T.ME/DARKNET. ‘This book is sold for information purposes only, Neither the ‘author nor the publisher will It held comantable for the use or misuse ofthe information cutie in tis bl ‘TECHNIQUES OF SAFECRACKING ©1900 by Wayne tk Yeager Al rights reserved. No part ofthis book may be reproduced oF “stored in ay form whatsoever witht the par writen consent ‘ofthe publisher. Reviews may quote brit passages without the writen consent of the publisher a ons proper eed i given Published by Loompanics Unite PO. tx 1107 Port Townsend, WA 95968 Loompanies Unlimited isa dvslon of Loompanics Enterpess Ine, Cover illustrations by Kevin Martin, ISBN 1.55950.052.2 Library of Congress Catalog Card Number 90-063304 ‘0. Contents Introduction a Sale Mecha a Combinatio 5 ‘Manipulation Techniques at Safe Dring Methods 6 Punching and Peeling 5 “Torels, Hle oon) plosives see Miscellaneous Methods of Safe Eniy «y.sses000008 Sale Deposit Hoes 67 Deterrence and Prevention +. aT.ME/DARKNET_} Introduction 4 Appendix A — Manufacturer's "Tey Out Combinations src... aL Appendix B — Suppliers... 85 Selected Bibliography a Introduction A constant technological war exists between safe- makers and safecrackers. To construct a safe of vault strong enough to keep burglars out, but fanctional enough to Tet authorized personnel in, has been the ‘ultimate goal for the manufacturers of safes and vaults Since their invention, The race towards this ideal sae has fesed frustration for those on both sides ofthe law in their attempls Lo defeat the technology of the other, And ‘while neither side may ever ultimately triumph, they both vin (cr share of ate, arsenal is his ability (o attack the burglar on one or more Tronts: denying initial access to the safe, strengthening the safe ise, alarming the safe, ete. But the burglar Is not completely defenseless either, for he knows a safe ean never really be male absolutely foolproot. Why? BecauseT.ME/DARKNET_} 2 TECIINIQUES OP SAPECRACKING 4 locksmith or other authority must always be able to ‘enter a sae in ease the combination tions. In other words, while x safe amount of protection, It can never b tical necessity, indestructible. Another problen that facilitates the safceracker'’s operation i that of obs lescence in sufe technology Hy de Lime an anth-burglary device is designed, patented, manufactured, marketed, and made commercially available, professional safe erackers have been experimenting and working to defeat it The question is no {7a xaely device can be bypassed, Dut rather when the device wild We bypassed When one buys asa, what one fs realy Ie the safe is om the lower end of the price seal, ca only be expected to resist attack for sort Teng of time, and ifthe burgar is using only basie tools and base ‘knowledge, the safe will more than likely do its Job, But as the potential reward inside the safe increases, 30 does ‘the ris and 39, too, mast the protection. Ths verysimpe and obvious maxims often overlooked by homeowners and businessmen. I could not count the number of times ve seen a $200 fire safe holding thousands of dolats it cash, or an 1890 safe expected to withstand 1990 attacks This book lists and explains just about all of the ‘methods that are used by both Ioeismieh and safecracker. (oeopen safes, vaults, and safe dept bones. These tech riques ranye from “Sot” openings, such as combination deduction and maniputation, to “hard openings, sch as ‘the application of nitroglycerine oF C-4, While sine af these techniques may be otsoleve on some of the newer, high-tech safes, many willbe overkill on the older or less sophisticated models. Tve not tied ta Mentify what is Introduction 3 nat Ido note throu: obgolete and what is unnccess ‘echniauels most often ‘athe Xt on what models ‘apple ecracking is rime tat has been with ws and wil Fhe with us For many, many years subserie tote theory that you ean solve a problem ualess the proba i ally ferstood. This book, like my others, is textbook on 6, a ude so that the security and law-enforcement community may more neeurately understand what theyre up agains. I you are a security consultant, use this guide to more accurately recommend equipment for your cients needs. Police and private investigators will Aliscover invaluable information here for eondveting 3 safecracking investigation, And although this book i written for budividuals wil no previous beksmithins ‘cxpericnee, {believe even tke most seasoned safenten will Tin several new safe-entry tricks hereT.ME/DARKNET_} ‘Safe Mechanics and Operation. § 1 Safe Mechanics and Operation Despite the multitude of safes on the market today, they al ling to a basic theory of operation: the protec- tion of contents from outside forces (Such as fire and burglary), while allowing authorized entry via a com binational dial, key, oF keypad. Safes differ from model to ‘model in the way they accomplish this task, but this i, revertheles, the basie premise of each. There are two basic types of safe: fire safes, which are insulated to protect important documents from extreme temper- flues, and money chests, which are specially designed Tor extra security, Lo withstand attacks from determined burglars. Actually, these are overlapping categories, for ‘most fire safes offer some burglary protection, and money chests are protected from smal fires as well Inorderto discuss safes inteligibly, we must make our- selves familiar with the basic terms regarding the6 TECHNIQUES OF SAFECRACKING ‘operation of the typical safe. Figure 