Cybergibbons Search …

Reverse engineer, hardware hacker, security analyst, lock picker, heist

planner. Definitely not involved in the Hatton Garden job.

HOME ABOUT CONTACT PGP KEY

A newbie’s guide to safes, both opening and My Tweets

using
Categories
POSTED ON JUNE 18, 2013 BY CYBERGIBBONS
Alarms (53)
Alarm technologies (5)
Firstly, a disclaimer – I’m not a safe cracker. I just know quite a few people who do work on
Friedland Response reverse engineering
safes and probably know more than the average person.
(8)
Signalling devices (21)
On Reddit a few months ago, a post appeared from user dont_stop_me_smee showing Arduino (9)
pictures of a large vault in a friend’s rented property. This garnered a lot of attention, partly Electronics (6)
riding off the back of the much older “vault in disused casino” popularity. Needless to say, OP General tips (1)
did not deliver, and the vault is still closed. Heat pump monitor (3)
Linux (1)
Lockpicking (2)
As a result of this post, a new subreddit was set up called “WhatsInThisThing“:
Opinion (5)
Parenting (1)
This subreddit is a place for anyone who has acquired a safe, piggy bank, briefcase, Quadcopter (1)
treasure chest, oak barrel, thumb drive, bottle, locker, storage unit, abandoned home, Reverse Engineering (13)
bomb shelter, antique can, maybe even a confidential file to post pictures of the Reviews (8)
adventure of finding out what’s inside it. StickNFind (8)
Security (81)
Bitfi (4)
There have been a lot of safes posted since then, ranging from modern £20 B&Q specials up
Burp Suite (1)
to vintage monsters.
Nebula walkthrough (11)
Shodan Searches (8)
There has also been a lot of crap posted about safes and how to open them. Uncategorized (57)

I’m writing this post to try and clear up some aspects of safes, both in terms of opening them
an using them to improve your own security. RSS - Posts
RSS - Comments
First things first, if you want your safe opened quickly and without damage, call a good safe
engineer. If you are in the UK or Europe, I can put you in touch with someone.

Otherwise, read on.

Opening cheap modern safes

There are a lot of cheap modern safes, constructed of sheet steel (or even plastic/cement
laminate!), often with digital combination locks or very insecure mechanical locks. These only
provide an illusion of security.

How would I open a cheap digital combination lock safe?

Find the manual. The safe will have a default code, and could have a reset procedure
that can be triggered from outside the safe. Try this first.
Call the manufacturer. Some of these safes have reset procedures that you can get
from the manufacturer. You will need to prove ownership. Sometimes you need the
serial number which will be inside the safe.
Try hitting it. A lot of these safes hold the boltwork back using a spring loaded solenoid.
If you hit the safe in the right place with a mallet (or even your hand on smaller safes)
whilst turning the handle, it bounces the solenoid back enough to allow the safe to open.
This works on a surprisingly large number of safes.
Pick the override lock. Nearly all of these safes have a mechanical override lock. These
are normally cheap wafer locks, which can be picked open easily by locksmiths and
hobbyists.
Try and activate the code reset button. Many safes have a small button inside the door
used to change the combination. I’ve managed to press this button from outside the
safe by using a welding rod poked through a mounting hole on the rear of the safe.
Take the front panel off and manually activate the solenoid or motor. Some of the cheap
safes have all of the electronics outside of the safe. If you remove the front panel, you
will often find two wires going through the door. These connect to the solenoid or motor
inside the safe. Apply the correct voltage (usually the same as the total voltage of the
batteries) and the safe will unlock.
Cut the safe open. I’ve not seen one of these resist more than a few minutes with even
a small angle grinder. The top or back is normally easiest.

Most of the time, you don’t really care if the safe survives or not, so go to town on it.

Opening bigger and better safes

If you want to try it yourself, you have the following options…

Non-destructively open the lock. There are a number of techniques that can be used to open
mechanical combination locks – reading contact points, or brute forcing (trying every
combination using a motor). This is a very skilled job. It is also unwise if you don’t know if the
lock works or not – hours could be spent trying to open a lock that will never unlock. Matt Blaze
has written a great guide on this (and other vulnerabilities) called “Safe Cracking For the
Computer Scientist“. If the lock is mechanical, it can be picked.

