00:00:00.042-->00:00:04.708 >>Hello everyone, um thank you very much for coming to this talk. Uh, we're going to attempt 00:00:04.708-->00:00:09.708 to crack this safe in the next 45 minutes. We could have made this safe cracker faster but 00:00:09.708-->00:00:14.125 then how would we get a 45 minute time slot [laughter] so we're going to do the best we 00:00:14.125-->00:00:18.417 can. These guys are still setting up as you can see it's kind of uh a big set up but um, 00:00:18.417-->00:00:22.542 we're going to go through the technical aspects of how we built it. I am Nathan, this is 00:00:22.542-->00:00:24.542 Joel and that's Rob. [laughter] So a little background, um if you uh may or may not know a 00:00:24.542-->00:00:29.833 company called SparkFun Electronics so back 15 years ago in 2002, I started SparkFun 00:00:29.833-->00:00:35.875 Electronics in a little room, hopefully you can see it uh this was in student housing and there 00:00:35.875-->00:00:40.875 was like 15 of us in this house and I started shipping little electronics out of my bedroom 00:00:44.125-->00:00:50.333 freaking out my roommates. Uh and um, here we are today pretty advanced website. We have about 00:00:50.333-->00:00:57.208 2-->000 products that we sell, uh about 500 of those are open source hardware. So today um, 00:00:57.208-->00:01:01.958 what SparkFun does is we design little development boards and technology and then we build 00:01:01.958-->00:01:06.167 projects using that technology to demonstrate it and inspire other folks. So this is an 00:01:06.167-->00:01:11.583 example of uh a light R with an Arduino shield and uh 7 uh couple 7 segment displays and 00:01:11.583-->00:01:17.583 you can see um if you have distance >>[audience babble] Slide! [indiscernible] Slide! >> 00:01:17.583-->00:01:22.583 No slides? >>You don't have slides you'll have to do an interpretive dance >>[laughs] 00:01:25.292-->00:01:30.292 Going to do an interpretive dance for all the slides. [off-mic inaudible chatter] 00:01:40.250-->00:01:45.250 [laugh] [faint squeaking] >>Tell us a story! >>Another shot! [laughter] >>He can't move, he 00:02:03.833-->00:02:10.125 can't move! [laughter] [squeaking continues] So I don't know if you can hear that noise, 00:02:10.125-->00:02:15.125 but I still have nightmares with that noise. We've been working on this a lot uh but I'll wave 00:02:17.625-->00:02:23.458 my hands. So uh what the robot is doing as you can see um, if you can see there's a dial on 00:02:23.458-->00:02:30.292 the front and there's uh a servo pulling on the handle. So while um we set up here um we attach 00:02:30.292-->00:02:35.000 the robot using magnets so the idea is that uh it's- there's no glue, there's no drilling, 00:02:35.000-->00:02:40.000 there's nothing to make it so that um you would if we did it right [applause] okay. We got 00:02:46.000-->00:02:50.250 slides, um I don't know if we're going to have this video feed up but um hopefully they'll work on 00:02:50.250-->00:02:53.458 that. In the meantime I'm going to stream through this thing. I'm Nathan, that's Joel, that's 00:02:53.458-->00:02:58.125 Rob. Uh this is what SparkFun looked like 15 years ago, student housing uh 15 people in 00:02:58.125-->00:03:02.000 this house uh this is what our website looks like, cool. Um this is [laugh] we build 00:03:02.000-->00:03:06.708 technology, this is a light R with a couple 7 segments displays and you have distance 00:03:06.708-->00:03:11.375 out to about 40 feet right? So if you take multiple measurements um per second than 00:03:11.375-->00:03:16.250 you can turn that into speed. So this is a speed trap, you run at the wall and see how fast you 00:03:16.250-->00:03:20.083 can get that number up to. [laughter] and in the lower right hand corner you can see 00:03:20.083-->00:03:25.625 the handprint um we're lucky no one's cracked the drywall yet. Um this is uh another thing I 00:03:25.625-->00:03:30.500 built a speedbag detectors so you hit the speedbag and vibrations from the platform 