EEVblog #762 - How Secure Are Electronic Safe Locks?

[HP-ILnerd]

Dave,

That was one of the most entertaining episodes you've done.  I love it when you leave in your mistakes.  Nice "The Eagle Has Landed" moment when you got the plug back in.   

It's the complete opposite of home improvement shows where they build something out of magical perfect framing timber that is miraculously clear and laser straight. 

[Rachie5272]

It would be interesting to see an analysis of the keypad serial connector.  If it's I2C, maybe it shares the same bus as the EEPROM.

Also, it could very easily have a backdoor in the form of a second secret passcode.  It could be a unique code for every safe based on the serial number, programmed at the factory.  Any chance of an EEPROM dump?

[bktemp]

It would be interesting to see an analysis of the keypad serial connector.  If it's I2C, maybe it shares the same bus as the EEPROM.

It is a 93C46 EEPROM: It uses Microwire, not I2C. I doubt they would make such a stupid mistake and share the wires between the code storage memory and the external keypad.
Maybe they have deliberately chosen a microwire EEPROM instead of an I2C EEPROM because the I2C data can be seen on the supply current because of the pullups drawing current only during low bits.
And maybe they use the buzzer to hide the current draw of the controller, checking the entered code while the buzzer is beeping?

[Rasz]

It is a 93C46 EEPROM: It uses Microwire, not I2C. I doubt they would make such a stupid mistake and share the wires between the code storage memory and the external keypad.
Maybe they have deliberately chosen a microwire EEPROM instead of an I2C EEPROM because the I2C data can be seen on the supply current because of the pullups drawing current only during low bits.
And maybe they use the buzzer to hide the current draw of the controller, checking the entered code while the buzzer is beeping?

all good points, if only someone did a power analysis of this loc......

[ivan747]

It would be interesting to see an analysis of the keypad serial connector.  If it's I2C, maybe it shares the same bus as the EEPROM.

It is a 93C46 EEPROM: It uses Microwire, not I2C. I doubt they would make such a stupid mistake and share the wires between the code storage memory and the external keypad.
Maybe they have deliberately chosen a microwire EEPROM instead of an I2C EEPROM because the I2C data can be seen on the supply current because of the pullups drawing current only during low bits.
And maybe they use the buzzer to hide the current draw of the controller, checking the entered code while the buzzer is beeping?

Yes I believe this could be a thing. I'd like to see that signal filtered out.

[rotopenguin]

It would be interesting to see an analysis of the keypad serial connector.  If it's I2C, maybe it shares the same bus as the EEPROM.

It is a 93C46 EEPROM: It uses Microwire, not I2C. I doubt they would make such a stupid mistake and share the wires between the code storage memory and the external keypad.
Maybe they have deliberately chosen a microwire EEPROM instead of an I2C EEPROM because the I2C data can be seen on the supply current because of the pullups drawing current only during low bits.
And maybe they use the buzzer to hide the current draw of the controller, checking the entered code while the buzzer is beeping?

They don't have to literally store the digits of the password as an unsigned int in EE, could instead remap each digit to a RLL-like bit pattern. With the right pattern-per-symbol, you'd have a very even distribution of ones and zeroes and hopefully a bland enough square wave to hide.

I doubt they would use the buzzer like that, it's easy enough to drill the bugger dead to take it out of the loop. Also, tiny amounts of timing jitter in the PWM might leak info. It's easier to have the buzz happen far apart from the juicy bits of code than verify the exact behavior of the MCU to be sure. (OH DUH, that noise isn't coming from the important MCU, it's just a ^G being sent to the keypad's controller. DERP.)

[eneuro]

And maybe they use the buzzer to hide the current draw of the controller, checking the entered code while the buzzer is beeping?

They can use high frequency timer interupt so often, than main code runs... step by step and they can have random times it spends in this interupt, so this what you'll see on power line will be... noise 
Common, why do you think you could guess this password based on power waveform? There are endless posibilities to make those readings useless or only looking that it leads to somewhere, but... it is hopeless effort probably not worth amount of money kept in this safe lock 

They don't have to literally store the digits of the password as an unsigned int in EE, could instead remap each digit to a RLL-like bit pattern.

Of course they do not store any passwords, but probably a few times hashed and few times encrypted this what someone enters and... you have no chance to find it the garbage with other random bits, which can be recreated each time someone sets new password 

Brute force solenoid wires or coil, something which could help open those doors, with help of really strong magnetic field or induced this way Eddy-currents designed to hit given parts and materials in mechanical lock, maybe could do the trick

I think, after sucessfull episode one, I hope Dave will try something much more powerfull than osciloscope 
Pure electro-magnetic power is needed, maybe at determined frequency.
I  suggest, this could do the job

MagLab claims record with novel superconducting magnet

Wow 

Built with both traditional and novel superconducting materials, the magnet reached a field of 27 teslas on June 5 in a test that exceeded designers' expectations.