Drill the safe. If non-destructive entry is not possible, safe engineers will drill the safe. This
involves making a small penetration somewhere on the safe and then opening the safe
through the hole. Again, this is a skilled job. You need to know exactly where to drill and then
how to open the safe. Sometimes you will drill near to the combination lock and use a
borescope to read the wheel pack. Sometimes you will drill to access the bolt or fence
instead. Many safes have very hard steel called “hardplate” protecting the lock, and this
requires a lot of pressure and special drill bits to get through. Most safes have some form of
“relocker” – additional spring-loaded bolts that will trigger under attack and hold the boltwork
shut. You really don’t want to trigger these as there is no way to unlock them from outside the
safe. The small hole that is left can be filled with hardened steel and welded over for repair.
Cut the safe open. This still generally requires skill or knowledge if you don’t want to damage
the contents. Angle grinders, punches, concrete breakers, and thermal lances are tools used
here. This can be very time consuming and noisy.

Do you see a theme? You generally need to know what you are doing.

Opening a vault
Unless you can make a hole in the wall, floor, or ceiling, you should call a safe engineer.

Old safes vs. new

Most older safes tend to be fairly secure. I believe this is because of two things. Firstly, safes
used to be made better, or at least, more solidly. Secondly, if an old safe has survived this
long and not been opened, it’s either secure or too damn heavy to throw out.

A lot of modern safes are cheap crap. Anything you can buy in B&Q can be cut open in under
10 minutes. But a good, expensive modern safe is a formidable opponent. Modern
combination locks are very good – they have extensive “anti manipulation” features. Even low-
cost lever locks are hard to pick. Hardplate is very hard and there are advanced composite
materials that are difficult to drill or cut through.

What not to do
There is a lot of bad advice floating about.

Don’t cut the external hinges off the door. They aren’t part of the locking mechanism on even
the cheapest safes, so you now have a broken safe that is still closed.

Don’t force the handle. Good safes have boltwork that won’t open no matter how much force
you apply to the handle. The handle will shear off first or you will break part of the drive
mechanism.

Don’t hit the dial or spindle of the combination lock. The combination lock and door has
something called a relocker on it. If you trigger this by hitting it, additional spring-loaded bolts
will fire and mean that you cannot open the safe even if you unlock the lock. You’ve potentially
made an easy job much harder.

Don’t attempt to use thermite. I’m not sure why, but people suggest this. I suspect none of them
have made or used thermite. I have. It’s hard to mix correctly, it isn’t cheap, it’s dangerous, and
it will destroy the contents of the safe.

Don’t try a plasma cutter. Again, I suspect these people have never used a plasma cutter.
They are exceptionally good at cutting through plate. They are no good when you cannot make
the cut in one pass (there is nowhere for the slag to go, so it gets blasted back towards you).
They will toast the contents. They are expensive and need a lot of compressed air.

Don’t try any other half-cut idea from someone who has no idea what they are doing. Dousing
the safe in liquid nitrogen, filling with water and blowing it up etc. all sound like they are a lot
more work and cost than just paying a safe engineer.

Don’t think that opening safes is some kind of mystical black art. There are hundreds of
people who can open safes. The more expensive and secure the safe, the less there are that
can open it. But there is no safe that cannot be opened.

Don’t think that the safe will have anything exciting in it. They very rarely do.

What do you need in a safe?

After reading all of that, you’ve decided you need a safe. What should you look for?

