3 ms·

Is there any chance that this vulnerability was created intentionally for e.g. law enforcement access? One could imagine that the manufacturer would provide LEO

Is there any chance that this vulnerability was created intentionally for e.g. law enforcement access? One could imagine that the manufacturer would provide LEO a similar device and instructions. Not that it would in any way excuse it.

420official 4y ago
Safes like this are more meant to be tamper-evident and hard to move than impervious, which is why you always want to bolt your safe down to something solid if you have one like this. A warrant and a circular saw will get you through really any consumer safe in seconds so I highly doubt they would go through all that risk to make it slightly easier to access but maybe there's concern of damaging evidence with forced entry or something.
- jeroenhd 4y ago
  The nice thing about this is that it's still tamper-evident, despite being opened non-violently. The PIN suddenly changed, so the owner knows that someone messed with their safe. Whether they did so by picking the backup lock or by using technology doesn't matter, the safe was obviously breached. The safe would've lost its purpose entirely if it was possible to open the lock without resetting the PIN. I'm sure there's a vulnerability in there that allows for that (after all, the microcontroller allows for opening the safe without entering the right code, a very basic mistake to make!) but this project doesn't entirely defeat the safe yet.
  - MiddleEndian 4y ago
    If I open my hypothetical safe once a month, I may not find out that someone has changed the code for up to a month. If someone cuts it open with a dremel, I'll notice as soon as I happen to see it.
kube-system 4y ago
Law enforcement doesn’t need a vulnerability to open a safe. Once they have a warrant they can just call a locksmith to drill it open, etc. Any vulnerability would only by helping the locksmith or the owner of the safe, at that point.

420official 4y ago

Safes like this are more meant to be tamper-evident and hard to move than impervious, which is why you always want to bolt your safe down to something solid if you have one like this. A warrant and a circular saw will get you through really any consumer safe in seconds so I highly doubt they would go through all that risk to make it slightly easier to access but maybe there's concern of damaging evidence with forced entry or something.

jeroenhd 4y ago
The nice thing about this is that it's still tamper-evident, despite being opened non-violently. The PIN suddenly changed, so the owner knows that someone messed with their safe. Whether they did so by picking the backup lock or by using technology doesn't matter, the safe was obviously breached. The safe would've lost its purpose entirely if it was possible to open the lock without resetting the PIN. I'm sure there's a vulnerability in there that allows for that (after all, the microcontroller allows for opening the safe without entering the right code, a very basic mistake to make!) but this project doesn't entirely defeat the safe yet.
- MiddleEndian 4y ago
  If I open my hypothetical safe once a month, I may not find out that someone has changed the code for up to a month. If someone cuts it open with a dremel, I'll notice as soon as I happen to see it.

kube-system 4y ago

Law enforcement doesn’t need a vulnerability to open a safe. Once they have a warrant they can just call a locksmith to drill it open, etc. Any vulnerability would only by helping the locksmith or the owner of the safe, at that point.