[HN Gopher] Unlocking a Gary TL-15 Round-Door Safe (2009)
___________________________________________________________________
Unlocking a Gary TL-15 Round-Door Safe (2009)
Author : altrus
Score : 89 points
Date : 2024-07-02 17:45 UTC (3 days ago)
(HTM) web link (www.locksmithledger.com)
(TXT) w3m dump (www.locksmithledger.com)
| jdblair wrote:
| If you're trying to find Figure 2, click on Figure 1 (the photo)
| and use the right-arrow nav to advance to the 2nd photo.
| swayvil wrote:
| Ah. Yes. Thank you.
| imglorp wrote:
| I just posted this amateur documentary about a guy that prides
| himself in saving safes from the drill. He only does
| manipulation. He uses a stethoscope and sometimes a laser pointer
| to visualize the wheel angles.
|
| https://www.youtube.com/watch?v=1hz_kjTc8DQ
| sidewndr46 wrote:
| The first thing I though about when listening to his
| description of moving the dial was a servo motor with a torque
| measuring shaft hooked to a microcontroller. It sounds like you
| could just graph torque required to turn it over 360 degrees to
| get the same info he was getting.
| dosman33 wrote:
| This is called the "soft drill". And strangely, this can
| still be a destructive attack. There are systems that can do
| proper manipulation by graphing out the gates, and there are
| systems that just do brute force attacks by dialing every
| combination. I've been told that the brute force machines
| that try every combination typically wear the lock out and it
| needs to be replaced afterwords.
| sidewndr46 wrote:
| Yeah, I certainly figure someone has done this before with
| varying success. At the extreme end I imagine someone could
| just design a dial with a centrifugal clutch that if spun
| beyond a certain speed clutches out permanently and locks
| the dial shaft. My limited understanding of anti-theft
| mechanisms in safes is they are generally destructive,
| making it impossible for anyone to open the safe once
| activated.
| sandworm101 wrote:
| If you are interested in safe cracking there are training
| tools available, at least for the consumer-style S&G locks.
|
| https://www.sparrowslockpicks.ca/product_p/sdial.htm
|
| (Sparrows makes good stuff, but note how the .com website
| doesn't list where they are actually located. The .ca is out
| and proud about their real address.)
| fortran77 wrote:
| They have machines that try every combination. (For example:
| https://blog.enbewe.de/2023/01/26/opening-a-safe-the-diy-way... )
|
| If you know how many digits and the Left-Right pattern, wouldn't
| this be the best way to do this, assuming you have a week to run
| it?
| coolhand2120 wrote:
| Came here to say this! What a great device.
|
| Cracker: "So I brute forced your safe"
|
| Customer: "I asked you not to damage it!"
|
| Cracker: "No damage. The combo is 27, 32, 14"
| litoE wrote:
| In 1999 we bought a house. It had a locked safe embedded in a
| wall and the seller did not know the combination - the house had
| belonged to his parents who had passed away. When we started
| remodeling the house we used a jackhammer to pry the safe from
| the wall, planning to discard it. But, in a moment of
| inspiration, I loaded the safe on a pickup truck and took it to a
| local locksmith to see if he could open it. The locksmith took a
| walk around the safe and reported "the combination is
| xxL,yyR,zzL." I was astonished. Until he showed me the secret:
| there was a piece of paper taped to the back of the safe.
| blumomo wrote:
| Come on, everyone wants to know what was inside??
| litoE wrote:
| Not surprisingly, empty.
| EvanAnderson wrote:
| Even if I'm not familiar with a topic there's something deeply
| satisfying about reading (watching, listening to) accounts of
| people who are good at their jobs doing intricate or technical
| work.
| swayvil wrote:
| That style of writing. It really goes down easy.
| mzs wrote:
| but who's the author?
| mrb wrote:
| I once bought a vacation home that was a century-old English
| cottage that went through 7 different owners over time. It once
| belonged to a US state senator. Another time it belonged to a
| prominent local businessman who went to jail for white collar
| crime, and went through a nasty divorce. Anyway, the house had a
| TL-15 Star Safe embedded in the wall in the master bedroom. The
| previous owner did not know the combination. Neither did the
| owner before him. Some unknown person at some point had attempted
| to open it, as the safe had 3 drill holes on the face plate.
|
| There was a very old sticker on the safe bearing the name of the
| company who apparently installed it. The phone number was so old
| it did not have an area code. Fortunately the company still
| existed after multiple decades. I called them and asked if they
| could open it in a non-destructive way. One of their technicians
| came, looked at it and probed it for a couple hours, but
| determined he could not open it. And the combination had been
| changed from the manufacturer's default. He gave me the contact
| info for a reputed safe technician who could help.