Consider the difference between a key and combination. A combination can be trivially
copied, but is easily shared. A key is harder to copy but useless if left near the safe.
Which works better for your users?
Avoid any digital combination safe that has a mechanical override lock. Instead of
having one good mechanical lock, you now have a digital lock and a crap mechanical
lock. The security of the safe is limited by the lower of the two.
Look for a good lever lock. At prices acceptable to most householders, a good lever
lock will provide the best security.
Decide if you are protecting against fire and/or theft. A lot of “fire safes” have extremely
poor security. Burglary is far more common than house fire. My safe protects against
theft, and the small fire chest inside protects truly irreplaceable objects.
Avoid any safe that a single person can easily pick up. You don’t need something that
weighs 750kg, but 50kg+ makes things a lot more awkward for burglars.
Make sure you can bolt the safe to the floor and/or wall. A 50kg safe attached to a
concrete floor with 4 expanding bolts is going to be as hard to move as a 500kg safe.
Make sure it is big enough to hold your stuff. If it can’t hold the thing you need to protect,
it has no purpose. A lot of smaller safes can’t take 15.6″ laptops.
Make sure it is accessible enough that you actually use it. If it is hidden away, you are
unlikely to ever use it. If your stuff isn’t in the safe, it doesn’t matter how secure the safe
is.

Recommended contacts
The following locksmiths and safe engineers are known to me, and whilst I have never had to
use their services, I know they do good work.

Jason Jones at Kelocks (UK)

Stuart Game at BBS Safe Engineers (UK)

Nigel Tolley at Discreet Security Solutions (UK)

Jord Knapp at Knapp Junior (NL)

Emiel van Kessel at De Slotenspecialist (NL)

Oliver Diederichsen at Tresoroeffnung (DE)

Share this:

Twitter  Facebook  Reddit

THIS ENTRY WAS POSTED IN LOCKPICKING, SECURITY. BOOKMARK THE PERMALINK.

14 thoughts on “A newbie’s guide to safes, both opening and using”

Nigel PERMALINK ⋅ REPLY

JUNE 18, 2013 AT 9:13PM

Whilst not a great fan of all this info being pooled so neatly, anyone could find this
out with a little work, so I’ll not moan.

As a pro, I agree with pretty much all of this. Main point to disagree with is that the
top safe engineers will go to massive lengths NOT to drill a safe – it takes forever
on a decent one, and those relockers can turn a 2 hour pick/decode into a 3 day
job with a few hundred blunted carbide tipped drills if you nick the glass.

Also, “additional sprint-loaded locks” is wrong. They are spring-loaded bolts. They
take no key. Even better, some of the relockers are also relocked(!), so nothing
short of complete destruction will open the door.

cybergibbons PERMALINK ⋅ REPLY

JUNE 18, 2013 AT 9:20PM

Thanks – I was hoping you would pass comment!

I hope that the post really drives people to speak to safe engineers
rather than do it themselves. There have been so many safes lose their
hinges on reddit already, some of which look like nice, vintage pieces.

I think I agree with you with good safe engineers on good safes. But,
looking at mid-range safes with mid-range safe engineers, it seems
that drilling is quite popular. The post is maybe focused on the US
where combo locks seem more common on cheaper safes.

Happy to change it through, what do you think?

I had relockers as bolts, but then I thought the layman would assume
they were alongside the main bolts, whereas they are usually bolts that
fire into the boltwork. I’ll clarify.

Sterling Brenner PERMALINK ⋅ REPLY

JULY 9, 2013 AT 3:56AM

My wife and I recently had some trouble retrieving the contents from our fire proof
safe. Normally, I’m the kinda guy that will try anything to solve a problem on his own
before admitting failure and contacting the right person for the job. In this particular
case, every attempt I made at opening the case failed and as you alluded to in the
article, the last thing you want to do is destroy the contents of the safe while
attempting to extract them. Long story short, contacted a technician from the
company and all was resolved without hassle.

Jason Jones PERMALINK ⋅ REPLY

JULY 22, 2013 AT 8:11AM

Some good advice there, the main difference with cheap safes is that they are
nothing more than an over priced tin box, I specialise in opening odd, medium to
high grade safes, Most of these safes will have some knid of AED (Anti Explosive
Device) that are ment to be set off it attacked. A lot of the safes and vaults I work
on were made at a time where a would be thief would have a long time
undisturbed to try and break into a safe (this was a time before Alarms) so they
could sit there over the weekend having a go.

