From the past DEFCON Hacking Conference in Las Vegas:
Your favorite gun lockbox might be preventing your toddler from having an accidental discharge, but it’s probably not at all likely to repel a criminal or even perhaps a curious teenager. Means of both attacking as well as improving upon the lockboxes you already may own are demonstrated, and audience members were invited to participate in all sorts of attacks… live and on stage.
Like they say, locks only keep honest people out. The video is very long (40 minutes), but really worth watching if you want to learn a few things and save yourself some money. The guy is funny too so the time goes by fast. The gist of the video is that many of these lock boxes are more similar to filing cabinets, than they are to safes.
Thoughts?
Comments
62 responses to “Hacking Firearm Lock Boxes”
This video is amazing.
I lock my spare pistols because if someone really wants it, they can work a little harder for it. I do not have massive amounts of money to by a high quality safe. In fact, if I had that kind of money, I would live alone!
Alternatively, I could just remove the slides, however even a simple lock prevents someone from immediate use.
+1 worth watching all the way through.
This video couldn’t have been posted sooner, I had to pick my sentry file safe to get my gun once cus I lost the damn keys :P I fabricated my own jiggler pick out of a cheap aluminum ruler using a grinder wheel and a jeweler’s file and the bugger worked! :O Watching this video when he got to the bit about wafer locks and the Sentry safe in general it made me laugh XD
*gist
Oops! Thanks buddy, I made the correction.
Hey, thanks for the cool mention here on the blog!
I’m please that so many folk enjoyed the talk. I had a really great time preparing it and giving it. The GunVault product is a really nice little lockbox, if you replace the tubular lock with something better. And eventhough the one audience member, Joey, got the cross pick to work on the LockSAF box, that attack hasn’t been repeated by anyone else whom i know. So i personally recommend that model to many friends.
Best regards to all, keep your action clean and your family safe.
I assume you sell the products that you were showing in the video? Great video. It was certainly an eye opener.
No, i am an independent security researcher and lockpicker. All of the products seen in that video do happen to be available from a single supplier, however… Center-Of-Mass.com got in touch with me regarding questions of lock security. The owner there, Patrick, was a really cool guy who was interested in knowing how secure the products were that he stocks and sells. Eventhough the manufacturers themselves were very against any independent security testing, he took it upon himself to sell the units to me at cost so that we could better understand them.
So yeah, Center Of Mass is the site that offers these and other similar items.
I would love to take that Black Hat class you mentioned. I did a google search and found (what I assume to be) that website, but it was hard to navigate. Do you have any more details on that.
Wow, that’s quite the endorsement you have made there, and you barely know of my work and such. ;-) Honestly, thank you for the kind words.
The courses that my company, The CORE Group, teaches around the country (and also sometimes internationally, but only to Blue forces) are targeted at the higher-end of the professional security and penetration field. Absolutely anyone can learn and will get a lot out of them, but the costs are sometime harder to justify if you don’t have an employer paying for your registration.
One of the biggest venues every year that our full compliment of classes are offered is at the Black Hat USA Briefings and Trainings, which are held in Las Vegas every summer (almost always around late July or early August)
Their site is blackhat.com but I don’t know if the full 2012 listings are up yet. I do know that all of our three courses from last summer are still listed in the archives…
https://www.blackhat.com/html/bh-us-11/training/core-pentest-intro.html
https://www.blackhat.com/html/bh-us-11/training/core-pentest-advanced.html
https://www.blackhat.com/html/bh-us-11/training/core-tamper.html
And, just for good measure, my own company’s web site… http://enterthecore.net
Again, i’m only posting these details because a few people asked about them specifically. I don’t want to come across as crass or as a shill. :-) For most folk, it may be a better use of your time to catch me at a public venue like a hacker conference or a Maker Faire when we run hands-on lockpicking workshops with TOOOL, The Open Organisation Of Lockpickers, which is a non-profit dedicated just to teaching folks the fun and challenge of solving locks like puzzles.
If you want something more in-depth than those public sessions, well, maybe we’ll see you at one of our private trainings. All good guys and gals are welcome.
