That code entry is a separate kind of packet from the “change password” one.Īrmed with an Arduino able to send packets imitating those produced by the keypad, found a critical bug – sending the password change command didn’t actually require the factory code packet to be sent first. Something drew his attention from there – if you want to change the password, the keypad requires you enter the factory code, unique to each safe and supplied in the instruction manual. Bruteforcing wasn’t viable, however, due to rate limitation in the solenoid controller. Then, he wrote some Arduino code to send the same packets manually, which worked wonders. hooked up a logic analyzer to the communication wire, which turned out to be a UART channel, and logged the keypad communication packets - both for password entry and for password change. The solenoid-connected board receives the PIN, verifies it, and then controls the solenoid that unlocks the safe. You can take the keypad board off and access its backside, but the keypad doesn’t make any decisions, it merely sends the digits to a different board embedded behind the safe’s door. On the surface level, this keypad-equipped safe is designed decently when it comes to privilege separation. As with any shiny new tool, he started looking for things to investigate with it, and his gaze fell on a Sentry Safe (produced by Master Lock). Got one of these lovely $5 logic analyzers.

How to get a small sentry safe open