There are a lot of traps that they are put in different models of safes and vaults to
stop them from being opened by every known method of attack. I did a large 6ft
safe not that long ago that had tar in the body, the ide is some one tried to use hot
equipment to open and would catch the tar alight and the room would fill with
dense chocking smoke.

cybergibbons PERMALINK ⋅ REPLY

JULY 22, 2013 AT 8:38AM

Thanks for commenting Jason, I hope you are OK with the link to your
site (I’ve heard many good things about your work).

The older safes are fascinating, I love the fact that they might be almost
completely unique and have all manner of crazy devices to stop people
getting in.

I really don’t get these cheap safes. There are Yale branded safes in
B&Q that are £130 or so, have a digital lock and a wafer lock override.
Literally less than 2 minutes to open. I spent about £500 on a ex-
display safe, and I’m confident it would withstand any reasonable
attack, it would be hard for anyone to move even if it wasn’t bolted onto
a concrete slab floor.

James PERMALINK ⋅ REPLY

MARCH 1, 2016 AT 7:45AM

Great post about safes! Seriously a great buyers guide. You never want to resort to
drilling one out!
 Jim PERMALINK ⋅ REPLY
JUNE 2, 2016 AT 10:14PM

Hi. Great article. I recently purchased an Alpha A690BKF. 66KG bolted to a

concrete floor.
Two questions…
1 Your thoughts on this safe, and
2 It has fixing holders in the front right corner and rear left. Would you recommend I
drill the other corners for additional fixing points?

Jim PERMALINK ⋅ REPLY

JUNE 2, 2016 AT 10:15PM

Sorry, I meant fixing holes, not holders!

Martin Higson PERMALINK ⋅ REPLY

JUNE 14, 2016 AT 9:22AM

Hi,
I plan to fix a modern small Yale key safe (with letterbox) in a fairly big old (ornate)
safe. I can fix the two bottom holes of the new safe ok with two socket bolts coming
up through the old safe’s 2 draw, cover plate. I also plan to drill into the inside back
of the old safe and secure the new safe via these 2 holes, What should I expect to
find when I drill these holes? Lead, sand maybe? I would like to know in advance
so I can best choose the bolt anchor method.
This new Yale safe has little room down the sides when inside this old safe, so will
be very difficult to extract when fixed in place. This to me seems a good place to fix
a small modern safe. The old safe has no key!

Igor PERMALINK ⋅ REPLY

OCTOBER 1, 2016 AT 4:40AM

It is very refreshing to see an attempt to post a complete treatise on how to open

safes. Even better is the lack of pompous “I have so much information but I am
afraid of it falling into the wrong hands” attitude. Thank you so much for making
such a great effort to make valuable information available to the public. I was
opening a Diebold safe today, destructively. Did not finish due to lack of time, but
made a lot of progress by cutting on the side with angle grinder. Later this evening
I sat down to read about safe cracking, and found that most information posted
online is of appalling quality. You are very different.

Stuart heenan PERMALINK ⋅ REPLY

FEBRUARY 11, 2017 AT 12:00PM

Jason Jones is a very good and experienced safe and vault engineer !! I have
used him for many jobs I don’t have the skill set for I’d highly recommend him !!!

Sam PERMALINK ⋅ REPLY

JULY 13, 2017 AT 8:30PM

Hello, Can you suggest some brands of safes that we can feel confident in
purchasing?

Joy Butler PERMALINK ⋅ REPLY

MAY 10, 2018 AT 4:33AM

I appreciate you helping me learn more about opening and using of safes. It really
helped when you said that we should decide whether we are protecting against fire
and/or theft. Being protected from the two is really a serious thing and should never
be ignored.

Mark Murphy PERMALINK ⋅ REPLY

SEPTEMBER 5, 2018 AT 2:26PM

I really appreciate your tip to remember the code reset button if you have trouble
remembering your passcode. My wife and I have been thinking of getting some
guns for hunting trips, and we both have a bad memory. I will be sure to find a safe
with a code reset button!

Leave a Reply
Your email will not be published. Name and Email fields are required.

Comment

Name Email Website

Notify me of follow-up comments by email.

Notify me of new posts by email.

Post Comment
This site uses Akismet to reduce spam. Learn how your comment data is processed.

Powered by WordPress. Debut theme by kwight.