Thank you for the links. I will be sure to sign up. I am not going to toot my own horn (I know I am a rank amateur) but I have a little background in security and forensics engineering. Mostly in nano-printing and other anti-counterfeiting/IP (intellectual property) protection – how to identify your product against a forgery in case of product failure and litigation. For me this would me as much fun as it is a learning experience.
I was a little leary when I read the length of time the video was going to be, but honestly, I’m probably going to watch it again. You put a lot of good information out, very well, very concise, and it made sense. most of us who read or saw this on here have never taken one of your classes or probably had to pick a lock (minus the one story posted right now), but you obeyed the tenant of a presentation/paper. ‘This must be understood by someone with no knowledge of the subject’. Excellent job.
I would be very interested in taking some of your classes.
Nice, man. Thanks so much for the terrific comments.
If you did indeed want to know more about some of the training work that I do (which is a little bit outside the scope of this video and thus I’m not getting into the whole rundown here) you can see the reply i made to The J above. The links and such up there should set you in the right direction.
I’m glad the video and the presentation were accessible to people from all points on the technology spectrum.
Thanks for the kind words here and in the video Deviant.
For the record Deviant the the best guy to test these things I had no clue he would actually mention us in the vid or these kinds of postings. My personal interest in locks, their weak points, methods of defeating them and my research in these subjects first got me to seek experts like Deviant.
Based on Deviants findings we have dropped some items, e.g. the BioBox which Deviant tested many many moons ago if I recall correctly and is now also sold under new brands we dropped because it’s tubular lock was sooo easy to open. He is able to explain this stuff really well and is one of those guys you can trust on the subject of security in my mind.
Wow, man… that’s one of the nicest posts i’ve ever read about myself. :-)
Thanks for the kind words of support. Thank you even /more/ however, for your continued commitment to learning about the products that you offer and for treating this segment of the market as one which deserves honesty and genuine evaluation.
I really appreciate that you’re in business not just to make a living but to do so by selling products that you can actually recommend with candor.
Can’t tell a lie man. I learned a lot from your stuff, your links and the links from those links before I got in touch with you. It is cool geeky stuff and I love that.
It has cost me a good some of time, effort and money but if I am going to sell something I want to know how good it really is. Granted the lower end lockers we sell could be issued with better locks but they serve the purpose of warding off the snatch and grab thief. Also the average consumer is not willing to pay an extra $20 or so for great lock or something made in the USA etc.. I just bought a pair of cuffs. The LEO store I was in had made in China cuffs for $8 less than the USA made one, I bought the one made in the USA. They might be pretty much the same but I spent more out of principal.
Anyway, my 2 cents. Going back to my rock.
You’re welcome, it was a great talk! I watched a couple of your other videos, and they were awesome as well. Keep up the great work.
My problem with the LockSAF box is that, while the LOCK is secure, the BOX is not. The lip on the lid looks VERY susceptible to a baby-crowbar opening it. The lip used for the actual lock also looks VERY weak. This product, in my opinion, would be better used as a layered defense, i.e. in your night-stand at night and your main safe during the times you’re out of your domicile.
I’m not a security researcher (yet), and don’t own the product. I’m going on what the product’s website shows and the fact I’ve been doing a lot of research on safes and their vulnerabilities lately.
CR Pyro,
If you want, you can buy the LockSAF on our website at full price, take a baby crow bar to it on video and show that it is VERY susceptible to a baby crow bar opening by going thru the lid.
If you are able to do it on video so we can all see it really can be done I will refund your money for the order and admit it is a weak point as well as inform the manufacturer of the problem. However having sold these for a long time now I am very very confident that you will not be able to break the lid with a baby crow bar. It is a solidly made heavy safe. Seriously.
Patrick,
I might be willing to do this if you’d be interested in doing it as an escrow deal, are you patrick@ your domain?
In looking over your site, and viewing the talk again, it’s been almost ten months since I posted that little missive, I agree with you that I wouldn’t be able to do this with one baby crow bar. Quarter inch steel would certainly be an impediment to a five second attack. Looking at the lid of the unit, though, I’m curious how the hoop/clasp is mounted to the lid. It looks like a weld to me, since I don’t see any protrusion from it, but the pics I’ve found are a bit dark. I suspect that with a concerted effort, and a pair of ‘bars, it’d be open within a few minutes.