00:03:30.500-->00:03:35.042 using an accelerometer you can count the number of speedbag hits. That helped me train for 00:03:35.042-->00:03:39.333 an amateur boxing match. I am undefeated 1 and 0 amateur boxer. [applause] A Beehive we 00:03:39.333-->00:03:43.083 hacked. So we took a bathroom scale, hacked it, attached it to wifi and you can see the weight 00:03:43.083-->00:03:47.792 of the beehive change overtime. It's actually sawtooth cause every morning 5 pounds of bees 00:03:47.792-->00:03:52.792 leave the hive and they come back during the day and then they leave again. Kinda 00:03:56.458-->00:04:01.042 interesting. Um power-power wheels, my wife and I. Who is my beautiful wife like to hack 00:04:01.042-->00:04:06.667 things. So we hacked power wheels um up to about 48 volts uh a bunch of sensors. Uh laser 00:04:06.667-->00:04:10.792 distance sensors uh it's an autonomous power wheels that does about 18 miles an hour. 00:04:13.583-->00:04:19.000 [laughter] This is all to say I'm a hardware geek. I don't know software. My wife had to 00:04:19.000-->00:04:24.000 explain this cartoon to me. [laughter] I'm sorry. Then she asked me for a sandwich. Okay 00:04:28.083-->00:04:33.167 [laughter] You're all here today to figure out how to make these look like this. Now the story 00:04:33.167-->00:04:39.708 behind this thing is uh, I'm really into puzzles and my wife found a safe on craigslist for 00:04:39.708-->00:04:45.250 20 dollars. It was so cheap because the owner of that safe did not have the combination, 00:04:45.250-->00:04:49.500 they had lost it. You can hire a locksmith to open it up for you but the owner was just like oh 00:04:49.500-->00:04:52.458 forget it, I'm just going to kick it to craigslist so my wife bought it and gave it to me for 00:04:52.458-->00:04:57.458 Christmas and I said hey we got to build robot to open this thing up. [laughter] and we, 00:05:00.542-->00:05:07.083 okay we're doing good. Alright, um and then uh we build it, uh we live streamed it on you uh 00:05:07.083-->00:05:11.792 youtube which was the second dumbest thing I've dom- I've done in my life. The dumbest 00:05:11.792-->00:05:18.625 thing I've done in my life is demoed Def Con. [laughter] So we've opened this safe in 41 00:05:18.625-->00:05:24.167 minutes. Okay now this safe is really cool um but I'm going to give you a little animation 00:05:24.167-->00:05:29.167 about how safe combination locks work. A little background there we go. Okay, there is 3 disks. 00:05:33.500-->00:05:38.500 The A disk, B disk and C disk. hmmm, hmmm, [humming under breath] there we go, lovely 00:05:53.417-->00:05:58.625 alright. So the C disk is that blue one that's got the notches in it, the green disk is disk B, 00:05:58.625-->00:06:03.875 disk A now the first thing you need to know is disk C is directly attached to the dial so 00:06:03.875-->00:06:09.667 when you twist that dial you're only turning disk C. Now after awhile disk C has these dots on 00:06:09.667-->00:06:15.542 it and those dots will interfere with the dots on disk B. And so that's how you turn disk B. 00:06:15.542-->00:06:21.667 Continuing to turn, you turn disk A. You line up those slots and you can unlock the safe. K? 00:06:21.667-->00:06:26.667 Have you go back, do do do do do. That's going to be important later on. Starting on the top 00:06:29.083-->00:06:33.250 lefthand corner, this thing runs on an Arduino. It's not a raspberry pie, it's not some 00:06:33.250-->00:06:36.958 heavy lifting single board computer. It's just an 8 bit micro controller, which means we 00:06:36.958-->00:06:42.375 can make this thing portable. Um next up we've got 3 magnets that help it stick to the safe. Power 00:06:42.375-->00:06:47.875 supply, that is just an AT power supply uh common 12 volts 5 volts, you find it fairly often 00:06:47.875-->00:06:52.417 with external hard drives. Really cheap, um it provides us with a couple amps on a 12 volt 00:06:52.417-->00:06:57.583 5 volt rails. Uh next is the erector set that's uh