The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/etc/security/safesci.txt

Text File | 2003-06-11 | 9.9 KB | 228 lines

================================
= The Science of Opening Safes =
=       by Eric The Red        =
=  Tiger's Lair [phone]  =
================================

Safes:
------
Once the determined agent gains successful entry to the premises, he may find
that some no good son-of-a-bitch has not only placed the necessary target in a
locked and alarmed building, but has also employed a safe to help insure the
virginity of the target materials.

A good agent will be prepared for such an eventuality by being armed with one
or more possible opening methods, and necessary implements.

Success often depends on the degree of security offered, coupled with the age
and make of the safe.

Safes come in a wide variety of sizes and applications. One can encounter wall,
floor, or vault models of varying thickness and offering a wide variety of
resistance to the determined agent.

Most safes have at least one combination mechanism. The combination is
preferred as there are no keys to lose or have copied, and the number of
possible combinations varies from over 1 million to 1 billion, thus making it a
bit time consuming to open one randomly.

The dial is marked with a reference point and a series of numbers. The dial is
connected to the spindle which appears as a skinny metal bar and to the
tumblers (which are connected to the leg bone, leg bone connected....).

The spindle transmits the motion of the dial to the tumblers, which appear as
metal wheels with a cut in one spot. The tumblers are all packed together.
(Do not confuse the tumblers of a safe with the tumblers of a normal lock--they
are entirely different)

When the spindle turns the tumblers, they first all turn together (as each has
a small metal post which hooks the next one). As the dial is stopped at the
first number, that tumbler remains it that position. Then one turns the dial
to the other direction moving all but that tumbler, the next number, and so
on.

When all the correct tumblers are dialed in the slots will be all lined up
directly under the "fence" which falls into the slots allowing the bolt to be
retracted.

Sound Opening:
--------------
Some safes can be opened by sound, much as in the movies, but most that were
manufactured after the mid 60's are not susceptible to the following method:

A high gain amplifier is used. A small, direct-coupled amplifier can be
purchased for about 10 dollars from the various electronic supply houses. A
contact microphone (i.e. one that "hears" vibrations rather than actual sound)
should be employed. BE SURE to use a matching transformer if the impedences do
not match; and in a pinch, a crystal phono cartridge can be employed as a
contact microphone. A stethescope can be used instead of all this, but the
amplifier-microphone combo is much better.

Place the contact mic on the safe, near the dial. Now, turn the dial 5 times to
the left to clear it. Now, turn back towards the right. On the first
revolution, you should hear a distinct click as the cam and lever engage. Read
the number. This will be the opening number, or the last number dialed to open
the safe.

Continue turning to the right. You will hear an additional click during the
next 4 or 5 turns. This indicates how many tumblers you are actually dealing
with. Most safes will have 3, but some will have 4 or 5.

While you are determining the tumber of tumblers, disregard the drop-in click
that occurs at the opening number on each turn.

Our turning the dial to the right 5 turns also performs another duty; it clears
the mechanism. This means that the dial has picked up all the tumblers and is
moving them in rotation with the dial.

After our 5 turns to the right, we move the dial about 10 points BEYOND the
opening number. If the opening number is 15, we would move to 25 and stop. Now
we move back to the exact opening number.

This procedure puts the opening lever and cam in position to open the safe
(although the tumblers are not lined up so it will not open) Now at this point,
you can rock the safe dial back and forth without actually turning it.

This rocking motion causes the lever to click against the tumblers (through
the lever slot). This clicking can be heard by the manipulator in his ear
phones. The whole secret here is the fact that the noise will vary depending
on the number of tumblers the lever is clicking against. (Much like the
difference in hitting 3 notes on a piano at the same time, or just hitting
one.)

Should we have happened to line up one of the tumbles slots under the lever,
the sound will be that of the lever only clicking only two tumblers (as the
lever will fit into the slot of the lined up tumbler, creating no sound).

Each time we time we rock the dial to make the lever-tumbler combination click
we (assuming there was NO difference in sound) move the dial back to the right
where it picks up the tumblers and then we move it about 2 digits past the
last number. Now one moves the dial back to the opening number to realign the
lever-cam slot, and repeats the rocking motion.