|
| Later I called this safe technician, but he was incredibly
| difficult to get a hold of. I had to leave multiple voicemails
| and send multiple emails. We chatted briefly one time and he said
| he would get back to me later to schedule an appointment. But he
| seemed half-retired and not interested in the job, as I never
| heard back, despite multiple contact attempts and my offer to pay
| handsomely. Eventually I became frustrated with his non-
| responsiveness and stopped caring about the safe.
|
| Fast forward a few years later, I was going to sell the vacation
| home, but I really wanted to open the safe before selling.
| Curiosity had gotten to me. I searched online for another safe
| technician, and found a supposedly reliable guy. I arranged an
| appointment. He showed up a few days later. I asked him to open
| it any way he could, even if he had to destroy the safe. He
| started drilling, making multiple holes over the course of 2
| hours. Eventually he came to me and said he ran out of drill bits
| as they all got worn out. He had to leave and promised he would
| be back.
|
| It took one week for him to eventually come back early one
| morning with more drill bits. He spent another couple hours
| drilling. Then he put a camera scope in the holes and claimed he
| could see 3 of the 5 wheels spin while the other 2 were broken.
| He spent an entire day trying to manipulate the wheels. But after
| a whole day of work, he came to me with a defeated look and
| apologized saying he was sorry but he doesn't think he is able to
| open the safe.
|
| I went back online to find yet another professional who could
| help. I learned that what I really needed to look for is a
| professional who is a member of SAVTA (Safe & Vault Technicians
| Association). So I found a SAVTA tech who on the phone told me a
| TL-15 safe in a residence is unusual as it is normally made for
| businesses like a jewelry store. Unfortunately he said his next
| availability would be about a month from now, and I was going to
| sell the house in the coming weeks.
|
| Eventually I found another SAVTA tech who was available on a
| short notice. He and a colleague both arrived a morning, and it
| took them 3 hours to do more drilling and more manipulation to
| FINALLY open the safe.
|
| Guess what was in it?
|
| Nothing. It was empty! I closed the sale of the house literally 2
| weeks later. I was still very relieved to have gone through this
| hassle to open it. The unsatisfied curiosity if it had not been
| open would have eaten me alive :) Also I decided in my next house
| I wanted a safe rated TL-15, as clearly they can withstand a lot.
| neilv wrote:
| There was a time that you could've gotten a lot of Reddit karma
| by releasing the story in breathless installments. :)
|
| (Good story, and have an HN Buck.)
| dosman33 wrote:
| Very interesting. A TL-15 is an excellent container, but I'm
| not familiar with a 5 wheel combination lock in commercial
| service in the US. I have a S&G vault lock which has 4 wheels.
| I don't doubt 5 wheel locks exist though, especially if the
| safe was possibly installed for a US Senator. Would definitely
| be interesting to see some photos of the lock (both outside and
| inside) if you still have any.
|
| Reminds me of this: https://blackbag.toool.nl/?p=31
| mrb wrote:
| Here is a picture of the inside: https://ibb.co/sF8RLDv I
| can't seem to locate a picture of the outside.
|
| The politician owner was not a "US senator" but a "state
| senator", IOW not a member of the US Senate but of the state
| senate. So not as prestigious as you think :)
| avidiax wrote:
| Everyone always says it was empty :)
|
| If it contained $100,000 in cash, the smart thing to do is say
| it was empty.
| doug_durham wrote:
| I don't think I've ever encountered such an over-monetized site.
| Every square mm of space has an ad. Then pop ups will
| spontaneously cover existing ads. I can't even find the content.
| hagbard_c wrote:
| Install a content blocker - uBlock Origin on a browser which
| does not try to thwart its purposes, i.e. Firefox or similar -
| and you won't see a single ad or pop-up on that site.
| waltwalther wrote:
| This. I can't remember the last time I noticed an ad of any
| sort, including on the link here.
| sandworm101 wrote:
| These "sergeant greenleaf" locksets are old but common in
| military/national security use around the world, although
| military models have a couple extra security features not sold to
| the public. They are amazing devices. They are 99.9999999%
| reliable for decades without any maintenance but nevertheless can
| take a beating. The combination can be changed in seconds.
| Recovering a forgotten combo is possible with only a screwdriver,
| so long as the safe is still open. Most are or have been replaced
| by digital locks, but I've always liked Sergeant Greenleaf.
| sidewndr46 wrote:
| Is that the same or different from the padlock style ones I see
| being used to secure military equipment?
| dosman33 wrote:
| Same company makes both combination dials and the large
| padlocks like the 831, 833, 851. I was lucky enough to tour
| their manufacturing facility, it's a typical machine shop
| plus a small foundry as they do their own casting on-site
| too.