from a company called Actobotics. That 00:06:57.583-->00:07:02.708 makes it really handy so that we can reconfigure the robot as we need it. Um for instance, if you 00:07:02.708-->00:07:05.542 had the dial in a different place or the handle in a different place. You can 00:07:05.542-->00:07:12.000 rejigger it real quickly to make those two things fit. Um the motor has 8,400 ticks. What that 00:07:12.000-->00:07:16.500 means is that it's a DC motor that spins really fast. But on the back end of it, it's got an 00:07:16.500-->00:07:21.708 encoder. So it's a magnet that passes uh uh a hall effect sensor. That motor that turns it 00:07:21.708-->00:07:26.167 like I dunno 10-->000 RPM. On the front of that, there's a gearhead that gears it down to 00:07:26.167-->00:07:31.167 uh, uh a single rotation so 8,400 turns of the magnet equal one rotation of the head. So we 00:07:33.792-->00:07:38.792 take 100 digit dial and we split it into 8,400 individual segments. Okay? So, that's the 00:07:41.583-->00:07:46.083 motor. Next we have the servo with feedback, that's the servo that pulls on the handle and 00:07:46.083-->00:07:51.000 tells us when the handle is pulled down and let's see. Next step of building this thing, is 00:07:51.000-->00:07:57.208 we had the 3D model of the safe. Uh from that we were able to print uh 3D print coupler. So 00:07:57.208-->00:08:01.667 that coupler fits on the dial really nicely and tightly. You can see the little uh flag 00:08:01.667-->00:08:06.500 sticking off of it. We use that and a photogate. So there's a photogate uh attached to the 00:08:06.500-->00:08:13.042 arduino that looks for that flag and sees when it breaks the beam. When it breaks the beam it 00:08:13.042-->00:08:18.458 knows that it is. Well it knows the flag is there and it asks the human, "hey what number am I 00:08:18.458-->00:08:22.958 at?" and the human types in, "62" and it says "aww okay I now know where 62 is." It can 00:08:22.958-->00:08:28.875 immediately go to zero. So it's a way that we can kinda calibrate hone the dial. This is 00:08:28.875-->00:08:34.875 what the handle puller looks like so we have a spring that pulls back uh pulls the handle 00:08:34.875-->00:08:41.167 back up. We have a servo with this cool nautilus gear. That allows us to maintain constant 00:08:41.167-->00:08:45.250 torque while pulling on the handle and then we have some very fancy string that you can 00:08:45.250-->00:08:49.667 get from anywhere that will attach the handle to the servo head. And again we got uh analog 00:08:49.667-->00:08:54.083 feedback on that servo. Um the way that you do that is you take any off the shelf servo, you 00:08:54.083-->00:08:58.167 open in up and there's uh uh potentiometer in there, you solder it to the center point of 00:08:58.167-->00:09:03.625 that potentiometer and you can see, you can uh analog voltage is in relation to where the head 00:09:03.625-->00:09:09.167 is. So now we can say okay the head is at 45 degrees or it's at 90 degrees and from that we can 00:09:09.167-->00:09:14.167 tell when the handle is open. This is what the electronics look like. Um top left corner, 00:09:17.250-->00:09:21.500 motor driver to 15 amp motor driver because this motor pulls a couple amps so it's overrated 00:09:21.500-->00:09:26.500 but that's good because we don't want it to get hot. Um underneath we've got an arduino 00:09:26.500-->00:09:30.875 right? It's just a red board, that's the board that SparkFun makes um we've got a buzzer. 