I once bought a vacation home that was a century-old English cottage that went through 7 different owners over time. It once belonged to a US state senator. Another time it belonged to a prominent local businessman who went to jail for white collar crime, and went through a nasty divorce. Anyway, the house had a TL-15 Star Safe embedded in the wall in the master bedroom. The previous owner did not know the combination. Neither did the owner before him. Some unknown person at some point had attempted to open it, as the safe had 3 drill holes on the face plate.
There was a very old sticker on the safe bearing the name of the company who apparently installed it. The phone number was so old it did not have an area code. Fortunately the company still existed after multiple decades. I called them and asked if they could open it in a non-destructive way. One of their technicians came, looked at it and probed it for a couple hours, but determined he could not open it. And the combination had been changed from the manufacturer's default. He gave me the contact info for a reputed safe technician who could help.
Later I called this safe technician, but he was incredibly difficult to get a hold of. I had to leave multiple voicemails and send multiple emails. We chatted briefly one time and he said he would get back to me later to schedule an appointment. But he seemed half-retired and not interested in the job, as I never heard back, despite multiple contact attempts and my offer to pay handsomely. Eventually I became frustrated with his non-responsiveness and stopped caring about the safe.
Fast forward a few years later, I was going to sell the vacation home, but I really wanted to open the safe before selling. Curiosity had gotten to me. I searched online for another safe technician, and found a supposedly reliable guy. I arranged an appointment. He showed up a few days later. I asked him to open it any way he could, even if he had to destroy the safe. He started drilling, making multiple holes over the course of 2 hours. Eventually he came to me and said he ran out of drill bits as they all got worn out. He had to leave and promised he would be back.
It took one week for him to eventually come back early one morning with more drill bits. He spent another couple hours drilling. Then he put a camera scope in the holes and claimed he could see 3 of the 5 wheels spin while the other 2 were broken. He spent an entire day trying to manipulate the wheels. But after a whole day of work, he came to me with a defeated look and apologized saying he was sorry but he doesn't think he is able to open the safe.
I went back online to find yet another professional who could help. I learned that what I really needed to look for is a professional who is a member of SAVTA (Safe & Vault Technicians Association). So I found a SAVTA tech who on the phone told me a TL-15 safe in a residence is unusual as it is normally made for businesses like a jewelry store. Unfortunately he said his next availability would be about a month from now, and I was going to sell the house in the coming weeks.
Eventually I found another SAVTA tech who was available on a short notice. He and a colleague both arrived a morning, and it took them 3 hours to do more drilling and more manipulation to FINALLY open the safe.
Guess what was in it?
Nothing. It was empty! I closed the sale of the house literally 2 weeks later. I was still very relieved to have gone through this hassle to open it. The unsatisfied curiosity if it had not been open would have eaten me alive :) Also I decided in my next house I wanted a safe rated TL-15, as clearly they can withstand a lot.
In what scenarios would someone paranoid / secretive / foresighted enough to have a TL-15 safe in their home also be negligent enough to leave the $100k in cash behind when the sell they house? (And without any widow / family / "business associates" who would know enough to invest in the prompt services of a SAVTA tech?)
Of course it was empty! The money was under the third floorboard next to the room door. You've obviously not watched enough Columbo or "Murder She Wrote"
Very interesting. A TL-15 is an excellent container, but I'm not familiar with a 5 wheel combination lock in commercial service in the US. I have a S&G vault lock which has 4 wheels. I don't doubt 5 wheel locks exist though, especially if the safe was possibly installed for a US Senator. Would definitely be interesting to see some photos of the lock (both outside and inside) if you still have any.
Here is a picture of the inside: https://ibb.co/sF8RLDv I can't seem to locate a picture of the outside.
The politician owner was not a "US senator" but a "state senator", IOW not a member of the US Senate but of the state senate. So not as prestigious as you think :)
wowzers, I guess that's my fault for not searching for images of the safe you were talking about but when I heard "in home safe" I imagined those things like a gun safe but they weren't kidding around!
I actually would guess that replacing the damaged door would put that back in operation and would make for a cool perk for selling the house, but with that much steel(?) I can't imagine how much such a stunt would cost
In 1999 we bought a house. It had a locked safe embedded in a wall and the seller did not know the combination - the house had belonged to his parents who had passed away.
