Slide 1

How Mechanical Safes WorkHow Mechanical Safes Work

AnalogAnalog Hacking In A Digital WorldHacking In A Digital World

By Leonard By Leonard GallionGallion, CISSP, CISSP

Lgallion@yahoo.comLgallion@yahoo.com

Slide 2

Kinds of Safe LocksKinds of Safe Locks

�� Safe and Vault locks are broken down into Safe and Vault locks are broken down into two categories:two categories:

Mechanical: A dial must be turned left & right, in the Mechanical: A dial must be turned left & right, in the correct order and amounts to open the lock.correct order and amounts to open the lock.

Electronic: A small digital processor opens the lock Electronic: A small digital processor opens the lock when the correct code is entered.when the correct code is entered.

�� We are going to look at how common We are going to look at how common mechanical safes operate.mechanical safes operate.

Slide 3

It All Starts With The It All Starts With The CombinationCombination

�� How to dial the typical 3 number How to dial the typical 3 number combination safe:combination safe:–– Turn the wheel LEFT landing on the 1Turn the wheel LEFT landing on the 1stst number number

the fourth time you come around to it.the fourth time you come around to it.–– Turn the wheel RIGHT landing on the 2Turn the wheel RIGHT landing on the 2ndnd

number the third time you come around to it.number the third time you come around to it.–– Turn the wheel LEFT landing on the 3Turn the wheel LEFT landing on the 3rdrd number number

the second time you come to it.the second time you come to it.–– Then turn the wheel RIGHT until the lock Then turn the wheel RIGHT until the lock

opens.opens.

Slide 4

What Does What Does DialingDialing Do?Do?

�� As you dial the various numbers of the As you dial the various numbers of the combination you are actually moving 3 combination you are actually moving 3 wheels (plus a special Drive Cam wheel) wheels (plus a special Drive Cam wheel) inside the lock.inside the lock.

�� Each of the 3 wheels have a single notch Each of the 3 wheels have a single notch cut into them. This notch is called the Gate.cut into them. This notch is called the Gate.

�� Once all of the Gates on the wheels are Once all of the Gates on the wheels are lined up, a bar called the Fence can fall into lined up, a bar called the Fence can fall into these notches, allowing the lock to open.these notches, allowing the lock to open.

�� DialingDialing the combination lines up the Gates the combination lines up the Gates on the wheels underneath the Fence.on the wheels underneath the Fence.

Slide 5

Looking Inside A LockLooking Inside A Lock

Wheels

Lever

Drive Cam

Relocker

Spline Key

Gate

Gate

Fence

Back View

Lever Spring

Slide 6

The Dial And Drive CamThe Dial And Drive Cam

Safe Dial

Drive Cam

Spindle

Drive Pin

The spline key (see

previous page) locks

the drive cam, spindle

and dial together

Slide 7

And The Wheels Go AroundAnd The Wheels Go Around

Drive Pin

The Drive Cam and each of the wheels have a Drive Pin. When the

Drive Cam is rotated by the dial of the safe, eventually it’s Drive Pin

will hit the Fly of the 1st wheel. Then the cam and the 1st wheel will

turn together. When the drive pin of the 1st wheel hits the Fly of the

2nd wheel, then all three (the cam and wheels 1 & 2) move together

This can continue until the cam and all 3 wheels turn together.

Fly

Slide 8

Keep On Spinning…Keep On Spinning…

When you turn the Dial & Cam four turns to the left, the Drive Cam

rotates enough to pick up Wheels 1, 2 and 3. Wheel 3 then gets

turned until the Gate is directly under the Fence by dialing the

first number of the combination.

GateFen

ce

Lever

Slide 9

Keep On Spinning (2)Keep On Spinning (2)

My moving the Dial and Cam three turns to the right, you leave the

3rd Wheel in place and only turn enough for the Cam to move

the 1st and 2nd Wheels. The second Wheel’s Gate is left under the

Fence as the second number of the combination is dialed.

GatesFen

ce

Lever

Slide 10

Keep On Spinning (3)Keep On Spinning (3)

Next, by turning the Dial and Cam two turns to the left, only the 1st

Wheel is moved. The last digit of the combination brings the 1st

Wheel’s Gate under the Fence.

GatesFen

ce

Lever

Slide 11

The Fence Finally FallsThe Fence Finally Falls

Finally by turning the Dial and Cam right one last time, you move

The Cam’s Gate under the Lever and allow the Lever & Fence to fall.

Wheel GatesFen

ce

Lever

Cam Ga

te

Slide 12

Open At Last!Open At Last!

By continuing to turn the dial right, the Fence (and Lever) stuck in

the Gates, pull the Bolt inside the lock’s case so the safe will open.Note: From the back, the cam and wheels appear to turn left as the dial turns right

Lever

Sliding Bolt

Back View