00:09:30.875-->00:09:37.667 Piezo buzzer so it can beep and let us know when the safe is open. Um there's, we initially 00:09:37.667-->00:09:42.750 designed a current sensor into the board thinking that we would look at how much the current 00:09:42.750-->00:09:49.458 motor was using, to tell when it started the stall. We found out that it's actually a lot faster 00:09:49.458-->00:09:53.417 to see the encoder stop so when we tell the motor to do something, if we ever see the 00:09:53.417-->00:09:58.958 encoder ever stop turning it's about 100 milliseconds before we see the current increase so we 00:09:58.958-->00:10:04.083 don't actually use the current sensor, we just look at the encoder. Next is that 12 volt 00:10:04.083-->00:10:10.292 external hard drive power supply. Uh next we have the motor control and feedback. So 00:10:10.292-->00:10:12.292 the motors are pretty simple right? You give is DC power in one direction and the motor 00:10:12.292-->00:10:16.125 starts turning uh in this case it's got a couple more pins because it's giving us feedback 00:10:16.125-->00:10:22.375 to that uh, gives us access to that encoder so we can read the encoder, we can power the motor 00:10:22.375-->00:10:25.417 and we can switch the directions on the motor and then we can turn the dial in different 00:10:25.417-->00:10:30.417 directions. Uh next up we've got a display, and I'm just going to check it out real quick. So 00:10:35.458-->00:10:40.458 currently we're testing 18, 16, 93 um so that's a display 7 segment with a bunch of segments 00:10:43.042-->00:10:48.042 um the interface to that display is 3 wire so it's serial just going uh to the display. Um next 00:10:50.667-->00:10:54.708 is the, that home photogate so it's a really simple photointerrupter, you power it 00:10:54.708-->00:11:01.208 and um whenever it breaks the beam you can see that pin go low. So we can tell the head to 00:11:01.208-->00:11:06.792 turn until we see that beam broken and we know the flag is there. Last uh, next up we have 00:11:06.792-->00:11:11.042 a go button. So we wanted to make this thing as autonomous as possible. You'll see a red 00:11:11.042-->00:11:17.250 button the the robot so we hear it, we hit the red button and it starts doing it's thing. Next 00:11:17.250-->00:11:21.208 up, is the servo and feedback, again that's where we attached the servo to find out where the 00:11:21.208-->00:11:26.208 handles at. Now, this is uh we had to connect all these things together. Um se this is a pretty 00:11:29.458-->00:11:33.958 simple schematic. There's not a whole lot going on it's just a whole series of connectors and 00:11:33.958-->00:11:37.458 making sure that the servo and buttons and everything are connected to the right spot on 00:11:37.458-->00:11:41.625 the arduino. Could have done this with wires, we could have just inserted things but it's 00:11:41.625-->00:11:45.583 not going to make it very portable and not going to make it very reliable. So uh, this is 00:11:45.583-->00:11:51.083 the schematic you can see in the bottom center is that gear logo. Um I don't know how many people 00:11:51.083-->00:11:55.875 are familiar with open source hardware. This is open, yeah yeah awesome OSHWA uh the open 00:11:55.875-->00:12:00.875 source hardware association um uh this you can take this design, you can modify it, you 00:12:00.875-->00:12:04.958 can copy it, you can sell it, you can do whatever the heck you want with it. Um and that's the 00:12:04.958-->00:12:09.250 same for all SparkFun products. We believe that everything should be open source and you 00:12:09.250-->00:12:13.167 know, if you can learn from me then I can learn from you and we can build upon each other's work 00:12:13.167-->00:12:18.292 so this is all open source, this is the schematic. Uh we turn it into a printed circuit board so 00:12:18.292-->00:12:22.083 uh this is a really simple printed circuit board. It's two sided but the traces are huge 00:12:22.083-->00:12:26.333 and it's all through hole soldering, and it's- it's really pretty straight forward. So 00:12:26.333-->00:12:31.333 that's the PCP. Now let's talk a little bit about the keys and how we will hopefully get this 00:12:33.792-->00:12:40.667 thing open quickly. Um there is about a million combinations on a given safe. And the reason 00:12:40.667-->00:12:44.625 that is is you've got to dial 0 to 99. So it's 100 times 100 times 100. That's a million. If 00:12:44.625-->00:12:48.750 a human walks up to a safe, think about it, you gotta clear the dial right? And