Safe-cracking

Lock manipulation

Lock manipulation is the stereotypical safe cracking technique commonly portrayed in movies. It's a damage free combination recovery method, and a well known surreptitious bypass technique. Manipulation only requires fingers, eyes, and proper technique but it's a skill that takes years to develop and decades to master. Manipulation is a Group 2 mechanical lock bypass method. Expert practitioners of this art can open locks with speed and consistency. These professionals manually manipulate ^[1] the lock in order to obtain the combination one number at a time. Manipulation procedures can vary, but they all exploit the same imperfections. Manipulation will unlock a safe and recover its combination. Once the combination is recovered it may be reused to open the safe lock. Similar damage free bypass can also be completed by a computerized auto-dialer. These auto-dialer^[2] machines are known to take 24 hours or more to reach the correct combination. In recent years faster devices have been engineered for lock bypass. These new devices use more advanced robotics and more advanced software. When used in cooperation with each other the two technologies closely mimic manual manipulation. This generation of niche robotics mimics manual manipulation because they can "feel," and measure mechanical movement within the lock.

Mechanical safe locks are manipulated primarily by feel and vision, with sound helping the process occasionally. To find the combination the operator uses the lock against itself by measuring internal movements with the dial numbers. More sophisticated locks use advanced mechanics to eliminate any feedback a technician could use to identify a combination. These group 1 ^[3] locks were developed in response to group 2^[4] lock manipulation and can be identified by the lack of feeling in the dial or by a push/turn dial.^[5] Wheels made from lightweight materials will reduce valuable sensory feedback, but are mainly manufactured as X-ray resistant locks. ^[6] Manipulation is often the preferred choice in lost-combination lockouts, since it requires no repairs or damage, but can be time consuming for an operator, the specific difficulty depends on the unique wheel shapes and where the gates rest in relation to them. A novice's opening time will be governed by these random inconsistencies, while some leading champions of this art show admirable consistency. There are also a number of tools on the market to assist safe engineers in manipulating a combination lock open in the field.

Nearly all combination locks allow some "slop" while entering a combination on the dial. On average expect 1% radial rotation in either direction from the center of the true combination number to allow the fence to fall despite slight deviation. so that for a given safe it may be necessary only to try a subset of the combinations.^[7] Such "slops" may allow for a margin of error of plus or minus two digits, which means that trying multiples of five would be sufficient in this case. This drastically reduces the time required to exhaust the number of meaningful combinations. A further reduction in solving time is obtained by trying all possible settings for the last wheel for a given setting of the first wheels before nudging the next-to-last wheel to its next meaningful setting, instead of zeroing the lock each time with a number of turns in one direction.

Guessing the combination

Safes may be compromised surprisingly often by simply guessing the combination. This results from the fact that manufactured safes often come with a manufacturer-set combination. These combinations (known as try-out combinations) are designed to allow owners initial access to the safes so that they may set their own new combinations. Sources exist which list manufacturers' try-out combinations.

Combinations are also unwittingly compromised by the owners of the safes by having the locks set to easy-to-guess combinations such as a birthdate, street address, or driver's license number.

Autodialers

A number of companies and groups have developed autodialing machines to open safes. Unlike fictional machines that can open any combination in a matter of seconds, such machines are usually specific to a particular type of lock and must cycle through thousands of combinations to open a device. A good example of such a device is a project completed by two students from the Massachusetts Institute of Technology, Kyle Vogt and Grant Jordan. Their machine, built to open a Sargent and Greenleaf 8400 lock on a Diebold Safe, found an unknown combination in 21,000 tries.^[8] Lockmasters, Inc. markets two autodialing machines that work on a variety of 3-digit combination safe locks.^[9]

There also exist computer-aided manipulation tools such as Mas Hamilton's SoftDrill (no longer in production). These tools are like autodialers except they listen to the lock, and, with the aid of a computer, make logical decisions like a human manipulator would.

Weak-point drilling

Safe-drilling w/ drill rig

While some safes are hard to open, some are susceptible to compromise by drilling or other physical methods. Manufacturers publish drill-point diagrams for specific models of safes. These are tightly guarded by both the manufacturers and locksmithing professionals. Drilling is usually aimed at gaining access to the safe by observation or bypass of the locking mechanism. Drilling is the most common method used by locksmiths, and is commonly used in cases of burglary attempts, malfunctioning locks or damaged locks.

In observational attacks, the drill hole allows the safecracker to view the internal state of the combination lock. Drill-points are often located close to the axis of the dial on the combination lock, but observation may sometimes require drilling through the top, sides or rear of the safe. While observing the lock, the locksmith manipulates the dial to align the lock gates so that the fence falls and the bolt is disengaged.