I will discuss your challenge with my wife and get with you privately. If I do accept it, either to pay up front for a refund or escrow, I’ll post the video for all to see, though. Also to your comment that I “will not be able to break the lid with a baby crow bar,” I agree whole heartedly, but I don’t have to. I only have to break the clasp hanging from the lid. And to do that I only need the right amount of leverage. If you’d like to talk privately, you’re welcome to shoot me an e-mail to com-challenge at tinfoil hat brig@de dot com. Replace the at with an a and you’re on your way.
CRP
We can talk and figure something out to get you a bit of a discount so you can figure out a way to test these so you get it past the CFO at home. I will shoot you an email privately.
My opinion on any and all of these types of safes is that they can all be opened. To loosely quote a custom safe builder (the big boy ones you can walk into etc.) who I was working with to figure out the options and cost told me many years ago “…given enough time, tools and knowledge any safe can be opened…”. Leave for a two week vacation and they will get into your safe. In the end the price tag of what I wanted was a show stopper.
I did not hear about this blog until one of the readers here contacted me with a question so hence my late arrival to the party here.
Nice wake up call for the safe manufacturers. I wonder if any of them are changing their lock systems
There’s absolutely no point for them to change anything about their systems since 95%+ of their consumer base will likely never see this information and spending the cash for a decent back up lock will only dig into their bottom line. It’s a sad truth but the point of manufacturing and sales is to move products, not to give good service.
In some ways it’s a “sad truth” but in others it could be simply seen as “just the truth”… I suppose it’s never nice when a company markets something as being SUPER secure, when in fact it is not, but as noted in a few of the images (and some photos that I realize were difficult to read at times) one could see that these vendors (for the most part) are at least TRYING to frame their products as “just sort of good enough” and not portraying them as end-all, be-all security.
Would i prefer just a LITTLE bit more care to be taken? Yeah, i would. That’s why i liked the LockSAF model (more robust construction, harder-to-pick lock, etc) and why i felt that a modified GunVault MicroVault (if you change the tubular lock to an Abloy) can be thought of as substantial security. Not impenetrable, of course, but substantial enough that we can use them with limited confidence for specific, minor purposes.
Deviant,
Thanks for this video. I saw your presentation on flying w/guns, which led me here. I hadn’t had much of an interest in locks before, but you’ve inspired me to start learning about the subject.
Which specific Abloy lock did you use in the Gunvault? I want to try my hand at modding one….
Keep up the good work!
I’ve contacted my lock supply guy (Mitch over at SecuritySnobs.com) to ask him specifically which Abloy cam lock he sent to me. When he replies, i’ll post a link right here.
It took a little bit of dremel work to make sure the tail piece from the original tubular lock would fit on the larger, squarer Abloy tail peg… but it wasn’t all that hard overall.
Thanks–appreciate it!
Any updates on this? Could you maybe post a little guide on how to mod this? I have a dremel & can buy the lock if you post the model #. Would be great to put your talk into action.
Thanks!
Funny guy. Great video. Watch all off it.
I’m glad someone made a good quality talk about gun safes because I’ve always felt this way about safes.
Well, yeah. A safe is for theft protection. A small gun-vault is just to keep unauthorized fingers off but still have access. It may deter the criminal breaking in the car that just doesn’t have more than a couple of minutes on a hit and grab, but not the determined bad guy. Besides, if they want it, they just take it (cut the cable if it’s locked down) and go work on it at their leisure.
That said, he’s pretty entertaining and he does highlight some great points about locks. He knows his stuff and this would be a good video to watch before you buy.
A very enjoyable and informative video. I think it’s important to remember that there isn’t a safe on the market that can’t be broken into with enough effort. As as been said, these lock boxes are mostly for keeping honest people honest. If this was in your house and someone broke in, they’d probably just snatch the whole box and work it open later.
Know the difference between a gun safe and a gun locker.