then you 00:12:48.750-->00:12:52.000 gotta dial in the first one and you gotta dial the second one and the third one and pull on 00:12:52.000-->00:12:56.958 the handle. Takes about 10 seconds for a human to do that. Um so worst case, if we were to 00:12:56.958-->00:13:03.625 brute force this, it would take 115 days of non stop trying every 10 second. So the first 00:13:03.625-->00:13:08.917 exploit that came about was how we could uh reduce the overall key set. I don't know if you 00:13:08.917-->00:13:13.917 noticed but we are only testing 93 over, over, and over again. Why is that? That's because uh 00:13:17.333-->00:13:21.875 oh let me take 1 step back um. So 100 times 100, we can actually reduce that a little 00:13:21.875-->00:13:28.542 bit. They design the safes so that if the digit is say 56. Humans are really bad at doing 00:13:28.542-->00:13:35.000 fine stuff. So it's hard to get 56 just right so they design the safes so that 57 and 55 will 00:13:35.000-->00:13:40.375 work so it's a 3 digit window so we're not actually trying all 100 we just have to hit that 00:13:40.375-->00:13:47.042 middle digit. So we're doing 33 times 33 times 33, it's still 4 days. It's mind numbingly slow. 00:13:47.042-->00:13:52.875 So this is what the inside of the safe looks like. There are 3 dials and the 2 white ones and a 00:13:52.875-->00:13:57.875 black one, if you see that black one, it's got a bunch of uh indents on it and that's what we 00:13:57.875-->00:14:02.875 call those indentations. Those are there uh yeah so there are 11 small indents and then 00:14:06.833-->00:14:12.417 there's one large indent and that's the solutions slot. So we know that one of those 12 00:14:12.417-->00:14:18.417 indents has to be the solutions slot. So we don't have to try all 33 digits on the last disk, 00:14:18.417-->00:14:23.417 we only need to try um 12 on disk C that's the black disk. So now we've reduced the solutions 00:14:25.542-->00:14:30.542 set 33 times 33 times 12 still at 1 and a half days. The real kicker came when um I took apart 00:14:32.833-->00:14:37.833 the safe and found out that the solution indent on this older model safe is slightly different 00:14:40.792-->00:14:45.792 in size okay? So that small indent is about ten thousandths of an inch smaller than the 00:14:49.042-->00:14:54.042 other 11 shallow indent. So from the outside of the safe, if we have a sensitive enough motor we 00:14:56.292-->00:15:01.292 can measure those indents and find the skinniest indent. So if we can do that then we can take 00:15:04.083-->00:15:11.042 disk C down to 1. We have the solution number within about 20 seconds. So if disk C has the 00:15:11.042-->00:15:16.042 skinny indent. We take 33 times 33 times 1. We're now down to about 3 hour test time. So the 00:15:18.375-->00:15:22.833 first thing I want to show you, well no, I got to show you all sorts of stuff but this is the 00:15:22.833-->00:15:28.542 model safe we had back in Boulder uh that we got off craigslist. Uh and it's really 00:15:28.542-->00:15:32.750 cool and that's the one we cracked open, it worked well. The problem is we wanted to do 00:15:32.750-->00:15:37.958 this demo at def con. This safe is about 10 years old and you can no longer get this model 00:15:37.958-->00:15:43.000 safe. Awesome, so we looked around and said "well what is the model of safe we can buy 00:15:43.000-->00:15:49.167 at." What's that? [inaudible] We're good. Okay. What's the model safe we can buy here in 00:15:49.167-->00:15:54.667 Vegas, we bought this safe at Home Depot. This is the model you can get readily available in 00:15:54.667-->00:15:59.667 Vegas. Now something should jump out at your about this picture. What is it? There's keys, where 00:16:02.667-->00:16:08.375 the hell did those come from? Those weren't on the original model safe. So when we've found, 00:16:08.375-->00:16:13.375 we saw the model safe in Vegas. We're like okay cool let's get the same model in Boulder I buy 00:16:13.375-->00:16:17.208 this same model in