When we started remodeling the house we used a jackhammer to pry the safe from the wall, planning to discard it. But, in a moment of inspiration, I loaded the safe on a pickup truck and took it to a local locksmith to see if he could open it. The locksmith took a walk around the safe and reported "the combination is xxL,yyR,zzL." I was astonished. Until he showed me the secret: there was a piece of paper taped to the back of the safe.
Incidentally, if you don't know this, the DoD and US Government standard for turning in a safe no longer in use is to set the combination to 10-20-30-40.
That's always worth a try on any safe that isn't in use.
Few years back the electronic lock on a safe in our office somehow died. The locksmith who supplied it was on vacation, but we somehow were able to convince him to give us the drill plan with the assurance that he will be the one to fix the safe after we had opened it ourselves. It was not that much of the drill-plan, but “take an angle grinder, cut there and the internal part of the lock should just fall inside the safe, 15min of cutting tops”, well it took most of the day and we busted entirely new DeWalt angle grinder in the process. Well, the procedure he gave us was for the lower security model, so instead of cutting through the bracket that held the lock in place, we were cutting through the actual locking bolt. Still, it was kind of a fun experience.
These "sergeant greenleaf" locksets are old but common in military/national security use around the world, although military models have a couple extra security features not sold to the public. They are amazing devices. They are 99.9999999% reliable for decades without any maintenance but nevertheless can take a beating. The combination can be changed in seconds. Recovering a forgotten combo is possible with only a screwdriver, so long as the safe is still open. Most are or have been replaced by digital locks, but I've always liked Sergeant Greenleaf.
S&G padlocks are evil. They are hateful devices. The inner working are broadly similar to the full-sized dials but are fiddly little demons. Changing their codes never goes properly, and recovering from a lost code requires multiple special keys. I know of boxes containing dozens of "bricked" S&G padlocks that people have given up trying to use. The difference in design and build quality makes it hard to believe both are made by the same people.
Same company makes both combination dials and the large padlocks like the 831, 833, 851. I was lucky enough to tour their manufacturing facility, it's a typical machine shop plus a small foundry as they do their own casting on-site too.
I just posted this amateur documentary about a guy that prides himself in saving safes from the drill. He only does manipulation. He uses a stethoscope and sometimes a laser pointer to visualize the wheel angles.
The first thing I though about when listening to his description of moving the dial was a servo motor with a torque measuring shaft hooked to a microcontroller. It sounds like you could just graph torque required to turn it over 360 degrees to get the same info he was getting.
This is called the "soft drill". And strangely, this can still be a destructive attack. There are systems that can do proper manipulation by graphing out the gates, and there are systems that just do brute force attacks by dialing every combination. I've been told that the brute force machines that try every combination typically wear the lock out and it needs to be replaced afterwords.
Yeah, I certainly figure someone has done this before with varying success. At the extreme end I imagine someone could just design a dial with a centrifugal clutch that if spun beyond a certain speed clutches out permanently and locks the dial shaft. My limited understanding of anti-theft mechanisms in safes is they are generally destructive, making it impossible for anyone to open the safe once activated.
With traditional safe combination locks, it's kinda normal for them to be spun fairly fast.
Often to enter the first digit you often have to turn the wheel four full revolutions, the second digit three full revolutions and so on. So users will be trying to spin it pretty fast under normal operation.
Of course there are other solutions to autodialers. For example, making sure burglers can't spend 3 days with the safe waiting for the autodialer to run.
(Sparrows makes good stuff, but note how the .com website doesn't list where they are actually located. The .ca is out and proud about their real address.)
Even if I'm not familiar with a topic there's something deeply satisfying about reading (watching, listening to) accounts of people who are good at their jobs doing intricate or technical work.
I have not one but two safes I've inherited which I ought to get opened. My thinking is that both safes would not be empty, as you can store as much emptiness as you like in a single safe.
I should figure out where to begin, do I bring the safes to the locksmiths, how are the safes disposed of, et al? It should be interesting.
I was surprised to read that they filled their hole with old carbide drill bit tips and J-B Weld (a two-part epoxy). I was expecting it to be welded closed.
