How Safes Work - AnalogHacking - Safe …

1 Slide 1 How Mechanical Safes WorkHow Mechanical Safes WorkAnalogAnalogHacking In A Digital WorldHacking In A Digital WorldBy Leonard By Leonard GallionGallion, CISSP, 2 Kinds of safe LocksKinds of safe Locks safe and Vault locks are broken down into safe and Vault locks are broken down into two categories:two categories:Mechanical: A dial must be turned left & right, in the Mechanical: A dial must be turned left & right, in the correct order and amounts to open the order and amounts to open the : A small digital processor opens the lock Electronic: A small digital processor opens the lock when the correct code is the correct code is entered. We are going to look at how common We are going to look at how common mechanical Safes Safes 3It All Starts With The It All Starts With The CombinationCombination How to dial the typical 3 number How to dial the typical 3 number combination safe :combination safe : Turn the wheel LEFT landing on the 1 Turn the wheel LEFT landing on the 1ststnumber number the fourth time you come around to fourth time you come around to it.

2 Turn the wheel RIGHT landing on the 2 Turn the wheel RIGHT landing on the 2ndndnumber the third time you come around to the third time you come around to it. Turn the wheel LEFT landing on the 3 Turn the wheel LEFT landing on the 3rdrdnumber number the second time you come to second time you come to it. Then turn the wheel RIGHT until the lock Then turn the wheel RIGHT until the lock 4 What Does What Does DialingDialingDo?Do? As you dial the various numbers of the As you dial the various numbers of the combination you are actually moving 3 combination you are actually moving 3 wheels (plus a special Drive Cam wheel) wheels (plus a special Drive Cam wheel) inside the the lock. Each of the 3 wheels have a single notch Each of the 3 wheels have a single notch cut into them. This notch is called the into them. This notch is called the Gate. Once all of the Gates on the wheels are Once all of the Gates on the wheels are lined up, a bar called the Fence can fall into lined up, a bar called the Fence can fall into these notches, allowing the lock to notches, allowing the lock to open.

3 DialingDialingthe combination lines up the Gates the combination lines up the Gates on the wheels underneath the the wheels underneath the 5 Looking Inside A LockLooking Inside A LockWheelsLeverDrive CamRelockerSpline KeyGateGateFenceBack ViewLever SpringSlide 6 The Dial And Drive CamThe Dial And Drive CamSafe DialDrive CamSpindleDrive PinThe spline key (seeprevious page) locksthe drive cam, spindleand dial togetherSlide 7 And The Wheels Go AroundAnd The Wheels Go AroundDrive PinThe Drive Cam and each of the wheels have a Drive Pin. When theDrive Cam is rotated by the dial of the safe , eventually it s Drive Pinwill hit the Fly of the 1stwheel. Then the cam and the 1stwheel willturn together. When the drive pin of the 1stwheel hits the Fly of the2nd wheel, then all three (the cam and wheels 1 & 2) move togetherThis can continue until the cam and all 3 wheels turn 8 Keep On On you turn the Dial & Cam four turns to the left, the Drive Camrotates enough to pick up Wheels 1, 2 and 3.

4 Wheel 3 then getsturned until the Gate is directly under the Fence by dialing thefirst number of the 9 Keep On Spinning (2)Keep On Spinning (2)My moving the Dial and Cam three turns to the right, you leave the3rdWheel in place and only turn enough for the Cam to movethe 1stand 2ndWheels. The second Wheel s Gate is left under theFence as the second number of the combination is 10 Keep On Spinning (3)Keep On Spinning (3)Next, by turning the Dial and Cam two turns to the left, only the 1stWheel is moved. The last digit of the combination brings the 1stWheel s Gate under the 11 The Fence Finally FallsThe Fence Finally FallsFinally by turning the Dial and Cam right one last time, you moveThe Cam s Gate under the Lever and allow the Lever & Fence to GatesFenceLeverCam GateSlide 12 Open At Last!Open At Last!By continuing to turn the dial right, the Fence (and Lever) stuck inthe Gates, pull the Bolt inside the lock s case so the safe will : From the back, the cam and wheels appear to turn left as the dial turns rightLeverSliding BoltBack View