Safe in a Ditch

Breaching a Digital Safe


Not today my friends, but that sure sounds fun, and already done.

Most nights, I try to get in a walk. That is, when it isn’t Surface of the Sun Fahrenheit outside. Ever since I was young, I’d keep an eye for things on the ground, and you occasionally find a few interesting items.

Some people go magnet fishing — literally tying a really strong magnet to a rope and they chuck it over a bridge — They find anything from bicycles to firearms and abandoned munitions. I’m much simpler, I just aim my flashlight over the side while I walk and listen to 90’s generic adult music. Today, it was “Sixpence None the Richer – Kiss Me” which reminded me of my youth and innocence, careless summers, and nervously meeting my first girl. Which took way too damn long because back then, women didn’t like you if you were “weird”. It also sounded kind of like a medication commercial.

Here, I found a partially broken keypad and lock cylinder. From this far away, I presumed it was likely a safe, but could be a cash register, security panel, fire panel or whatever.

Getting closer, however, it looks like it was a type of digital safe made by Sentry:

This sort of thing thrills me, because I am into security and I just found both a lock I could potentially pick at some point, but also a keypad I can perhaps learn something about. I can even do things destructively that I wouldn’t do to things I care about, because it’s already destroyed. I should question why it is in a ditch and broken, but I prefer to use positive energy to guide my decisions and took it home instead.

I also found a knife (pictured) but the blade lock is broken, so I’ll decide if I want to tear it apart or toss it.

First thing I noticed about the panel were both the wires (obv) and that one was solenoid and one was for the batteries, and I knew this blog would be unconventional. I also noticed the test pads, but also:

These small plastic clips — if you can get the faceplate off from the front with a bit of spudging, you can non-destructively get access to the board — no evidence at all that you were inside.

This itself is not really a problem, the keypad needs to be on the insecure side to be accessible.

And, inside:

Normally, as I did with the Alarm System blog series, I’d dump the EEPROM and get the pin code — and I may just do that at some point, but it really doesn’t motivate me when I’m still on the insecure side and I see this:

In this case, “SOL” does not mean “Shit outta luck”, it means “Solenoid”. Simply connecting a voltage to that white wire should be enough to override the entire keypad component of this device and allow us to gain entry to it.

So if you have one of these safes, remember it might be okay to protect against your house being on fire for “X Minutes” but it likely won’t do much to anybody who wants to get in.

TL; DR: If your lock is controlled on the insecure side, it is insecure. Instead, route the wires to the inside of the safe from the keypad and process the data in that area instead.




Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.