Likely stronger than welding against drilling. Weld bead is generally pretty easy to drill through. Carbide drill bits you’d need diamond to cut through. Sure you could cut through the JB weld, but you’ll obliterate your drill bits as soon as you hit the carbide.
Carbide junk in a hole will not only shatter weak drill bits but also deflect the stronger bits sideways, likely snapping them. Many security devices insert carbide debris, usually ball bearings, as protection over areas likely to be drilled.
JB Weld is a run of the mill 2-part organic epoxy, heating it up to 250F is plenty more than enough to dig it out with a shanghai-grade screwdriver from Harbor Freight.
You sure about that? J-B Weld claims its resistant to a constant temperature of 500F, and 10 mins of 600F. With the heatsinking of the steel body nearby, it'd be quite difficult to melt out the epoxy. Not impossible, mind you, but... this isn't intended to be a bulletproof fix, I assume. Why would a would-be thief even think there's epoxy there in the first place?
You are a person who is easily manipulated by marketing, and clearly has zero practical experience in this field. I do. There are no epoxys that are good to 500F. None of them. See username, Buildsjets. The epoxy resins that we build jets out of are cured in an autoclave under high pressure, and at best they are good to 350F, and they are absolutely the highest performing epoxy resins you can buy from the likes of Hexcel, Toray, and other industrial companies that do not distribute though Home Depot. To go higher than 350 you need to go to more exotic and toxic resin systems like Bismaelemide, and we don’t like to do that because they are ITAR restricted, so we could not tell our foreign customers how to repair their aircraft when they broke. Dispose-a-plane.
If JB weld were actually good to 500F, we would be building aircraft parts out of it. But, if it were actually good to 500F, it would be ITAR controlled and Bubbas would not be able to buy it at Home Depot.
To your comment about difficulty of removal, JB weld does not melt. No epoxys melt. They are thermosets, not a thermoplastics. But it degrades at around 250f to the point where you can pick it apart with a mild steel pick. I know, because I have done it. The heat-sinking effect of the surrounding steel is negligible when compared to a 3,500F MAPP torch flame directly impinging on the epoxy.
Yep, most of them crap out right around 350°F. Many of the circuit board epoxy resins go a little higher, but not much, and I presume they have their own issues for composite layups. They're certainly not structural adhesives.
The highest temperature ordinary structural epoxy adhesive I know of is Lord 310, which claims to be good to 400°F (205°C). No idea if it's any good though, that project went another path so we never opened the tube I bought.
I don't think I've ever encountered such an over-monetized site. Every square mm of space has an ad. Then pop ups will spontaneously cover existing ads. I can't even find the content.
Install a content blocker - uBlock Origin on a browser which does not try to thwart its purposes, i.e. Firefox or similar - and you won't see a single ad or pop-up on that site.
I once bought a vacation home that was a century-old English cottage that went through 7 different owners over time. It once belonged to a US state senator. Another time it belonged to a prominent local businessman who went to jail for white collar crime, and went through a nasty divorce. Anyway, the house had a TL-15 Star Safe embedded in the wall in the master bedroom. The previous owner did not know the combination. Neither did the owner before him. Some unknown person at some point had attempted to open it, as the safe had 3 drill holes on the face plate.
There was a very old sticker on the safe bearing the name of the company who apparently installed it. The phone number was so old it did not have an area code. Fortunately the company still existed after multiple decades. I called them and asked if they could open it in a non-destructive way. One of their technicians came, looked at it and probed it for a couple hours, but determined he could not open it. And the combination had been changed from the manufacturer's default. He gave me the contact info for a reputed safe technician who could help.
Later I called this safe technician, but he was incredibly difficult to get a hold of. I had to leave multiple voicemails and send multiple emails. We chatted briefly one time and he said he would get back to me later to schedule an appointment. But he seemed half-retired and not interested in the job, as I never heard back, despite multiple contact attempts and my offer to pay handsomely. Eventually I became frustrated with his non-responsiveness and stopped caring about the safe.