When you hear a sound differnce, (indicating that the tumbler slot is lined up)
you turn the dial back to the right until the click indicating the cam has
picked up the tumblers. Now immediately stop and read the number that is lined
up when you hear this click.

This is one of the combination numbers.

Now continue to the right 2 digits past the last try and move the dial back to
the opening number and repeat the procedure. Do this until you have all the
combination numbers.

Now, we know the opening number is the final number, but we dont know what
order the combination numbers are arranged, so you will have to try all 9
(assuming 3 combinations and one opening number) possible variations. One will
open the safe.

Sometimes you will have to move the dial a couple of points beyond the opening
number to get the cam to retract the bolt and open the lock.

Some locks open to the right, i.e.
 R four turns  22
 L three turns 18
 R two turns   46
 L to opening  15
Some will be opposite (L-R-L-R).

Most locks will open no matter which way it is turned, however, a rough
guideline is:

 Sargeant-right
 Diebold-right
 Yale-left
 Mosler-left

This sort of technique will not work on high quality modern safes as they
employ nylon tumblers, sound baffles, and devices to prevent the lever from
touching the tumblers until ready to open. Because of this, the good agent will
have a couple of alternate methods in his repertoire.

Drilling:
---------
A good way to tell where to drill is to place your microphone against the safe
about half way between the handle and the dial. Now shake the handle violently.

This should make the tail piece hit the bolt. Keep it up until you can locate
the point where the noise is loudest, i.e., where the tail piece and bolt come
into actual contact. Drill here.

It makes little difference whether you drill off the tail piece or bolt; either
will open the safe.

It is safer to use a large bit, say one inch, on a powerful drill. This may
require more than one person pushing on the drill...

Use special hardened carbide or diamond points, and always carry 4 or 5 with
you.

Some safes have hardened plates covering the vital areas to discourage those
who would use the method. When you encounter such a plate, press very hard on
the drill and DO NOT ease up, even for a moment, as the will cause the bit to
burn up.

You may have to take your torch (you did bring a torch, didn't you?) and heat
the plate quite hot, let it cool, or throw water on it, drill some more,
reheat, cool, drill, etc. Most hard plates are fairly thin.

Punching:
---------
In this case, we are not referring to what the frustrated agent often resorts
to when the safe fails to open, but rather, a quick method of forced entry. The
agent knocks off dial off with some heavy instrument and punches the spindle
with a center punch and hammer. With a bit of luck, the safe can often be
opened.

However, on many high quality safes, any puching attempt will shatter the
spindle, or cause the bolt to dead-lock. Some safes have a surprise in the form
of tear gas which will be released when punched or burned.

Grinding:
---------
A high speed electric grinder with a carbide wheel may be employed to cut away
the safe wall around the lock mechanism.

Burning:
--------
One of the most popular methods over the years has been the burn job.

This is accomplished with an oxy-acetylene torch. The protecting wall in front
of the dial mechanism is cut away revealing the tumblers which are manipulated
to open the door.

Many modern safes are laminated steel connected to something like copper, which
conducts heat away from the burning area. Also one must consider the
possibility of tear gas releasing at about 130 degrees.

Paper can withstand temperatures up to about 350 degrees.....

Other:
------

Many people feel they must go in via the door as that is the conventional way,
when, in real life, the door may be the protected part of the safe.

Often, turning a safe on its top and attacking the bottom with a sledge or
heavy duty axe may yield opening results. However, this method does lack a bit
in the finesse department.

Peeling is another possibilty: Here one drills a hole in the corner of the door
(thereby missing the anti-drill plate) and inserts a crowbar and peels back the
first layer of te door. This will usually expose the locking mechanism.

One can also drill from the rear, look into the safe, decide if it is worth
opening. As an added bonus, most safes can be opened by turning the dial while
watching the mechanism from the rear and visually aligning the tumblers.

Thermic Lance:
--------------

A thermic lance, or burning bar, will cut through most safes with no noise,
minimum hassle, and have the added advantage of being concealable and simple to
operate.

Call Tiger's Lair [phone] for the latest in "The Science of..." Series.