[rotopenguin]

So, the attack vectors I see, especially once you pull the keypad face off and are talking directly to the 4 pin plug are:

1. How does it keep track of too many bad tries? How is a single bad try recorded? Here is one way not to do it. The obvious way is to record a bad attempt to flash after a password check, but there's a tiny window where an attacker might read your poker face and pull the plug before commit. Or a gigantic window where you never had enough voltage for flash writes to succeed at all. If I were writing the firmware, I would FIRST append a failed attempt to flash (and verify it!), then test the password, and then if we have a match we'll go back and erase that black mark. (By append, I mean don't erase a 2 and put a 3 down as the number of failed attempts, somebody's bound to split that transaction with a power outage.)

2. How does the 5 minute timeout work? How goes the last bad try before dropping the timeout hammer? If there's anything special about how the flash writes "uh oh, we're in lockdown mode now", we might be able to take a miss on that and get unlimited retries. If pulling power causes the controller to forget about the timeout, somebody is hankering for a firing.

3. Seriously, how well do you deal with brownouts? Flash is a fat little piggy for voltage requirements, while the processor would probably be okay running significantly leaner. Are they counting on the MCU's BOD to cover the flash chip's needs too?

4. When does the password match actually happen? Lots of folks here are saying "only once the 6th digit is entered" which I like. Some are saying that you are typing into a rolling window of 6 digits, which would give you FAR too many free swings at bat if that were true. The 7th digit you enter must be taken as a clean slate entry of the 1st digit of a new attempt.

5. Does the processor's eyebrow twitch as it matches a correct or incorrect digit? If Dave spent the weekend plugged into that pretty little 4 pin plug instead of leaning against a drill, we might have seen some movement on this front :-P Love the lemonade that Dave made out of the lemons anyway!

6. How well protected is that I2C(?) pin anyway? I've heard of AVRs getting messed up in the head with crazy-fast thwacks on a GPIO, perhaps an ST is as vulnerable.

7. Did a web programmer do the communication code? Those jerks make buffer overflows all the time, geez keep it together guys.

8. Can the CPU skip instructions until it finds itself in the unlock routine? Don't let a few missed instructions just let it fall into the unlock code, put a minefield in between main() and there. Hmm, If I were a 2 stage pipeline CPU being induced to glitch, I think I'd try interleaving the code with tons of small JMPs past very bad instructions. I believe that the pipeline normally starts chewing the next instruction, but has it inhibited by a later clockcycle of JMP. If the JMP gets glitched, the evil instruction may be executed and induce a soft fault, throwing code flow into a (hopefully) more jailable exception handler. And how bout this - wire the board such that only a certain pattern on GPIO will trigger the solenoid without also smacking your own RST line. What are the odds of a drunk processor (a) accidentally falling into the GPIO port write and (b) having the correct magic pattern sitting in a register in the first place?

9. Is there a bitchin' bass frequency where the solenoid pin will dance out of the way? The opposing-mass pin (which is awesome!) may hold shit together when the solenoid is bumped out of the way, but it won't groove to the same tune.

[EEVblog]

Also, it could very easily have a backdoor in the form of a second secret passcode.  It could be a unique code for every safe based on the serial number, programmed at the factory.  Any chance of an EEPROM dump?

No, not possible. It would never have passed the type approvals if it had this.

[EEVblog]

"Im gonna do power analysis" .... doesnt do power analysis(no, looking at the scope at 2 orders of magnitude wrong scale is not it), announces lock is secure

Oh FFS people, get over it.
Yes I did the simplest check possible, it was first simple check, of course there is a ton of more stuff I could do. It could easily be a 10 part video series.
I did mention that further testing would be needed, but that it didn't look promising at this stage.
Yeah, ok, I should have explained this better, but I didn't expect people to take this video to be the be-all end-all attack video on this lock

[EEVblog]

The easiest way to "crack" this safe must be to do exactly what Dave did when re-inserting the connector - but instead using some wires to power the solenoid directly.

You, you can't do this. The company has patent on preventing exactly that "spiking".
That of course does not mean it's not possible, but they have thought of it and have put design measures in place to prevent it.

[Rasz]

The easiest way to "crack" this safe must be to do exactly what Dave did when re-inserting the connector - but instead using some wires to power the solenoid directly.