Fast forward a few years later, I was going to sell the vacation home, but I really wanted to open the safe before selling. Curiosity had gotten to me. I searched online for another safe technician, and found a supposedly reliable guy. I arranged an appointment. He showed up a few days later. I asked him to open it any way he could, even if he had to destroy the safe. He started drilling, making multiple holes over the course of 2 hours. Eventually he came to me and said he ran out of drill bits as they all got worn out. He had to leave and promised he would be back.
It took one week for him to eventually come back early one morning with more drill bits. He spent another couple hours drilling. Then he put a camera scope in the holes and claimed he could see 3 of the 5 wheels spin while the other 2 were broken. He spent an entire day trying to manipulate the wheels. But after a whole day of work, he came to me with a defeated look and apologized saying he was sorry but he doesn't think he is able to open the safe.
I went back online to find yet another professional who could help. I learned that what I really needed to look for is a professional who is a member of SAVTA (Safe & Vault Technicians Association). So I found a SAVTA tech who on the phone told me a TL-15 safe in a residence is unusual as it is normally made for businesses like a jewelry store. Unfortunately he said his next availability would be about a month from now, and I was going to sell the house in the coming weeks.
Eventually I found another SAVTA tech who was available on a short notice. He and a colleague both arrived a morning, and it took them 3 hours to do more drilling and more manipulation to FINALLY open the safe.
Guess what was in it?
Nothing. It was empty! I closed the sale of the house literally 2 weeks later. I was still very relieved to have gone through this hassle to open it. The unsatisfied curiosity if it had not been open would have eaten me alive :) Also I decided in my next house I wanted a safe rated TL-15, as clearly they can withstand a lot.
Everyone always says it was empty :)
If it contained $100,000 in cash, the smart thing to do is say it was empty.
In what scenarios would someone paranoid / secretive / foresighted enough to have a TL-15 safe in their home also be negligent enough to leave the $100k in cash behind when the sell they house? (And without any widow / family / "business associates" who would know enough to invest in the prompt services of a SAVTA tech?)
Of course it was empty! The money was under the third floorboard next to the room door. You've obviously not watched enough Columbo or "Murder She Wrote"
Probably cost about 10K to open it.
Very interesting. A TL-15 is an excellent container, but I'm not familiar with a 5 wheel combination lock in commercial service in the US. I have a S&G vault lock which has 4 wheels. I don't doubt 5 wheel locks exist though, especially if the safe was possibly installed for a US Senator. Would definitely be interesting to see some photos of the lock (both outside and inside) if you still have any.
Reminds me of this: https://blackbag.toool.nl/?p=31
Here is a picture of the inside: https://ibb.co/sF8RLDv I can't seem to locate a picture of the outside.
The politician owner was not a "US senator" but a "state senator", IOW not a member of the US Senate but of the state senate. So not as prestigious as you think :)
wowzers, I guess that's my fault for not searching for images of the safe you were talking about but when I heard "in home safe" I imagined those things like a gun safe but they weren't kidding around!
I actually would guess that replacing the damaged door would put that back in operation and would make for a cool perk for selling the house, but with that much steel(?) I can't imagine how much such a stunt would cost
There was a time that you could've gotten a lot of Reddit karma by releasing the story in breathless installments. :)
(Good story, and have an HN Buck.)
In 1999 we bought a house. It had a locked safe embedded in a wall and the seller did not know the combination - the house had belonged to his parents who had passed away. When we started remodeling the house we used a jackhammer to pry the safe from the wall, planning to discard it. But, in a moment of inspiration, I loaded the safe on a pickup truck and took it to a local locksmith to see if he could open it. The locksmith took a walk around the safe and reported "the combination is xxL,yyR,zzL." I was astonished. Until he showed me the secret: there was a piece of paper taped to the back of the safe.
Come on, everyone wants to know what was inside??
Not surprisingly, empty.
Incidentally, if you don't know this, the DoD and US Government standard for turning in a safe no longer in use is to set the combination to 10-20-30-40. That's always worth a try on any safe that isn't in use.