While this is some good info and a great video it doesn’t scare me all that much. Most home invasions are going to be smash and grab types, I don’t see too many of them knowing where to stick a shim in a safe to hit the “learn” button or carrying specialized tools with them for picking the circular locks. The only people I’d realistically worry about would be curious teenagers with lots of free time in the house alone but since I don’t have any of those in my house I don’t have much to worry about.
Yes, everything he said was accurate. But… everything has it’s purpose. I often commit the mortal sin of leaving my CCW handgun in my car. In my defense, there are a lot of places (restaurants, post office, bank) that the law keeps me from taking my gun into. In such a case, I have a cable lock that I run through the frame (it’s a revolver) and the frame mount for the front seat. Can it be picked: yes. Can it be cut: absolutely. Will 99.9% of people who want to steal my LCR out of my truck be stopped by a cable lock: yes. Most people are not going to try and pick a Masterlock in a car with the alarm going off in the parking lot of the TGI Fridays. Every security system can be defeated. My $3,000 Cabela’s Gold Medal safe is child’s play to the guy who knows how to crack it. Will it keep the guy who smashes a window and goes after my flat away from my guns: yes. I appreciate what this guy says, and he is right. But 99.99% of the people I intend to protect my guns from are guys looking to steal some stuff to pawn for drugs, not the team from the “Italian Job”.
I wonder what kind of safe cokeman uses and how many times he’s shot it.
Just curious what model Abloy lock you used to replace the tubular lock, and exactly what mods you had to make to get it to work? (I think in the video you talked about a little dremmel work, but didn’t go into specifics.) I’m thinking that this would be a good one for the gunnies in my area to show them.
I’ve contacted my lock supply guy (Mitch over at SecuritySnobs.com) to ask him specifically which Abloy cam lock he sent to me. When he replies, i’ll post a link right here.
It took a little bit of dremel work to make sure the tail piece from the original tubular lock would fit on the larger, squarer Abloy tail peg… but it wasn’t all that hard overall. If you take the original lock out you’ll likely see instantly what is needed. The Abloy comes with a heavy-duty cam on the tail that is designed to prevent prying and such. The “backup opening” lock (the original tubular) has a thinner, lighter tailpiece because it isn’t providing security… it’s just bent in a way that turning the lock depresses a release bar.
So you want to use the tail piece (if you can call it that… it’s just bent sheet metal) from the original tubular lock even after you swap in the Abloy Protec core. Hence, making the hole a little larger and squarer in the original sheet metal tail piece and then using the small locking nut from the Abloy to affix it all to the back.
The rest stays the same. Save for the need of a little bit of spacing (you can see in the video how i used a metal keyring) the Abloy fits perfectly in the original mounting hardware and will settle right into position.
Deviant,
Any word on the cam lock part number?
Thanks!
I’ve contacted Security Snobs to get more details. It’s surely one of the first two locks on this page that i used…
https://securitysnobs.com/Cam-Furniture-Locks
… i just don’t know if they considered it the “key retaining” or “non key retaining” model. truthfully, either would work in this gun case mod. NOTE – you use the original tail piece from the tubular lock that you remove from the GunVault case. a little Dremel tool action will make the hole on that tail piece a square shape and then you’re ready to install the original tail piece on to the Abloy cam lock.
Deviant,
Did you by chance find out what part number for the correct abloy?
v/r
Raven961
The Abloy Cam locks that i used were the 180 degree rotating “key retaining” locks. But the non-key-retaining will work just as well for this.
I have SecuritySnobs shipping me some more sample products as we speak. I’m planning on retrofitting some of my Pelican cases with internal cam locks, too. =)
This is still my favorite video on this blog. One day i hope to get to a venue where TOOOL is set up.
wow, man. that’s quite an awesome thing to say! :-)
thanks for the great words of support and feedback. i try to make for a good time when i’m teaching others. guess i succeeded on this talk.
you never know where TOOOL will pop up, but folks can always check this calendar on our site… http://toool.us/calendar
Deviant,
I am about to buy a key retaining Abloy from security snobs, is the length 1 1/8, 7/8 or 5/8. Just want to make sure I am getting the right one. Thanks.
Deviant,
I am about to buy a key retaining Abloy from security snobs, is the length 1 1/8, 7/8 or 5/8. Just want to make sure I am getting the right one. Thanks.