Bypass attacks involve physical manipulation of the bolt mechanism directly, bypassing the combination lock.

All but the simplest safes are designed to protect against drilling attacks through the implementation of hardplate steel (extremely wear-resistant) or composite hardplate (a casting of metal such as cobalt-vanadium alloys with embedded tungsten carbide chips designed to shatter the cutting tips of a drill bit) within the safe, protecting the locking mechanism and other critical areas such as the locking bolts. The use of hardplate ensures that conventional drilling is not successful when used against the safe. Drilling through hardplate requires the use of special-purpose diamond or tungsten-carbide drill-bits. Even then, this can be a time-consuming and difficult process with safes equipped with modern composite hardplates.

Some high-security safes use what is called a glass relocker. This is a piece of tempered glass mounted between the safe door and the combination lock. It has wires attached to the edges. These wires lead to randomly located, spring-loaded bolts. If an attempt is made to penetrate the safe, the penetrating drill or torch breaks the glass and releases the bolts. These bolts block the retraction of the main locking bolts. To drill a safe with a glass relocker, side, top, or rear drilling may be necessary. Many modern high-security safes also incorporate thermal relockers in conjunction with glass-based relockers (usually a fusible link as part of the relocker cabling), which also activate when the temperature of a safe exceeds a certain level as a defense against torches and thermal lances.

Drilling is an attractive method of safecracking for locksmiths, as it is usually quicker than manipulation, and drilled safes can generally be repaired and returned to service.

Punching, peeling and using a torch are other methods of compromising a safe. The punch system is widely used by criminals for rapid entry. Punching was developed by Pavle Stanimirovic and used in New York City. Peeling is a method that involves removing the outer skin of the safe.

Plasma cutters and thermal lances can be as hot as 2,200 °C (3,990 °F), much hotter than traditional oxyacetylene torches, and can be used to burn through the metal on a safe.

Scoping

Scoping a safe is the process of drilling a hole and inserting a borescope into the safe to get an intimate look into a specific part of the security container. When manipulation proof mechanical locks and glass re-lockers are implemented as security measures, scoping is the most practical option. One common method is called "scoping the change key hole." The safecracker will drill a hole allowing him to get his scope into a position to observe the change key hole. While spinning the dial and looking through the change key hole for certain landmarks on the combination lock's wheel pack, it is possible to obtain the combination and then dial open the safe with the correct combination. This method is common for a professional safe specialist because it leaves the lock in good working order and only simple repairs are needed to bring the safe barrier back to its original condition. It is also a common way to bypass difficult hard plates and glass re-lockers since the change key hole can be scoped by drilling the top, side, or back of the container.

Brute force methods

Other methods of cracking a safe generally involve damaging the safe so that it is no longer functional. These methods may involve explosives or other devices to inflict severe force and damage the safe so it may be opened. Examples of penetration tools include acetylene torches, drills, and thermal lances. This method requires care as the contents of the safe may be damaged. Safe-crackers can use what are known as jam shots to blow off the safe's doors.

Most modern safes are fitted with 'relockers' (like the one described above) which are triggered by excessive force and will then lock the safe semi-permanently (a safe whose relocker has tripped must then be forced, the combination or key alone will no longer suffice). This is why a professional safe-technician will use manipulation rather than brute force to open a safe so they do not risk releasing the relocker.

Radiological methods

Penetrating radiation such as X-ray radiation can be used to reveal the internal angular relationship of the lock's internal mechanism to deduce the combination. Modern safe locks are made of lightweight materials such as nylon to frustrate this technique, since most safe exteriors are made of much denser metals. The Chubb Manifoil Mk4 combination lock actually has a lead shield surrounding part of the lock to defeat such attempts to read its wheels.

Tunneling into bank vaults

Large bank vaults which are often located underground have been compromised by safe-crackers who have tunneled in using digging equipment. This method of safe-cracking has been countered by building patrol-passages around the underground vaults. These patrol-passages allow early detection of any attempts to tunnel into a vault.

Safe bouncing

A number of inexpensive safes sold to households for under $100 use mechanical locking mechanisms that are vulnerable to bouncing. Many cheap safes use a magnetic locking pin to prevent lateral movement of an internal locking bolt, and use a solenoid to move the pin when the correct code is entered. This pin can also be moved by the impact of the safe being dropped or struck while on its side, which allows the safe to be opened.^[10][11][12] One security researcher taught his three-year-old son how to open most consumer gun safes. More expensive safes use a gear mechanism that is less susceptible to mechanical attacks.