You, you can't do this.

have you tried? video clearly shows space for two sockets, but only one is used for the keypad/power cable, second one is unpopulated and leaves a lot of space for stiff wire to go inside and poke around

The company has patent on preventing exactly that "spiking".

oh, a patent, well that settles it 

[alien_douglas]

I though I might post a story on power line analysis. Nothing to do with safes!
Back in 1985 I was working for IBM NZ and IBM had just released their new Quietwriter electronic daisy wheel (Remember those?) typewriter to replace the totally mechanical Selectric golf ball machine.
I received a phone call from the NZ Secret Intelligence Service (Don't know why they rang me as I did not have anything to do with typewriters.) asking if there was an anti spying EC (IBM speak. Engineering Change) for the new electronic Quietwriters.
I thought that my leg was being pulled, but I went around to talk to the Office Product guys who told me that there was indeed such a device for the mechanical typewriters.
This is when I learnt about power line analysis.
So way back in 1985 the spies around the world had tiny devices that could be fitted into the back of a mains outlet to read the varying current that uniquely changed as the mechanical golfball typewriter typed different characters. And then transmit the data to a sneaky spy outside the building. Way cool!!

BTW. The anti spy device for the mechanical typewriter was the addition of a large flywheel on the motor. That smoothed out the current draw on the power line.
And the new Quietwriter, that was full of electronics and stepper motors, was almost totally quiet on the power line. Great quality IBM engineering!!

Alien

[rotopenguin]

You, you can't do this. The company has patent on preventing exactly that "spiking".

I sure hope that's a patent on "an integrated device to prevent spiking" rather than a patent on "the business method of injecting power spikes to maximize unauthorized ingress".

[EEVblog]

have you tried? video clearly shows space for two sockets, but only one is used for the keypad/power cable, second one is unpopulated and leaves a lot of space for stiff wire to go inside and poke around

No I have not tried it, doing so could ruin the lock. A one-shot deal.
How about you send me say 20 identical locks and I'll give it a go.
Say what you want about patents, the fact is they have thought about this and implemented measured to protect against it. And it is well know that this lock is not susceptible to spiking any more, they fixed it a long time ago.
*see my previous disclaimer*

And there is no point going in through any side hole and poking around, it's of no consequence. If someone was the drill through the safe side case and try to manipulate through that tiny hole from outside the safe from 25cm away then they might as well just crack the safe open the old fashioned way. It's pointless to even consider.

[apis]

Oh FFS people, get over it.

Hacking security devices is just too much fun! People expected an epic hack but in the end were left hanging.

But a negative result is also interesting as you said! If I had any valuables worth protecting I would look for an LG lock, looks like they knew what they were doing.

9. Is there a bitchin' bass frequency where the solenoid pin will dance out of the way? The opposing-mass pin (which is awesome!) may hold shit together when the solenoid is bumped out of the way, but it won't groove to the same tune.

I would expect that the spring-constant to mass ratio of the solenoid and the opposing system is matched. So they should move similarly. But things get complicated if you apply preasure and thus varying friction by twisting the handle while shaking/bumping it. Might be possible to bump, apply pressure and thus holding the solenoid pin in position, repeat until solenoid is free and hopefully you can get the opposing pin to return out of the way.

[EEVblog]

Oh FFS people, get over it.

Hacking security devices is just too much fun! People expected an epic hack but in the end were left hanging.

Well that is the nature of the EEVblog. It's an "off-the-cuff" blog, publish and be damned, I shoot and upload, even if not finished, knowing I can always do another video. I don't spend weeks on a video, chipping away at it bit by bit until it's done and then upload some magical final product.
People seem to forget this all too often.
I don't think I've ever spend more than a full day on a video.

I would expect that the spring-constant to mass ratio of the solenoid and the opposing system is matched.

I would expect that as well.

So they should move similarly. But things get complicated if you apply preasure and thus varying friction by twisting the handle while shaking/bumping it. Might be possible to bump, apply pressure and thus holding the solenoid pin in position, repeat until solenoid is free and hopefully you can get the opposing pin to return out of the way.

Given that this lock has been the industry standard for about 20 years, I figure someone would have figured a way to beat it by now.

[Fungus]

But things get complicated if you apply preasure and thus varying friction by twisting the handle while shaking/bumping it. Might be possible to bump, apply pressure and thus holding the solenoid pin in position, repeat until solenoid is free and hopefully you can get the opposing pin to return out of the way.

How are you going to shake/bump something that's bolted to a wall/floor?

(And if it isn't bolted down then you've got some big holes in the back to poke things into. You could just unscrew the metal plate on the door lock and dismantle it from inside).

Given that this lock has been the industry standard for about 20 years, I figure someone would have figured a way to beat it by now.

If there was a way in early versions it would have been fixed by now.

It's not as if bumping bumping or timing attacks are amazing secrets of the L33t HaXXors. Safe makers know them, too (probably before the L33t HaXXors).

