Bruce Schneier
Schneier on Security
A blog covering security and security technology.
« Online Age Verification | Main | Friday Squid Blogging: Preserving Giant Squid »
November 21, 2008
Lego Safe
Nice:
You might think that a Lego safe would be easy to open. Maybe just remove a few bricks and you're in. But that's not the case with this thing, the cutting edge of Lego safe technology. The safe weighs 14 pounds and has a motion detecting alarm so it can't be moved without creating a huge ruckus.
Posted on November 21, 2008 at 1:07 PM • 27 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Comments
Aoi • November 21, 2008 1:28 PM
I tried building one of these, but gave up after I realized the low melting point of Lego bricks. Too easy to just apply a heat source to the top and get in. Still, impressive to look at, and fun to think about improving. A temp sensor perhaps?
vader • November 21, 2008 1:55 PM
well, I expect using a huge sledge hammer to destroy all alarm mechanism in one hit would do it. "Creating a huge ruckus" only helps if the mechanism is difficult to destroy -- which isn't the case here.
Dscho • November 21, 2008 1:56 PM
Of course, you'd put something extremely inflammable into that safe, no? I mean, the heat attack is the most obvious attack.
peri • November 21, 2008 2:08 PM
14.1592 ^ 10 is 323 billion
It must use really interesting digits.
(and that number should look familiar, try putting a 3 in front of it and see if that helps)
Clive Robinson • November 21, 2008 2:08 PM
Err heat or mechanical disruption is just so 1920's think modern solvent's for the quiet approach ;)
Seriously though the security is not the point...
As with all lego models it's the fun of creation.
And my son is getting a Mindstorms NXT for Xmas if and only if I don't wear it out first ;)
lego2 • November 21, 2008 2:39 PM
Nobody is going to point out the fact that the display tells you if the digit is correct, actually reducing the number of attempts to 5*99?
Anyway, I want one for christmas.
Clive Robinson • November 21, 2008 2:45 PM
Just one thing, if it was just built out of lego bricks then no it would not be that strong, but use technics studed beams, pins and ordinary lego plates it would be actually mechanicaly quite strong.
As to the lock why use electronics, conventional safe combination locks are not exactly difficult to make (wheels with slots and adjustable pins) so easily possible.
Ah the joys of being young 8)
For the real geek how about a lego Turing machine say using lego railway as the tape etc...
Now where did I leave those "lego bits"...
JF • November 21, 2008 2:58 PM
@lego2: this is not what is shown at 1:35. All 5 locks are open but the box does not open. Hear the diabolic laugh. Box opens at 2:00.
IMHO, the box displays how many digits have been entered already. Not if they are right or wrong.
Cheers,
JF.
@ JF, the icons change from closed locks to open locks, so it seems like it indicates a correct entry (that was my first thought when I saw it) you don't see it open but you hear it start before the video shifts. If that is true, than you wouldn't have to go through that many possibilities.
Jason • November 21, 2008 3:35 PM
Dang... this sort of thing makes me with my wife and I could have kids.
We have no excuse to buy the cool toys.
partdavid • November 21, 2008 3:41 PM
I read this the way JF does. What is being demonstrated is that the wrong combination is entered (the result icon is a lock, there is the laugh, the door doesn't open) even though the numbers have been entered. I don't think the door is starting to open at that point in the video.
BlindWanderer • November 21, 2008 3:54 PM
When I was a child I made a Lego safe with combination lock, it worked like an ordinary combination pad lock... except it had only 6 digits positions. A total of 216 combinations. Yes you could just pull the top off it and get at the Girl Scout Cookies hidden inside but you would be hard pressed to get it back put back together properly.
Bernie • November 21, 2008 4:12 PM
This story reminds me of trying to get Lego apart when I was a child... after a while, tooth marks on the bricks were very common. (Maybe I was simply a dumbass and pushed them together too hard.) I tell you that the first time I glued Lego bricks together was also the last time.
Jurjen • November 21, 2008 4:15 PM
Actually, if you look it up, the lock symbols in the display do _not_ tell you if the corresponding number is correct: they just tell you it is entered. The author explains all: there are only a few lego brick you can loosen to open the safe (a bit of glue could solve this): the only other option is to destroy it, which is guaranteed to make noise.
Anyway, destruction of the bricks is outside the scope of the experiment.
Peter E Retep • November 21, 2008 5:50 PM
Use the bricks as lost-wax cast molds, cast the bricks in metal, epoxy them together, and charge Neimann Marcus Dubai customers the requisite zillions of dollars for one, as hand made in silver, gold, or platinum. Then breaking INTO the safe becomes the superfluous part of safe-breaking.
vader • November 21, 2008 5:51 PM
"Seriously though the security is not the point..." -- well, the video says "ultra secure" AFAIR.