Boulder, where we're from and I take it up to Rob's office and I'm like 00:16:17.208-->00:16:22.208 hey we got this safe and I'm like "Oh my God, wh-wha-what is, there's keys now? This isn't 00:16:22.208-->00:16:27.375 gonna work." I know the Def Con audience is really understanding about demos but we can't just 00:16:27.375-->00:16:32.708 show up with a robot that doesn't work. How are we going to open this lock? Well anybody 00:16:32.708-->00:16:37.708 who knows tubular locks right? Um this is the first time in my life where I used a big pen. 00:16:40.042-->00:16:46.542 [laughter] to open a lock. It works really, really well. [laughter] It's incredible so uh 00:16:46.542-->00:16:52.208 sure enough if you find this safe and you need to get it open, build one of these robots 00:16:52.208-->00:16:58.750 and bring a big pen with you, that's all you need. So inside this safe, again we've never 00:16:58.750-->00:17:04.667 opened this safe. We bought it yesterday, um God I hope we get it open. But um, this is what 00:17:04.667-->00:17:09.667 the inside of our safe, same model in Boulder looks like. Ok? Same 12 indents, all plastic now 00:17:12.625-->00:17:18.958 the interesting thing about this disk C is that the solution slot is actually fifty thousandths of 00:17:18.958-->00:17:23.917 an inch larger than all the other indents. That may not sound like a lot but that's 54 00:17:23.917-->00:17:29.333 ticks on the encoder. That's, that's a huge gaping, like i-it's such a sore thumb it 00:17:29.333-->00:17:34.333 sticks out at you. So uh this is how, what it looks like um. How we measure the indents. So the 00:17:38.750-->00:17:44.792 robot will spin the disks to an indent and then it will apply pressure on the handle and rock 00:17:44.792-->00:17:48.833 the wheel back and forth. Now remember the encoder is giving us feedback so we can say "okay 00:17:48.833-->00:17:54.000 the encoder is at 17 and then it went to 312" and then we do the subtraction and say "okay that 00:17:54.000-->00:17:59.000 indent is this many ticks wide." And we do that for each indent. And I think, yup we'll 00:18:03.583-->00:18:08.583 eventually do the solutions slot, measures that. [inaudible noise] Got it? K. That's how you 00:18:11.125-->00:18:15.625 measure the indents. Now we're not trying anything yet but we are establishing what those 00:18:15.625-->00:18:20.625 indent widths are. So [deep breathe] this is what the output from the terminal looks like. 00:18:22.750-->00:18:29.000 Nothing may jump out at you except that. The width of that indent is like a sore thumb, 00:18:29.000-->00:18:34.458 It's much bigger than any other indents. So our software says "okay cool, the large indent 00:18:34.458-->00:18:39.250 number is 6, that is the number I'm going to try for all other combinations." So in this case, 00:18:39.250-->00:18:44.250 we think the indent is 93, we're really, really hoping the solution indent is 93. Uh we're 00:18:47.667-->00:18:52.667 gonna see if it works or not. Uh we're pretty sure. So, we know we have the solutions disk C. 00:18:55.917-->00:19:01.625 It's 33 times 33, it still takes about 3 hours so how are we going to do this is under 45 00:19:01.625-->00:19:05.833 minutes? There's some other things that we can do. How can we get the test time down from 00:19:05.833-->00:19:11.667 10 seconds to something shorter? Um this is something we created called set testing so uh we've 00:19:11.667-->00:19:16.833 got the test time down to about 4 seconds per test. We can even go a little bit faster than 00:19:16.833-->00:19:22.500 that. Um but let me demonstrate what set testing is cause it's a little complicated. Um well it's 00:19:22.500-->00:19:25.125 not complicated it's hard to describe. So, hum hum, so this, I'm going to play this animation 00:19:25.125-->00:19:27.125 again but disk C is the blue disk. Disk B is the green disk. Now we have those interference 00:19:27.125-->00:19:29.125 points right? To test as quickly as possible, I shouldn't reset all the