This attachable robot tests every possible 3 digit combination on a safe with 100 dial positions. Once it confirms that it has reached the correct combination it plays a jingle and stops testing.
The motivation for this project came from the wonderful minds of Nathan Seidle and Alicia Gibb who put together a studio course where students could explore ethical hacking and mechanical locking mechanisms. Each team of students in the course was assigned a unique safe and given the task of building a robot that would "break" it open without causing physical damage. For the first half of the studio course, everyone was given combinations and access to the inside of their safe. During the second half, all combinations were changed and teams were locked out until their robot could guess the new combination.
BRIEF COMBINATION SAFE LOGIC
Our first step was to find the safe model and manual to learn how the safe is manufactured and operated. Second, we studied the mechanisms of a dial safe.
Based on a 3 disk safe with each disk representing one number in the combination and a 100 digit dial on the front, there were 100 possible numbers for those 3 disks. We also assumed, at the slowest, our robot would enter a combination in about 13 seconds.
100x100x100 = 1,000,000 combinations in 150.46 days
Safe companies build in about a +/- 1 range for human error on each number. It is not likely or possible to duplicate numbers between disks.
33x32x32 = 34,848 combinations in 5.25 days
We knew that our safe had 4 disks setting our combination, which could only be shuffled around and not replaced by our professors. The first and last disk were physically constrained to their original positions. We knew the factory set combination was (97, 32, 44, 0) which meant that the first number of the combination had to be 97 and the last 0.
1x33x32 = 1,056 combinations 3.81 hours
The disks within our safe were split into 17, radially equal, numbered sections. There was a single extruded interference point on each side of the disks located in the center of one of the 17 sections. The location of these interference points is what determines each number of the combination. The two center disks of our combination were identical. We also knew that the first and last disks could not move or be changed. So, we found we only had four possible orientations of the disks and their interference points.
This meant there were only 4 possible combinations, one of which was the old one.
(97, 32, 44, 0), (97, 32, x, 0), (97, x, 44, 0), (97, x, x, 0).
We deducted we only had to test 4 combinations, but had we been forced to use our original blunt force algorithm to find the correct combination, it would have only taken a total of 33.5 minutes to find (97, 7, 67, 0) instead of our initial worst case calculation of 5.25 days.
Hardware
• SparkFun Blackboard
• Custom PCB Board
• DC Motor with Encoder
• Motor Driver
• Photogate Sensor
• Piezoelectic Sensor
• Molex Connector
CODE
The logic for the safecracking algorithm was straightforward on paper but difficult when paired with the physical constraints of a safe. A combination is selected and the motor turns counterclockwise or clockwise in order to reach those numbers. The complexity of this project revealed itself when the software requested a combination, but the hardware provided one that was roughly three or more numbers off. A safe with 100 dial positions only gives about two dial positions of error to users, and we were just outside of that. Trying a very specific combination was not necessary when the motor could simply rotate and try every single position, but it was necessary when that kind of algorithm could take months to execute. We needed precision combination testing in order to test only likely combinations. Hours and hours were dedicated to calibration and fine tuning the efficiency of algorithms.
ATTACHING TO THE BODY OF THE SAFE
As a team we had quite a few creative solutions to attaching our hardware to the safe. We needed a system that we could remove and reattach with little to no disturbance caused to the placement of our dial coupler, as well as a system that was not too expensive or labor intensive to build.
In the end, the best solution turned out to be the simplest. We took some large clamps bought from the hardware store, drilled a few holes where necessary, and attached them to a few pre-cut extruded aluminum beams. The beams were used to restrict movement on every axis so that when the motor rotated our dial coupler there was not a single millimeter of movement to throw off the calculations being made by our software. The solution remained sturdy even when it was moved around, reattached and tinkered with on a daily basis.
EXPLOITING WEAKNESSES IN THE FACE OF A DEADLINE
Before the safe was closed one final time, the team studied the four disks that created the three digit combination. It was noted that two of the disks were identical, and the first and the last disk were one sided. What was discovered was that there were only four possible combinations for this specific safe (permitting that none of the disks were swapped with new ones), and instead of testing 1,000,000 combinations, the robot only had to realistically test four.
The new issue was finding out what those four were.
(97, 32, 44, 0), (97, 32, x, 0), (97, x, 44, 0), (97, x, x, 0)
The two middle numbers, 32 and 44, had "reflected digits" meaning that if the disk that creates 32 is flipped, there is only one other number it could produce in our combination. We did not have any measurements of our disks as we were not allowed to deconstruct our mechanisms, but we did have a picture with a hand for scale.
Using the one picture we had taken of a disk, notes about the notch positions, and a deadline less than 24 hours away we attempted to open our safe faster by remodeling the safe in a CAD program. After modeling a dial and four disks, we turned our virtual dial with a mouse and found which orientation the disks were in for the factory set combination. We then reoriented the disks and reverse engineered the "reflected digits" for 32 and 44. After making some minor adjustments for our human error, we attempted the combinations and eventually the safe popped open. Our reflected digits were 7 and 67.
The program we had written to blunt force test all possible combinations was archived and new code was written so that the four possible combinations for our individual safe were tested for. This was done for largely for grading and demonstration purposes.
The functionality of the software remained adaptable for any combination safe scenario.
THE TEAM
From left to right: Andrea DeVore, Kenzy O'Neill, Kendle McDowell