Fun safe can be opened no pin needed

[bigpick]

www.google.com/amp/s/arstechnica.com/information-technology/2017/12/top-selling-handgun-safe-can-be-remotely-opened-in-seconds-no-pin-needed/%3famp=1

I don’t have one of these but thought it was interesting. Still would be tough considering you’d have to steal it first.

 

[Kevin_NH]

That does look like a fun safe.

Technical writeup here. The faulty "Vaultek VT20i handgun safe" is bluetooth enabled!?!

 

[sbi]

That does look like a fun safe.

Technical writeup here. The faulty "Vaultek VT20i handgun safe" is bluetooth enabled!?!

Right, who new a safe has a BT and why should it have a BT. Even if it does, how can any device simply connect to it.

 

[WanMan99]

Most people are using these to simply comply with safe storage requirements so who cares. However, if you have a teen with a computer I would opt for something a bit more secure....

 

[Rob Boudrie]

Just about every Group I rated electronic safe lock (S&G, LaGard, etc.) other than the very high end GSA rated ones (Kaba-MAX X-xx series; S&G 2740B) can be opened by the Phoenix gadget from Taylor Security. I contact the S&G regional sales manager asking for confirmation or denial, and he was direct in his reply - yes, that tool will open our locks. The problem is info "leakage" (current draw and delay to beep varies depending on the validity of the entered digit).

 

[Kevin_NH]

Just about every Group I rated electronic safe lock...can be opened by the Phoenix gadget from Taylor Security.
The problem is info "leakage" (current draw and delay to beep varies depending on the validity of the entered digit).

So basically a "class break" against Group I electronic locks? Wow.

I really expected better from these; current and timing is the second thing any hacker worth his salt would think of upon first encountering an electronic lock with externally accessible connectors for keypad and/or battery.

 

[Rob Boudrie]

So basically a "class break" against Group I electronic locks? I really expected better, current and timing is the second thing any hacker worth his salt would think of upon first encountering an electronic lock with externally accessible connectors for keypad and/or battery.

The fact that UL allows these locks to keep a "Group I" designation undermines the credibility of that org.

I would go after current & timing first; RFI secondarily; and finally check to see if power removal could reset the "wrong code timeout" clock.

The GSA qualified electronic locks have addressed these problems.

 

[snax]

A big enough magnet located in the right spot can trip those electronic safe solenoids.

 

[Kevin_NH]

A big enough magnet located in the right spot can trip those electronic safe solenoids.

Guess the safe makers are all too cheap to build in a bit of mu-metal?

That's a really big magnet.

 

[tuna]

Most people are using these to simply comply with safe storage requirements so who cares. However, if you have a teen with a computer I would opt for something a bit more secure....

I don’t get it.

If my safe is to meet stupid law requirements, that means I’ve done my job as a parent and can trust my kid. If I need to worry about my teen and his computer, I’ve failed. My kids should be trusted to open the safe if needed, and understand that locks are for their idiot government and idiot friends.

 

[CatSnoutSoup]

Did someone say "Fun safe?"

 

[Love Machine]

If you're not using simplex locks, god help you.

 

[Kevin_NH]

If you're not using simplex locks installed prior to 2010, god help you.

FTFY.

Simplex locks are generally vulnerable to an exhaustive attack, and most older Simplex and Unican locks are vulnerable to the above "magnet defeat"; as part of the 2011 settlement, a free upgrade kit was offered.

 

[Spanz]

the Internet of Things revolution is just starting. there will be THOUSANDS of these sort of hacks coming up until the industry develops a STANDARD for security.

Zigbee has an encrypted protocol, but only about 1/3 of manufacturers bother to use it. Bluetooth has all sorts of flaws.

In five years, the security will be in place, possibly dictated by law. But until then, it is the wild west. Remember that when your doctor tells you he wants to insert a bluetooth pacemaker into your chest!

 

[ProGun]

Please tell me they aren’t using Bluetooth in pacemakers, etc!

 

[Rob Boudrie]

There was a security standard - UL Group I.

Rendered meaningless by UL's lack of reaction to the Phoenix.

 

[Al-Jim19]

In my recent quest for a safe I learned a lot. One of the main things I learned is that most safes won’t protect the contents from EVERYTHING, but they can protect against most or some things. Realistically most of our safes here could be broken into by someone with a lot of tools and a lot of time, but most dirtbags who enter your home won’t have either of those in quantity.

 

[Spanz]

Please tell me they aren’t using Bluetooth in pacemakers, etc!

they ALL have wireless links now. To check battery health, etc. Not sure the comm protocol used. Might be a simple RFID tag communicator...which has zero security.

here is a bluetooth one
https://www.conehealthmedicalgroup....d-pacemaker-provides-flexibility-to-patients/

and insulin pumps too

t:slim X2 Insulin Pump
(launch expected October-December 2016)
What’s new? The t:slim X2 is a new insulin pump nearly identical to the t:slim, with the addition of a new two-way Bluetooth radio and a manufacturing change. Most notably, the X2 Pump will be capable of online software updates, enabling users to add Dexcom G5 integration once it is approved (expected mid-2017).

Note on all these things, they brag about the new bluetooth capability, but do not even bother to mention the security protocols used.

 

[Kevin_NH]

Please tell me they aren’t using Bluetooth in pacemakers, etc!

they ALL have wireless links now. To check battery health, etc. Not sure the comm protocol used. Might be a simple RFID tag communicator...which has zero security.

They've had "wireless" links since at least the 1980s, originally used inductive circuits to get data out and to change programming.

A pacemaker that blindly transmits health statistics on RF (battery level, how often it fires, etc) is pretty low risk, it's accepting commands from a channel that can be accessed remotely at significant distance that should be worrying.

In 2007, Vice President Dick Cheney's cardiologist disabled the wireless functionality of his pacemaker because of just that risk. “It seemed to me to be a bad idea for the vice president to have a device that maybe somebody on a rope line or in the next hotel room or downstairs might be able to get into—hack into,” said the cardiologist, Jonathan Reiner of George Washington University Hospital in Washington, D.C., in a 2014 TV interview

 

[10thSFFD]

I don’t get it.

If my safe is to meet stupid law requirements, that means I’ve done my job as a parent and can trust my kid. If I need to worry about my teen and his computer, I’ve failed. My kids should be trusted to open the safe if needed, and understand that locks are for their idiot government and idiot friends.

Unless you can absolutely trust your teen I would not be so sure. Teenagers are very vulnerable and their emotions can change unexpectedly.

 

[tuna]

I don’t have teens yet, but I was one once. I also had a dozen rifles and shotguns lying against the wall of my room.
I think unsecured storage is the norm outside Mass.
My kids are still young, but constantly pass safe gun handling tests I do. I’ll leave an unloaded gun someplace for them to find it, and see what happens. Always, it is reported to me without them touching it. Sometimes, it’s my trigger locked hunting gun for tomorrow I get told about.
I can trust my 6 and 9 year old pretty well.
As for emotionally disturbed teenagers...I’ll just have to make sure they get plenty of range time around then, and keep a close eye.