[Rasz]

have you tried? video clearly shows space for two sockets, but only one is used for the keypad/power cable, second one is unpopulated and leaves a lot of space for stiff wire to go inside and poke around

No I have not tried it, doing so could ruin the lock. A one-shot deal.
How about you send me say 20 identical locks and I'll give it a go.
Say what you want about patents, the fact is they have thought about this and implemented measured to protect against it. And it is well know that this lock is not susceptible to spiking any more, they fixed it a long time ago.
*see my previous disclaimer*

And there is no point going in through any side hole and poking around, it's of no consequence. If someone was the drill through the safe side case and try to manipulate through that tiny hole from outside the safe from 25cm away then they might as well just crack the safe open the old fashioned way. It's pointless to even consider.

I am not talking about hole on the side of the safe 
I am talking about 3(4?) FACTORY holes in the front plate. At least the one used for the handle/power cable goes all the way through. Skilled people are able to use such holes to go in places they werent supposed to with a stiff wire.
You dont risk burning anything it you unplug battery and just measure resistance between ground and your magic wand until you land on specific known one to be sure it landed on second magnet pole/transistor pad.

[Seekonk]

I bought a famous name electronic safe at a garage sale with the door open.  Mfg would give you combination for $3.50.  I figured take off back plastic cover and look at electronics, maybe a combination sticker.  No electronics inside safe.  Just two wires leading from solenoid.  Removing battery cover from front of safe gave easy access to those.  So a wire connected to the battery and a pin to break through insulation is all someone needs to get in.   I don't really use it, just keep it in an obvious location.  If someone breaks in I want them to take all their time moving that heavy safe and leaving the other stuff alone.  That is real security.

[Fungus]

I am not talking about hole on the side of the safe 
I am talking about 3(4?) FACTORY holes in the front plate. At least the one used for the handle/power cable goes all the way through. Skilled people are able to use such holes to go in places they werent supposed to with a stiff wire.

Do you think they didn't think of that? 

[apis]

How are you going to shake/bump something that's bolted to a wall/floor?

You can often just bang on things with a mallet or something, there are plenty of videos on youtube...

It's not as if bumping bumping or timing attacks are amazing secrets of the L33t HaXXors. Safe makers know them, too (probably before the L33t HaXXors).

Surprisingly often that's not the case, and it's hard to tell which manufacturers know what they are doing and who are clueless, price isn't necessary a good indicator. It's easy to make things that work when used as expected, much harder to correctly identify and counter all the corner cases, especially when someone clever is deliberately trying to break things. Some things are simply ridiculous bad even when not cheap and from well known brands.

[Rasz]

I am not talking about hole on the side of the safe 
I am talking about 3(4?) FACTORY holes in the front plate. At least the one used for the handle/power cable goes all the way through. Skilled people are able to use such holes to go in places they werent supposed to with a stiff wire.

Do you think they didn't think of that? 

Make yourself a favour and click on YT clip I linked like 4 pages ago. Professional system (audit log, networked, rfid key) 300Euro electronic door locks are routinely cracked by nothing more than a coat hangar wire. I am talking systems that cost xxK euro to install in whole building.

BTW Dave, I learned today that you became a verb. to 'dave jones' something apparently means to fuk around with it for 2 minutes and toss it in the corner  another ee blogger I follow got X-Carve and people were afraid he would 'dave jones' it in the comments It was such a holy shit Im not alone moment when I read that

[apis]

another ee blogger I follow got X-Carve and people were afraid he would 'dave jones' it in the comments It was such a holy shit Im not alone moment when I read that

To be fair, you have to choose between how much time is spent on each gadget and quantity. You can't get several videos per week if each video takes several days to shoot and this format obviously work well for a lot of people. How many videos per week does the other blogger produce?

Although suppose I wish there was more of everything as well.

[eneuro]

To be fair, you have to choose between how much time is spent on each gadget and quantity.

There is something else too-how much money can someone invest into each of those videos 

If someone uses safe from his house, probably never ever will publish its manufacturer in internet, since this opens serious security hole-someone knows what to expect and can be better prepered to attack it.

Mythbusters S02E03 Ancient Death Ray, Skunk Cleaning


So, now if Myth Busters saw this video, they of course wouldn't try any powerless osciloscopes to hack this thing, but if they knew there is decent amount of gold inside, than thay could see from this Dave video that... there is no good air insulation and it is not water proof too, so they rather... pumped a litle bit of explosive gas inside, inserted two thin wires, added remote controled ignition and... could easy open those dam doors 
Than, in the rush after detonation, dressed in first aid skirts takes gold from already open safe and... there is also no walls in the building and... could live long and in happines 
No need to monitor safe lock power lines, but simply open its doors from inside by means of mechanical forces