I promise that i am really, really, really trying to get an answer for you. The problem lies in the following areas…
1. i am not home, so i can’t just measure my lock inside of the case i use presently
2. Mitch had given me a lot of sample hardware to test out, so it’s not like he can just pull a transaction record for a web purchase i made
3. He and i are working on a lot of projects including best ways to add internal Abloy Protec locks to Pelican cases, so it’s hard for us to even look back through our emails and figure out which locks were shipped at what time for what reason.
I should be flying home for at least a day towards the end of the week and i promise to try really hard to get out to my truck (assuming it’s at the house when i’m there and no one has borrowed it) in order to measure the lock. I do believe that it is highly unlikely to have been the very shallow cam lock.
It would have been the 7/8 inch most likely, but possibly the 1 1/8 lock.
I realize your a busy man and I appreciate your time. If you get a chance to measure your lock and get back to me cool. The thing is I am about to deploy and I will feel safer with my wife having a more secure means of lock while she stays back with my two boys. Thanks again.
well, I took my micro vault apart today during the half time of the Eagles game.
I tweeted a photo (@deviantollam) because I am not certain what this measurement means. from the front of the lock face back to the rear of the screw tip on the tail my lock appeared to be 1.5″ long.
maybe Mitch can help us figure out which cam lock that is.
sorry for the delay!
After closer inspection, i believe that we can consider this lock to be the 7/8″ lock. See this image…
http://deviating.net/stuff/abloy_cams.jpg
… while that photo shows the same thing i mentioned earlier (the overall length from front face to tail tip) is about 1.5″, you can clearly see that the recessed body (from behind the front face collar until you reach the maximum portion where the retaining nut could grasp) is 7/8″ inches. That would make some sense, given that if inserted into a hole drilled through material which was 7/8 inches thick, the front collar would protrude and the tail spoke would stick out… but the body of the lock itself would be totally within the medium it was passing through.
I do appreciate it, thanks to you and Mitch for helping me out. Let me know how the Abloys work in the Pelicans. Cheers!
Excellent video, I was doing a bit of research and couldn’t find any of the ones out there that seemed secure. I’m going to go your route and get the GunVault + Abloy…but before I do anyone out there willing to make and resell these? I can probably figure it out but would feel better if someone with a bit of experience did it.
As far as i know, this was just a custom mod of my own making. I could take a whack at it for you, but that would cost a bit, given the time and such that i would have to go through.
For $50 i’d pull it off — timeline uncertain — but i’d be willing to wager that you could do it pretty easily. Tell you what, if you were to send it to me and have me do it like that, i’d document the process as much as possible in order to better advise others. We can post it here if ENDO wants to post a follow-up.
I just wanted to follow-up, although I realize that no one might be following comments any longer. I’m curious if Deviant or any other black hats have taken a look at the Shotlock products. I have a Shotlock for a Remington 870 and am considering purchase of a Shotlock 1911 from center-of-mass for securing my P226 when I don’t have it in my primary safe. It seems that cost wise, the Shotlock with the mechanical lock would be similar in price to the Gunvault MV500 + a real wafer lock. I would just pony up and get the Locksaf biometric but frustratingly the dimensions won’t work for where I need to install.
Heh, i do indeed still get alerts if people comment. :-)
I have played with ShotLock products. While they are rather well-built, i do not like the overall design at all. Pump guns must be locked up with the action open. that means sacrificing at least one if not two shells which could be part of your defensive load.
I keep my shotguns with a full magazine tube and a rubber buckshot load in the chamber. Responding to threats, i can either fire the rubber or cycle it out for a full charge shot. Either way, that’s a full use of the tube.
With ShotLock, you have to have the action open (no round in the breech) and then you have to roll out the shell that lands in the lifter when the action is open (or else it can fall out at some other time) and there’s no way to replace that shell in the mag tube with the action open. Thus, you’re down TWO shells right off the bat.
Not for me.
Deviant,
Thanks for your comments regarding the Shotlock. In the case of their 1911 product it is basically just another pistol box except it is secured by way of a five key press mechanical lock instead of a digital lock. Those locks only have around 1000+ combinations but you can key them with multiple pushes of the same key as part of the opening sequence. I played with the Gunvault MV500 at a local sporting goods store and the biggest issue I had with it is counting on the keypad which felt flimsy as well as the reliance on batteries.