1-1 shows a he Diebold bran safe, IL is essentally five ks steel ox wit ay ataclvad dr, The ‘and aise thie, with hardened stee! pla Attached to the box with very strong hinges deadbolt, gure 1 Safe Mechanics and Operation 7 The safe is opened leyiimately by dialing the proper ‘connbinaion on the dia nd turning the ane ce lease the bolt from the safebox; the door is then tre to fen. This i deceptively simple operation, for much tore occurs within the walls of the safe hidden from {1} spine hk 6 orem it ip neste Figure 12 a th or pa mat of ches, raids mt re ere ‘ontT-ME/DARKNET {8 TECHNIQUES OF SAPECRACKING eal device that. “knaves” when the proper eo nation has heen dialed, The wheel yack usally const of three or four wheels (depending on the amount of ‘numbers in the combination sequence, so a 10-20-30 combination will require three wheels) and they are moved about by turning the dial (see Fygure 1-2). The combination dial is attached by the spindle to the drive team. Ifthe dial is turned, the drive pin on the drive cam comes into contact with the fy on the whecl adjacent to and that wheel begins turning also. IFthe combination dial continues to turn, the Ny on the first wheel comos into contact with the fy on the next wheel, and 59 on, ‘until the turning of the combination dal turns all of wheels in the whtel-pack simuleanconsy, Into each of the wheels of the whwel- pack, a deep Hotel {is cut, When the proper combination is dated all of these notches in the wheels are aligned perfeety. Just above ‘the wheel-pack isa device known aga gate and fence. As long as the correct combination has not been dialed, the ‘notches will not all be In perfect alignment, and the gate and fence wll merely rest upon the wheels (see Figure I~ 8). But when the Fight combination is executed, the ‘wheols align accordingly, and both the gate and fence are allowed! 10 fall into the groove formed hy the ‘aligned notches (see Figure 1-4). The lever and fence which were fuarding the bolt are now out of the way, and if we Randle i turned, the bolt iv retracted, and the door ‘opens: If this procedure sooms-a-bit complicated, stdy the diagrams until you understand this completely ‘The lever/bolt mechanism varies slightly from safe to safe. Some are gravity activated as in our example, but ‘they may be fiction or spring-loaded. ‘This i of no eon- sequence, however, for they all at protty much the same, Sufe Mechanics and Operation 9 and the light dierences donot ater the sfeeraker's south ony thing wor non heres the ft thal ving toed fene/bolt mechanisms do way wth the need for outside handle, since the com ination il rtracts the ol (after the combination has at cours) This the type wed almost o- oun sor safe. Figure 13 rhe erect combination hs na bo line the notches thawed yc il et ign, at he ate ad “ew erty et pn th whe10 TECHNIQUES OF SAFECRACKING Fence hae ‘nea nlahes| Who he igh combination ia, th whe im, he gat oneal ny trig nec ‘When one is dealing with safes it helps Lo know all one ‘can about the particular model that is encountered. Underwriters’ Laboratories has facilitated this procedire by labeling most safes with a universal code, On Uke safe body, a small metal tag (see Pure 1-5) wil be displayed telling the amount of protection one may expect from fre for burglary. In other words, a burglar in the know ean Sie Mecuics and Operation 11 dg hy the Ue ag jus how the safes protected, and ‘Whit tcetnigues will or will not work. Handy, huh? itwough the fople A UL ave coed thi information Sluhtly, every saferacker worth his salt knows exactly ‘what each kdenlying code means. gure 1-08 a chart Ute various coder current i use Fuori sat ifs pg sl ee ay bi oni le sitet here tearing est Fam byte eeeT.ME/DARKNET_AB 12 TECHNIQUES OF SAFECRACKING Safe Mechanics and Operation 18 Any other specifies of safe operation will be diseussed eee |S |S |S more thoroughly whenever that information i needed to clarify a certain procedure. You have now, however, al the information you need to understand the next chapter. Figure 16 ‘Thi chat eplains th meaning of various Underritrs! “oratories aufero i wsT-ME/DARKNET Combination Deduction 18 2 Combination Deduction ‘Since the most convenient way to open a safe is to dial out the proper combination, this chapter deals with how fone may go about procuring it Besides the obvious brute facts, such as beating i out of someone who knows it, or threatening to do 20, there are several treks burglars {se to come by this elusive combination. One ofthe most Successful ways, manipulation, requires in-depth explan- ‘ion, so Une next chapter is devoted exclusively to i ‘Another method ls by using ty-out combinations, These Combinations are set on the safes by te manufacturers, find are intended Lo be changed by the nese owners, iithough many people dot knew chit or are too Lan bother: Some examples of try-out combinations are i Appendix A, and these will een a surprising number of ‘safes in use today. ‘A locksmith I know was called upon to open a safe whose owner had just died The locksmith walked aroundT-ME/DARKNET 16 TECHNIQUES OF SAPECRACKING the room for a few minutes before sitting doven in front of the safe. To the family’s amsacment, the locksmit flialed ont the combination and pened te safe i te seconds flat, Magic? No, my locksmith friend simply realized Uhat_ most people have terrible memories for rmumbers, and almost invariably write the combination own somewhere near the safe, He had found it written fn the