Few years back the electronic lock on a safe in our office somehow died. The locksmith who supplied it was on vacation, but we somehow were able to convince him to give us the drill plan with the assurance that he will be the one to fix the safe after we had opened it ourselves. It was not that much of the drill-plan, but “take an angle grinder, cut there and the internal part of the lock should just fall inside the safe, 15min of cutting tops”, well it took most of the day and we busted entirely new DeWalt angle grinder in the process. Well, the procedure he gave us was for the lower security model, so instead of cutting through the bracket that held the lock in place, we were cutting through the actual locking bolt. Still, it was kind of a fun experience.
These "sergeant greenleaf" locksets are old but common in military/national security use around the world, although military models have a couple extra security features not sold to the public. They are amazing devices. They are 99.9999999% reliable for decades without any maintenance but nevertheless can take a beating. The combination can be changed in seconds. Recovering a forgotten combo is possible with only a screwdriver, so long as the safe is still open. Most are or have been replaced by digital locks, but I've always liked Sergeant Greenleaf.
Is that the same or different from the padlock style ones I see being used to secure military equipment?
S&G padlocks are evil. They are hateful devices. The inner working are broadly similar to the full-sized dials but are fiddly little demons. Changing their codes never goes properly, and recovering from a lost code requires multiple special keys. I know of boxes containing dozens of "bricked" S&G padlocks that people have given up trying to use. The difference in design and build quality makes it hard to believe both are made by the same people.
https://mbausa.com/content/downloadfiles/8077_Combo_Recovery...
https://mbausa.com/s-g-padlock-combo-recovery-set/
Compare with the easy change procedure for dials: https://homelandsafes.com/how-to-change-the-combination-on-a...
Same company makes both combination dials and the large padlocks like the 831, 833, 851. I was lucky enough to tour their manufacturing facility, it's a typical machine shop plus a small foundry as they do their own casting on-site too.
I just posted this amateur documentary about a guy that prides himself in saving safes from the drill. He only does manipulation. He uses a stethoscope and sometimes a laser pointer to visualize the wheel angles.
https://www.youtube.com/watch?v=1hz_kjTc8DQ
The first thing I though about when listening to his description of moving the dial was a servo motor with a torque measuring shaft hooked to a microcontroller. It sounds like you could just graph torque required to turn it over 360 degrees to get the same info he was getting.
This is called the "soft drill". And strangely, this can still be a destructive attack. There are systems that can do proper manipulation by graphing out the gates, and there are systems that just do brute force attacks by dialing every combination. I've been told that the brute force machines that try every combination typically wear the lock out and it needs to be replaced afterwords.
Yeah, I certainly figure someone has done this before with varying success. At the extreme end I imagine someone could just design a dial with a centrifugal clutch that if spun beyond a certain speed clutches out permanently and locks the dial shaft. My limited understanding of anti-theft mechanisms in safes is they are generally destructive, making it impossible for anyone to open the safe once activated.
With traditional safe combination locks, it's kinda normal for them to be spun fairly fast.
Often to enter the first digit you often have to turn the wheel four full revolutions, the second digit three full revolutions and so on. So users will be trying to spin it pretty fast under normal operation.
Of course there are other solutions to autodialers. For example, making sure burglers can't spend 3 days with the safe waiting for the autodialer to run.
Not the hallmark of a resilient design.
If you are interested in safe cracking there are training tools available, at least for the consumer-style S&G locks.
https://www.sparrowslockpicks.ca/product_p/sdial.htm
(Sparrows makes good stuff, but note how the .com website doesn't list where they are actually located. The .ca is out and proud about their real address.)
They have machines that try every combination. (For example: https://blog.enbewe.de/2023/01/26/opening-a-safe-the-diy-way... )
If you know how many digits and the Left-Right pattern, wouldn’t this be the best way to do this, assuming you have a week to run it?
Came here to say this! What a great device.
Cracker: "So I brute forced your safe"
Customer: "I asked you not to damage it!"
Cracker: "No damage. The combo is 27, 32, 14"
If you're trying to find Figure 2, click on Figure 1 (the photo) and use the right-arrow nav to advance to the 2nd photo.
Ah. Yes. Thank you.
Even if I'm not familiar with a topic there's something deeply satisfying about reading (watching, listening to) accounts of people who are good at their jobs doing intricate or technical work.
Has anyone come across safe autodialers that don't just make use of bruteforce?