Your buddy who runs center of mass actually has the shotlock 1911, you might want to take a look at it, it appears to be pretty well put together and the primary thing (from my perspective) I would be curious about is how hard the locking mechanism is to defeat.
Is there a way to remove the tubular lock from my Barska biometric rifle locker, measure it, and order a direct, drop-in replacement from Abloy? I thought I understood from the video that you modified an old Abloy you happened to have laying around, but if a guy were ordering a new Abloy, could he get an Abloy that would fit correctly without modification?
I suspect that this would be possible, however from a glance at the product you’re describing…
http://www.amazon.com/BARSKA-Quick-Access-Biometric-Rifle/dp/B005FDIUPE
… it seems like it might be more of an intricate job than with the other safes i have modified. I am willing to bet that there’s a more complicated series of plastic housings and whatnot among the tubular lock assembly parts.
If you could cleanly get the tubular lock out of there, i’d be very confident that a suitable replacement Abloy would be able to be used. Without seeing the inside of the unit, however, i couldn’t comment specifically.
Heh, if anyone wants to send me one of these safes, i’ll gladly take it apart and do a detailed shot-for-shot instructional series of how to modify it.
Hey Deviant Ollam,
I came across your videos regarding a few different things, and I was amazed at how fast the time went by in your videos. Has anyone taken you up on the MicroVault? I was looking at purchasing some safes in which I can travel on airplanes, and for when I need to throw something in the car. You video really opened my eyes to the flaws of some of the more well known safes. They seem more to deter smash and grab guys, but not someone who has time and energy to put into getting your valuables. Anyway I look forward to hearing from you, and learning the ways of the black hat HAHA.
Have a great one!
Thanks for the cool feedback, man! I appreciate knowing that folks are still getting a lot out of this video.
As of now, no, no one has done a whole lot more exploration. Most of us have the newer LockSAF units or modded MicroVaults in our homes and cars for quick-access carry pieces (and larger safes for most of our collections)
Best regards and stay safe out there!
I have enjoyed that video immensely! I was looking for something I could store for travel that was small enough to throw in a bag or car, which lead me to another of your videos Packing and the friendly skies. If you are still up for doing it I would love to see a step by step of how to mod a safe. I am sure it is easy, but I am new to this and would hate to mess it up. Thank you for all the info you put out there!
D
I just ordered a couple of the Locksaf products from Patrick based in part on Deviant’s excellent talk and in part based on Pat’s clear interest in being sure he could stand behind what he sold. I couldn’t find a local dealer and Pat was within 7% or so of the lowest Amazon pricing – which he matched, to my surprise, in response to my telling him I didn’t mind contributing to a thoughtful business.
I’ve just watched Marc Tobias’ video from the subsequent defcon which looked at several similar safes to the ones Deviant worked over (http://www.youtube.com/watch?v=48HUctXZUNw) and I realized a couple of things: The Barska safes seem to be better made than many others, but between the tubular lock and the raised fingerprint reader / activating mechanism I think they might be vulnerable to a hammer and screwdriver pry-off of the raised print reader housing as well as to tubular picks.
Once I get the Locksaf products in, I’ll be very interested to look at how the signal lead from the print reader is secured. It’s obviously flush with the casing of the safe, which seems to be a very nice design improvement over the raised housing safes. The external battery mount is interesting, but I’m wondering this:
has anyone tried removing the battery and then using the gap left there to seat a prying tool and using the leverage of being a 9 v cell deep into the casing to dislodge the bypass and print reading mechanisms? I would expect that as the order is
| battery seat | bypass crosslock | print reader |
that the proximity to the locking mechanism should go a long way to defeating that kind of destructive attack.
Obviously, nothing’s perfect, I’m just curious about that as a method of attack. And I’d rather not bang up a new safe if the relative risks are known :)
Thanks again to both of you gentlemen!
Abloy locks can be very easily compromised.
https://www.youtube.com/watch?v=4tc8LJiBuOc&feature=youtu.be