Update-Liberty Safe Electronic Lock Fail

[milktree]

I’m also a fan of the S&G but I have several digital.
So when you change just the keypad, can you use the code programmed on the old one or do you use the new code that came with a new lock?

The security info is not in the keypad, it’s in the part inside the safe.

Otherwise you could open any safe by plugging in your own keypad.

I really don’t understand why keypads go bad; car electronics which are way more complicated last essentially forever.

 

[pastera]

I really don’t understand why keypads go bad; car electronics which are way more complicated last essentially forever.

Money - that's the #1 reason
The keypad is made as cheap as possible but still keep the person happy enough to keep the person happy in a repeat market

Cars are a repeat market with plenty of competition where customers value perceived quality along with price.

Safes are pretty much a one and done for the majority of owners and it's a cost/size value system.

If you want a good lock on your safe buy a good lock to put on your safe - there isn't a viable market for an affordable (meaning cheap) safe with a good lock.

 

[MGnoob]

The security info is not in the keypad, it’s in the part inside the safe.

Otherwise you could open any safe by plugging in your own keypad.

I really don’t understand why keypads go bad; car electronics which are way more complicated last essentially forever.

That’s why I was asking. Would be pretty ridiculous if you could just put a keypad on it and enter your own combo again.

I’m terrible. I don’t even know the code to most of my saves I just do it. I feel and pattern except my day safe. The combo is 0000.

My real safes i have to know because there ain’t no way you drilling those out. They got glass plates and stuff.

 

[57West]

I recieved a reaponse from liberty by email in two days. An email a day for two more days and they shipped out a replacement keypad at no charge. New Keypad arrived last night. Swapped out last night and after waiting for the remaining "timeout" beeping from the broken keypad, i entered my code and everything functioned again. I will be swapping out for a mechanical as suggested. Thanks to everyones responses and suggestions.

 

[drgrant]

I really don’t understand why keypads go bad; car electronics which are way more complicated last essentially forever.

The average post 2013 gun owner in america is a dust collector type. If they open the safe more than like 20 times in a year it might be a miracle or something
happening. So these chinesium vendors engineer the cheapest product to meet that "LCD" level requirement.

 

[GaryO]

I sent off an email to liberty. Hoping to get a free keypad and will be swapping out for a mechanical lock as soon as i get it open. If i have to buy a replacement keypad i will but like most of the other members here i am somewhat of a skinflint and dont wanr to spend money on something i plan on throwing away.

 

[Rob Boudrie]

That’s why I was asking. Would be pretty ridiculous if you could just put a keypad on it and enter your own combo again.

I’m terrible. I don’t even know the code to most of my saves I just do it. I feel and pattern except my day safe. The combo is 0000.

My real safes i have to know because there ain’t no way you drilling those out. They got glass plates and stuff.

No, but you can put a Taylor Security Phoenix in place of the keypad and it will figure out the combo in about 15 minutes, the $$$$ and not sold to non-government buyers GSA approved locks like the Kama Mas X-## series and S&G 2740B being notable exceptions.

 

[Kevin_NH]

No, but you can put a Taylor Security Phoenix in place of the keypad and it will figure out the combo in about 15 minutes.,

Neat, too bad it's $3500. How long before somebody buys one Phoenix, sniffs the electronic signals, and writes an emulator for the flipper zero?

I do think it's BS that Lagard, AmSec, etc failed to take this class of attack into consideration in the design phase; it would've cost them about fifty cents to add a couple of additional capacitors inside the main locking mechanism so as to keep the Phoenix from bypassing the escalating-delay-on-failed-combo feature.

 

[Rob Boudrie]

Neat, too bad it's $3500. How long before somebody buys one Phoenix, sniffs the electronic signals, and writes an emulator for the flipper zero?

I do think it's BS that Lagard, AmSec, etc failed to take this class of attack into consideration in the design phase; it would've cost them about fifty cents to add a couple of additional capacitors inside the main locking mechanism so as to keep the Phoenix from bypassing the escalating-delay-on-failed-combo feature.

There are other units that do the same thing but not across as many models, and don't get into stuff like avoiding the audit trail on locks with that feature. The phonex comes in two models - Orange and Black. The later has secret squirrel features and sold only to LE.

There is no need to reverse engineer the Phoneix - the cat is out of the bag now that this in band data leakage defect is known. It's like tricky Day 1 Windows bugs - some are very very difficult to discover (like the timing based attack based on pre-branch predictive analysis), and the real security breech is not the code for the attack but the knowledge that the flaw exists and what it is becoming common knowledge.

The concept is not unique - there is also the Lockmasters unit - same idea but less capable. The Little Black Box – A Reset Tool for Electronic Safe Locks
I wonder if the "reset but not display" on the Lockmasters unit is due to some limitation in the technique, or a way to prevent use of that unit to effect entry without leaving a trace.

I'm not sure it's a matter of defeating the retry delay, but rather variations in current draw/duration/waveform between valid and invalid presses. But, it would still have been possible to buffer the full combination entered in the lock, electrically disconnect the keypad, then run the combo verification/opening. Does disconnecting the keypad (ie, power) completely on the common safe locks defeat the retry delay feature? If so that is a world class f'up.

Group I lock certification requires undefeatability for at least a certain number of hours (20?) with only equipment the penetrator can carry. It is a shame that UL chooses to overlook the Phoenix (and concept the Phoenix demonstrates) and allows these locks to certified Group I. I also wonder why they didn't get group IR as long as they were at it.

 

[timbo]

While we're on the subject, is there a mechanical lock made for my Tractor Supply Winchester gun safe? I've thought about replacing the electronic lock that came on mine as it's probably just a matter of time before mine takes the big dirt nap. It's going on about 10 years since I've bought it.

 

[Kevin_NH]

While we're on the subject, is there a mechanical lock made for my Tractor Supply Winchester gun safe? I've thought about replacing the electronic lock that came on mine as it's probably just a matter of time before mine takes the big dirt nap. It's going on about 10 years since I've bought it.

The locking mechanism on all but the cheapest of RSC's is pretty standard, and can be replaced by Sargent and Greenleaf with their “MagicModule®” footprint

Winchester safes will generally accept something like a S&G 6730-100 ($125). To confirm fit you'd need to take the inner door liner off.