of weeks...
- mcphage 7y ago"If it's stupid and it works, then it's not stupid" — my motto
- ALittleLight 7y agoRephrasing for brevity: "Nothing stupid works."
- janders 7y agoI took two things away from my AI class. 1) If brute force doesn't work, you're not using enough. 2) Do the stupid thing first.
- RickJWagner 7y agoReminds me of the famous 'Luggage Combination' scene from SpaceBalls. https://www.youtube.com/watch?v=_JNGI1dI-e8 https://www.youtube.com/watch?v=_JNGI1dI-e8
- emiliobumachar 7y agoAlternative headline: after experts fail, museum successfully crowdsources brute force attack on safe, over decades. With all due respect to Mr. Mills, in this context he's a pawn in someone else's master plan.
- hajhatten 7y ago> "They have no value really, but they are of great interest to us. It gives us a little bit of idea of what the places were like in 1977, '78," said Mr Kibblewhite. This must be the most American thing ever. 40 year old stuff treated like they're ancient.
- Schattenbaer 7y agoThere used to be a joke along the lines of "In Europe people think a 100 miles is a long distance. In the States people think a 100 years is a long time".
- hudibras 7y ago>This must be the most American thing ever. Guys, who's going to be the one to tell him?
- refurb 7y agoI’m sure the Canadians will be here shortly to correct him.
- ape4 7y agoThe sentence right before is: The pad included receipts for a mushroom burger for C$1.50 ($1.12; £0.59) and a package of cigarettes for C$1.00.
- elif 7y ago>guys, who's going to be the one to tell him? Guys, who's going to be the one to tell him ?
- hajhatten 7y agoCanada's not in North America?
- raldi 7y agoTry getting a demolition permit in San Francisco. http://www.sfweekly.com/news/why-a-laundromat-might-be-considered-historic/ http://www.sfweekly.com/news/why-a-laundromat-might-be-consi...
- ElFitz 7y agoThis reminds me of Feynman http://www.openculture.com/2013/04/learn_how_richard_feynman_cracked_the_safes_with_atomic_secrets_at_los_alamos.html http://www.openculture.com/2013/04/learn_how_richard_feynman...
- gruez 7y ago>The museum had previously enlisted the help of experts to crack the code since they have (essentially) infinite time, why couldn't they attach a machine that tries all possible combinations? feels like something that someone from the high school robotics club could come up with.
- sricks3 7y agoThe article states that the museum is in a town of a little over 4,000 people. My guess is there was simply never the right combination of interest, knowledge, and resources available.
- tantalor 7y ago> the right combination ISWYDT
- john-radio 7y ago> why couldn't they attach a machine that tries all possible combinations? Doesn't it seem to you that (with a very loose definition of "machine") they did?
- notatoad 7y agofrom a local article on this, "enlisted the help of experts" means they called the local locksmith and asked if they remembered what the combination was. the answer was no.
- jnty 7y ago"The fact that the combination was in a specific pattern and did not appear to be a random combination of numbers could also factor into a calculation of the odds, he added." Hehe. I guess he'll have to produce a list of non-random numbers to work those odds out.
- kingkawn 7y agoRandomness produces patterns all the time, and if we cut out the patterns that appear, then we are selecting the pattern that we’ve labeled as ‘random.’
- empath75 7y agoHumans are terrible at selecting truly random numbers so if the combination was picked by a person, and people who were guessing were also people, then I would say that the odds are significantly better that the safe would be cracked than what you would expect from calculating the permutations.
- wtetzner 7y agoI think it was a joke. What would it mean to produce a list of non-random numbers?
- FartyMcFarter 7y agoReminds me of this: https://en.m.wikipedia.org/wiki/Interesting_number_paradox https://en.m.wikipedia.org/wiki/Interesting_number_paradox I suppose the smallest random number is also not random :)
- superasn 7y agoThe code was 20-40-60 is like somebody setting their account password as "password123" to me
- monkeycantype 7y agoI thought the bbc had mis-lablled a photo of Gennady Korotkevich. (https://en.wikipedia.org/wiki/Gennady_Korotkevich https://en.wikipedia.org/wiki/Gennady_Korotkevich)
- monkeycantype 7y agoGennady Korotkevich is a competitive coder who go's by the handle _tourist, so I read this headline as about him cracking a safe
- clumpthump 7y agohttps://www.cbc.ca/news/canada/edmonton/vermilion-alberta-safe-busted-lock-open-1.5159979 https://www.cbc.ca/news/canada/edmonton/vermilion-alberta-sa... The CBC article differs in two important aspects. The BBC article says they "enlisted the help of experts", when the CBC article says they just called a locksmith who gave them some combinations to try over the phone. The BBC article makes it sound like some tourist just tried a random combination, while in the CBC article, a machinist put his ear to the safe and listened for clicks.
- m463 7y agoI think they both tell a similar story. Someone on the tour (a machinist) played with the safe and got it open. The experts tried it at were at a different time in the past.
- cl0ckt0wer 7y agoYou can be an expert tourist.
- benj111 7y agoIts interesting that this is interesting. People win the lottery all the time, they aren't newsworthy in the 'lucky guess' sense. On the other hand whenever someone gets out a pack of cards I always try and guess the top card. Eventually I'll get it right.
- deleted 7y ago[deleted]
- mikepalmer 7y agoEveryone is so amazed that he opened the safe “on the first try” but the article also says, “Like the Mills family, other museum visitors played around with trying to open it, with no success.“ Moreover the museum had had the safe since the mid 90s, at least 20 years... sounds like lots of tries by tourists... is it really so surprising that someone eventually opened it? Probably people don’t sit there all day, they try once or twice then let the next person have a go... so maybe 50% chance that the person that opened it would get it on their “first try”. (If not the article would have said “almost immediately” which would be nearly as newsworthy.) Sounds like the multiple comparisons fallacy. More-moreover, not unlikely there are multiple safes in public places like this in the world (I have seen at least one before in an antique shop that people would try like this) but this is the one that got opened and therefore written up in the news... sounds like survivorship bias.
- nashahg 7y agoSort of a buzz kill that the safe did not contain something far more interesting. https://finance.uonbi.ac.ke/node/116134 https://finance.uonbi.ac.ke/node/116134
- chansiky 7y agoDuring high school, I played a lot of morrowind and thought it was cool to learn how to pick locks. I had already known how to break combination locks, and I already taught myself to open traditional pin and tumbler locks. I saw a number lock with 4 digits and I couldn't help myself. Considering they were just numbers I thought to myself, this is a guaranteed crack. So every day before and after class, I would take a minute to mechanically go through about 50 numbers. Testing numbers is surprisingly quick. It only took me like 3-4 weeks of testing a few numbers before and after class and I had it open. The loot? A pair of used gym socks, shoes, and one of those math homework books you write in.