| sandworm101 wrote:
| S&G padlocks are evil. They are hateful devices. The inner
| working are broadly similar to the full-sized dials but are
| fiddly little demons. Changing their codes never goes
| properly, and recovering from a lost code requires multiple
| special keys. I know of boxes containing dozens of "bricked"
| S&G padlocks that people have given up trying to use. The
| difference in design and build quality makes it hard to
| believe both are made by the same people.
|
| https://mbausa.com/content/downloadfiles/8077_Combo_Recovery.
| ..
|
| https://mbausa.com/s-g-padlock-combo-recovery-set/
|
| Compare with the easy change procedure for dials:
| https://homelandsafes.com/how-to-change-the-combination-
| on-a...
| chiph wrote:
| I was surprised to read that they filled their hole with old
| carbide drill bit tips and J-B Weld (a two-part epoxy). I was
| expecting it to be welded closed.
| Kirby64 wrote:
| Likely stronger than welding against drilling. Weld bead is
| generally pretty easy to drill through. Carbide drill bits
| you'd need diamond to cut through. Sure you could cut through
| the JB weld, but you'll obliterate your drill bits as soon as
| you hit the carbide.
| sandworm101 wrote:
| Carbide junk in a hole will not only shatter weak drill bits
| but also deflect the stronger bits sideways, likely snapping
| them. Many security devices insert carbide debris, usually
| ball bearings, as protection over areas likely to be drilled.
| buildsjets wrote:
| JB Weld is a run of the mill 2-part organic epoxy, heating it
| up to 250F is plenty more than enough to dig it out with a
| shanghai-grade screwdriver from Harbor Freight.
| Kirby64 wrote:
| You sure about that? J-B Weld claims its resistant to a
| constant temperature of 500F, and 10 mins of 600F. With the
| heatsinking of the steel body nearby, it'd be quite
| difficult to melt out the epoxy. Not impossible, mind you,
| but... this isn't intended to be a bulletproof fix, I
| assume. Why would a would-be thief even think there's epoxy
| there in the first place?
| buildsjets wrote:
| The hubris around here. Yes, I'm sure about that.
|
| You are a person who is easily manipulated by marketing,
| and clearly has zero practical experience in this field.
| I do. There are no epoxys that are good to 500F. None of
| them. See username, Buildsjets. The epoxy resins that we
| build jets out of are cured in an autoclave under high
| pressure, and at best they are good to 350F, and they are
| absolutely the highest performing epoxy resins you can
| buy from the likes of Hexcel, Toray, and other industrial
| companies that do not distribute though Home Depot. To go
| higher than 350 you need to go to more exotic and toxic
| resin systems like Bismaelemide, and we don't like to do
| that because they are ITAR restricted, so we could not
| tell our foreign customers how to repair their aircraft
| when they broke. Dispose-a-plane.
|
| If JB weld were actually good to 500F, we would be
| building aircraft parts out of it. But, if it were
| actually good to 500F, it would be ITAR controlled and
| Bubbas would not be able to buy it at Home Depot.
|
| To your comment about difficulty of removal, JB weld does
| not melt. No epoxys melt. They are thermosets, not a
| thermoplastics. But it degrades at around 250f to the
| point where you can pick it apart with a mild steel pick.
| I know, because I have done it. The heat-sinking effect
| of the surrounding steel is negligible when compared to a
| 3,500F MAPP torch flame directly impinging on the epoxy.
| exmadscientist wrote:
| Yep, most of them crap out right around 350degF. Many of
| the circuit board epoxy resins go a little higher, but
| not much, and I presume they have their own issues for
| composite layups. They're certainly not structural
| adhesives.
|
| The highest temperature ordinary structural epoxy
| adhesive I know of is Lord 310, which claims to be good
| to 400degF (205degC). No idea if it's any good though,
| that project went another path so we never opened the
| tube I bought.
| Animats wrote:
| The Lock-Picking Lawyer shows the modern way to do this.[1] Yes,
| there is an app for that.
|
| [1] https://www.youtube.com/watch?v=vkk-2QEUvuk
| anfractuosity wrote:
| Has anyone come across safe autodialers that don't just make use
| of bruteforce?
|
| Regarding electronic safe locks, I found the following videos
| really fascinating
|
| * https://www.youtube.com/watch?v=lXFpCV646E0 - Side channel
| attacks on high security electronic safe locks
|
| * https://www.youtube.com/watch?v=viU8Qs1Sccg - No Mas How Side
| Channel Flaw Opens ATM Pharmacies and Gov to Attack
| Animats wrote:
| Incidentally, if you don't know this, the DoD and US Government
| standard for turning in a safe no longer in use is to set the
| combination to 10-20-30-40. That's always worth a try on any safe
| that isn't in use.
| at_a_remove wrote:
| [delayed]
___________________________________________________________________
(page generated 2024-07-05 23:00 UTC)