wall by a window, two feet away. Tve found com biations rtten on | ‘walls, pieture frames, telephones, atl even on the sale sei This tendency is so universal, burglars almost alway allot few mime to eo hunting before king combina {nthe life. For example, Ive 5s October 12, 1931 use 10-12-31 for the combination to Ins safe. ve aly known pple to use anniversary dates, parts of Social Security’ numbers, Armed Forces se ‘numbers, and birthdates of children and spouses, Next to ‘writing the combination down, this the Favorite method of combination retrieval, and you ean bet professional Durglars are well aware of it. Many safecrackers il ‘undoubtedly do research to uncover uch numbers prior tos house-bee iques are impossibie, Une bungar may then try to determine wheter or nol Ue owner hus lle the safe on what is known as “day-lock” Day-Jock means that the safe door was closed, and the combination dial ‘was turned slightly. This serambles only the last wheel of tue combination, and the combination dial has only to be turned back to the original number forthe safe (0 opes again. Business owners like this, sinee unauthoriac Combination Deduction 17 employees cannot open the safe, yet the entire combin- Stn doesnot have tobe redid everytime the safe si Many buses forget abou is eompetey {thd casionally eave thei safe on da-lock even at night, and ths lords yet another opportunity for an hlerprsing tie, Day fol exploited by tring the ial to the let as far a goes before any resistance fs hs resistance & due €0 te deve pin on the wheel ‘humnber, I the safe deed on day-oek, the handle wi five atthe proper combination number, and the safe will Sen tf, however, the tial i tsened to the right until Fesistance fs felt agai, the safe combination must have ‘Deen completly serambled after closing, Surelanc certains is plac im combination cin fly here eee peso ‘eitane pase fg tags ik or coe range ‘eae tan one alempin, tong instars ors tle saetec combination tiled Yin assumes of Ca tht one any taf in om esac oe cannot der he exact com vant maybe eae what nerd each vee tas owein ne psi combinant stu rere carr Une a camers eh set segue he combination dag on Tim fo incr fewing the camera ofeoure Sings, a oe Ist deve pretext or planing an rece Ie Te tied Seam suvelance ne rang were one tat sae the entre combination aed, but war jt east nb apps sa asT.ME/DARKNET_} 18 TECHNIQUES OF SAFECRACKING ‘or businesses where the safe or vault i kept open during Dusiness hours, and the number on the dial ke plainly visible. If the number on the dial remains the same Tong period, tis more than likely combination sequence. One nay ask what good one ‘number ofa three number combination is, bt with just fone number, a burglar can trial-and-error the other two Jn just one weekend. This trial-and-error trile was Accomplished on a six combination vault In the film Honor Among Thieves, which was supposedly based on & true story. In addition, ifone knows the make ofthe safe, fone can plug that number Into the try.out combination {ormula Used by the manufacturer (see Appendix A). Another trick to learn a safes combination is to frst Joel the combination dial off of the safe or ollcrwine mess it up, then plant a bug in the room the safe isi, toilcen inom the conversation wii the locksmith Fixes ‘Chances are, the combination will be discussed during his wisi, Before moving ahead to manipulation, there are a ‘couple more ways of combination deduetion to discuss ‘These methods ure rather fantasti, and I lend little credence to their success, but they are included here for the sake of completeness, One doubtful technique Is Ue tape-recorder trick Supposedly, one ean place a dis: ulsed tape recorder in someones not-Loo-quiet sae, and Upon retrieval, the tape speed is slowed and the volurne amplified to produce a series of “elie” These clicks are then counted to deduce the combination. Assuming a tape recorder ean eapture the precise number of clicks, hhow does one know from where the safeopener began Glaling, oF where the combination dial changed dirce- tion? There are simply too many variables for ta to be Combination Datuction 19 fi eliable technique, And ara ous for hyinotsa Resmng ne ean hypnotize the ‘nape tn bark preset that he kas the omit, nd ta he lt enc era im forte genorally ped by professional pee “us that no on will donde hypons something they stoutd never do wile conscous Te lst two ticks re Intersting and fine for mystery newest movie, hf sincerey dou Une lfetivanessin reali-ME ARKNET_ABC Manipulation Toskniques 21 3 Manipulation Techniques “The art of manipulation has been around at least 100 years, for manipulaion:proof locks were manufactured 2s early as 1910, This method of safe entry, however, was, fand has always been known only to afew highly-silled Tocksmiths. Manipulation today is based largely on the techniques of Harry C. Miller, who developed a scientific ‘approach to manipulation inthe 1940. Manipulation is the safe opening trick you've seen ‘countless times on television. Our hero sticks an ear to the safe, turns the dial a few times, and voila. the safe is open’ Well of course, t's not that easy in real life (Cauank goodness), but It ls indeed possible. Locksmiths {ust practice manipulation a great deal to master it, and 50 too musta safecracker if he wishes to apply it success. fully. I you wish to follow along with this chapter, and fully understand iT suigtest you get an old safe, oF per- zaps & mounted combination lock mechanism.