disks. I'm a robot, I 00:19:29.125-->00:19:31.125 know exactly where the disks are so I shouldn't have to reset B. I tested C and now I'm gonna 00:19:31.125-->00:19:33.125 turn C until it interferes with B. B will move three digits and then C returns to where it needs 00:19:33.125-->00:19:35.125 to be and we test again. So we do this, we turn B, we bring it back, we turn B, we bring it 00:19:35.125-->00:19:37.125 back. And I want to show you the next video of that in practice. Set testing and take 00:19:37.125-->00:19:39.125 measurement. MMk so this is, it-it the robot. Oh that set testing, measurements there we 00:19:39.125-->00:19:43.708 go. So we test, we move the disk, we test, we move the disk, we test and you can see that 00:19:43.708-->00:19:48.333 slot opens up a little bit and keeps going and we go right through it. Now realize that 00:19:48.333-->00:19:53.333 this is just a quick little video but we're testing a large number of combinations in the 10 00:19:59.125-->00:20:04.125 seconds it takes to watch this video. We're screening through combinations as quickly as we 00:20:42.750-->00:20:47.750 can. Hmm, okay so doo-doo if we can get the set time, test time per combination down to about 4 00:20:57.292-->00:21:04.000 seconds how are we gonna get it down to 45 minutes. We can't, it's all luck. It's to the demo 00:21:04.000-->00:21:10.083 Gods of Def Con to try to get this thing open in 45 minutes. [laughter] It's not an exploit, 00:21:10.083-->00:21:15.208 it's just luck. Um so you may ask yourself uh okay, how can we improve upon this technology? 00:21:15.208-->00:21:20.208 How do I protect myself? Well there's a couple things, um if you don't like combination locks 00:21:22.292-->00:21:26.958 get one with a key pad right? The one in the middle has a keypad and my robot does not 00:21:26.958-->00:21:32.583 work on keypads, however before you buy the model of safe in the middle, I suggest you search for 00:21:32.583-->00:21:37.583 it on the internet because that safe can be opened faster than we can open this one. You take a 00:21:37.583-->00:21:41.917 high powered magnet, you take it outside and there's a solenoid that when you type in the 00:21:41.917-->00:21:46.292 keypay, that solenoid pulls the pin and you can open the safe? Well if you take a high powered 00:21:46.292-->00:21:50.167 magnet and you can activate the solenoid using that magnet from the outside and you can open the 00:21:50.167-->00:21:55.167 safe in a couple seconds. [laughter] Do your research. Um well Nathan, I could just spend 00:21:58.333-->00:22:03.042 more money on a safe. Yes you could, there's lots of good secure safes out there for um ya 00:22:03.042-->00:22:09.000 know a thousand dollars. Um you can get a safe that doesn't have plastic internals right? This 00:22:09.000-->00:22:14.042 safe is the most, common model at home dept, Lowes and all the other places. So this is the one 00:22:14.042-->00:22:18.750 that we wanted to exploit because this is probably the one that everyone has. However if 00:22:18.750-->00:22:22.375 you spend a whole bunch of money you can get a jewelers safe but you can also get the SG6030 the 00:22:22.375-->00:22:24.375 interesting thing about this is that um the only people that buy this are locksmiths because they 00:22:24.375-->00:22:26.375 are the only ones who can actually dial in the single digit combination. Remember, our 00:22:26.375-->00:22:28.375 safe has that plus or minus one digit so if you dial in 56 and it's supposed to be 55, it's 00:22:28.375-->00:22:33.375 still going to work. This lock you have to be dead on and it's so bad that most users can't 00:22:44.500-->00:22:49.500 open their own safe. And there's always someone around with a thermolance [laughter] right? No 00:22:53.167-->00:23:00.125 matter how much money you spend on a safe. There's, uh nothing is impervious. So few things 00:23:00.125-->00:23:06.875 about future research, um we found out that as you, there's 2 aspects, 2 motors on our robot. 