Regarding electronic safe locks, I found the following videos really fascinating
* https://www.youtube.com/watch?v=lXFpCV646E0 - Side channel attacks on high security electronic safe locks
* https://www.youtube.com/watch?v=viU8Qs1Sccg - No Mas How Side Channel Flaw Opens ATM Pharmacies and Gov to Attack
I have not one but two safes I've inherited which I ought to get opened. My thinking is that both safes would not be empty, as you can store as much emptiness as you like in a single safe.
I should figure out where to begin, do I bring the safes to the locksmiths, how are the safes disposed of, et al? It should be interesting.
If the safes are portable bringing it to a locksmith is probably the cheapest option.
You could also find how much they weigh, and how much they should weigh, and if that's the same leave them for someone you don't like.
I was surprised to read that they filled their hole with old carbide drill bit tips and J-B Weld (a two-part epoxy). I was expecting it to be welded closed.
Likely stronger than welding against drilling. Weld bead is generally pretty easy to drill through. Carbide drill bits you’d need diamond to cut through. Sure you could cut through the JB weld, but you’ll obliterate your drill bits as soon as you hit the carbide.
Carbide junk in a hole will not only shatter weak drill bits but also deflect the stronger bits sideways, likely snapping them. Many security devices insert carbide debris, usually ball bearings, as protection over areas likely to be drilled.
JB Weld is a run of the mill 2-part organic epoxy, heating it up to 250F is plenty more than enough to dig it out with a shanghai-grade screwdriver from Harbor Freight.
You sure about that? J-B Weld claims its resistant to a constant temperature of 500F, and 10 mins of 600F. With the heatsinking of the steel body nearby, it'd be quite difficult to melt out the epoxy. Not impossible, mind you, but... this isn't intended to be a bulletproof fix, I assume. Why would a would-be thief even think there's epoxy there in the first place?
The hubris around here. Yes, I’m sure about that.
You are a person who is easily manipulated by marketing, and clearly has zero practical experience in this field. I do. There are no epoxys that are good to 500F. None of them. See username, Buildsjets. The epoxy resins that we build jets out of are cured in an autoclave under high pressure, and at best they are good to 350F, and they are absolutely the highest performing epoxy resins you can buy from the likes of Hexcel, Toray, and other industrial companies that do not distribute though Home Depot. To go higher than 350 you need to go to more exotic and toxic resin systems like Bismaelemide, and we don’t like to do that because they are ITAR restricted, so we could not tell our foreign customers how to repair their aircraft when they broke. Dispose-a-plane.
If JB weld were actually good to 500F, we would be building aircraft parts out of it. But, if it were actually good to 500F, it would be ITAR controlled and Bubbas would not be able to buy it at Home Depot.
To your comment about difficulty of removal, JB weld does not melt. No epoxys melt. They are thermosets, not a thermoplastics. But it degrades at around 250f to the point where you can pick it apart with a mild steel pick. I know, because I have done it. The heat-sinking effect of the surrounding steel is negligible when compared to a 3,500F MAPP torch flame directly impinging on the epoxy.
Yep, most of them crap out right around 350°F. Many of the circuit board epoxy resins go a little higher, but not much, and I presume they have their own issues for composite layups. They're certainly not structural adhesives.
The highest temperature ordinary structural epoxy adhesive I know of is Lord 310, which claims to be good to 400°F (205°C). No idea if it's any good though, that project went another path so we never opened the tube I bought.
I am intrigued to learn more if you post anywhere (nothing in your profile); this all seems intriguing.
That style of writing. It really goes down easy.
but who's the author?
The Lock-Picking Lawyer shows the modern way to do this.[1] Yes, there is an app for that.
[1] https://www.youtube.com/watch?v=vkk-2QEUvuk
I don't think I've ever encountered such an over-monetized site. Every square mm of space has an ad. Then pop ups will spontaneously cover existing ads. I can't even find the content.
Install a content blocker - uBlock Origin on a browser which does not try to thwart its purposes, i.e. Firefox or similar - and you won't see a single ad or pop-up on that site.
This. I can't remember the last time I noticed an ad of any sort, including on the link here.
UBlock Origin on Firefox mobile cleaned that right up for me.