00:23:06.875-->00:23:11.750 One is the motor that spins the dial and the other one pulls on the handle. We have a very 00:23:11.750-->00:23:17.625 sensitive motor that uh turns the dial. We can also get a very sensitive servo that pulls on 00:23:17.625-->00:23:22.625 the handle. At, giving us feedback about how far down the handle has been pulled. Um, if 00:23:26.958-->00:23:33.417 the ha, we uh let's see. Based on the depth at which the handle is going, we ought to be able to 00:23:33.417-->00:23:38.167 glean some information about the disks inside the safe. I don't know if we can or not, but we 00:23:38.167-->00:23:44.250 can get uh depth feedback from the servo. Something to look into. Uh another one, this is 00:23:44.250-->00:23:49.250 from my friend TJ. This is an idea, it's called impulse response we ought to be able to 00:23:49.250-->00:23:55.083 slam the arm into the disks and listen to what it sounds like. If there's 3 pieces of plastic 00:23:55.083-->00:24:00.667 there. We should hear one sound. Humans probably won't be able to detect this but a computer could 00:24:00.667-->00:24:07.333 look and do the analysis and say ah there's 3 pieces or plastic there or in this case. You can 00:24:07.333-->00:24:11.583 barely see there is one slot lined up to whenever we slam into it. There's only 2 pieces 00:24:11.583-->00:24:16.875 of plastic, we should have a different impulse response. If we can make this happen then I 00:24:16.875-->00:24:20.167 won't have to stand next to a safe that isn't open. Uh we should be able to open it up a 00:24:20.167-->00:24:25.167 lot faster. Uh next, we have a uh 3D printed coupler that works with this dial. So if you want 00:24:29.042-->00:24:34.292 to hack into this safe you have to get measurements of that safe, measurements of that dial 00:24:34.292-->00:24:39.292 or on a safe similar to it. Um in this case, uh there are really interesting grabbers uh 00:24:42.750-->00:24:48.708 this is uh from irobot and it's basically a balloon filled full of coffee grounds. You press it 00:24:48.708-->00:24:54.000 up against the thing and then suck the air out of the balloon and it turns into a uh hard 00:24:54.000-->00:24:58.417 gripper, so you can grip all sorts of different objects and different shapes. Um a few shown 00:24:58.417-->00:25:03.917 here we may be able to create uh a coupler that you shove onto a disk, you evacuate the air and 00:25:03.917-->00:25:08.375 then you have a very tight grip on whatever dial any, any size or shape dial you've got. 00:25:12.500-->00:25:18.125 Another thing, uh the next safe that we would like to work on is the uh keypad safe. So these are 00:25:18.125-->00:25:23.792 the ones that you often find in the hotel room um or uh the one I suggested before. There are 00:25:23.792-->00:25:28.792 machi- [beeping] >>Woo! [applause] [silence] [laughter] [uproarious applause] >>What's 00:25:58.292-->00:26:03.292 in the safe?! >>I don't know! [indescribable] >>OH yeah, So the combination to the safe is 00:26:23.208-->00:26:28.208 >>51, 36, 93 [applause] [speaker exhales sharply] >>Man oh man, okay. I'm- I'm done now. 00:26:36.500-->00:26:42.125 [laughter] Um, lastly we- we ought to look at the- we ought to be able to see the tactile 00:26:42.125-->00:26:48.583 feedback of buttons. So uh using a load cell on a pen we ought to be able to press the button and 00:26:48.583-->00:26:53.542 see where the tactile force fails and from that you can see which buttons have been worn 00:26:53.542-->00:26:58.625 out. In theory, this is future research. Not sure if we can but we've done a lot with load 00:26:58.625-->00:27:04.042 cells. And this is a common testing method for tactile uh tactile feedback of buttons. It 00:27:04.042-->00:27:08.500 might work, um yeah and then once you have the number of buttons figured out it's just in 00:27:08.500-->00:27:13.292 factorial. This is all really boring compared to that [laughter] so yeah I'm um. We 00:27:13.292-->00:27:18.292 got it open. That's all I got. [applause]