:-P
Roger • November 21, 2008 10:03 PM
@Clive Robinson:
> As to the lock why use electronics, conventional safe combination locks are not exactly difficult to make (wheels with slots and adjustable pins) so easily possible.
Most of us these days have far more ability to construct complex algorithms in code, rather than in elaborate mechanisms. In fact I would bet there are far more people who have programming tools for hobbyist microcontrollers (Lego Mindstorms, PICAXE, Basic Stamp etc.) than there are people with precision machine tools.
And they do need to be precision made; roughly finished combination locks are both easier to bypass, and also unreliable.
Electronic locks also give a variety of powerful options that are difficult, or even practically impossible, to implement mechanically. For example:
1. logging and audit trails;
2. differently privileged keys for different users;
3. instant revocation of a compromised key, without affecting other users;
4. intelligent rate limiting;
5. Sophisticated time-based controls.
(Some of these can be done, crudely, in very sophisticated and complex mechanical locks.)
Clive Robinson • November 22, 2008 3:42 AM
@ Roger,
Ahh, sorry my fault I was talking in the context of building the mechanisum out of lego bits such as the lego technics etc.
That is from a more asthetic point than technical (for which your points are correct).
Lego is not just a toy in the same way that Play Dough is not just a toy. They both alow people to not only have fun but also express themselves both creativly and inventivly. Further the process alows investigation into the process which is a fundemental part of learning.
I'm not going to witter on about "form over function" but simply say that irespective of the security aspects of this safe, the whole thing has that "neat" asspect that appeals to some people.
Estheticaly I would like to have seen a mechanical combination lock in lego as to me it has a "beauty of it's own" which is like seeing technical or construction drawings as art (which some truely are).
Beauty has meaning to the observer, I find it in all sorts of "technicaly sweet" and often quite abstract designs and implementations. This is because viewing it makes my mind think "yes this has both form and function" and I get a physical (gut) reaction. A double hit or if you will an expresso for the mind ;)
Pat Cahalan • November 22, 2008 10:13 AM
I'm imagining 'lil Marcus building one of these and keeping his favorite toys in there and 'lil Bruce figuring out how to crack it without getting caught. Or vice versa. Hm... so Bruce, if you could revert to childhood, would you rather be the safe builder, or the safe cracker?
Henning Makholm • November 22, 2008 1:54 PM
I find it interesting that this thing apparently has a fully electronic _mechanism_ while mimicking the _user interface_ of a mechanical combination lock -- there's a wheel that you turn in alternate directions to enter key digits, and another wheel (just for show, apparently) that spins as the locking bolts retract.
Wasn't the fun of lego technics supposed to be that what you build works by the same principles as the real thing? Or do serious electronic locks actually use dials for data entry?
Does a dial have a safety advantage over an off-the-shelf 10-button keypad? The only one I can think of is that it eliminates differential wear of the keypad keys, which might clue in an attacker as to which digits the key uses. On the other hand, if you need to open your safe in the presence of untrusted persons, it is a lot easier to hide the key entry for a keypad than with a combination dial.
Roger • November 22, 2008 5:40 PM
@Henning Makholm:
> Wasn't the fun of lego technics supposed to be that what you build works by the same principles as the real thing?
I suspect the reason is that the system is designed for robotics rather than general electronics or data entry, thus the constructor probably had ready access to a wheel position optical encoder, but could not easily obtain a conventional keypad. But that's just a guess.
> Or do serious electronic locks actually use dials for data entry?
Not that I've ever heard of. Generally, the most expensive ones use scrambling keypads. That is a keypad similar to an ordinary numeric keypad, but with each button labelled through a miniature LED matrix display. The position of all the numbers is randomly scrambled after each key press. They usually also have a grid of plastic mesh mounted over the LED matrix to reduce the viewing angle to about 20° in front of the keypad.
The combination of these features makes shoulder surfing very difficult, eliminates uneven wearing of the buttons, and pretty well completely defeats attacks based on physical identification of buttons (such as tracing agents, thermal traces, or acoustic cryptanalysis.) They also make it much harder to attack the system through a recording device concealed inside the keypad, since it must be able to decode and record not only the key strokes, but also the display information sent out to the keys.
Unfortunately, scrambling keypads are more than an order of magnitude more expensive than regular keypads. A typical price is USD $400.
Clive Robinson • November 23, 2008 11:43 AM
@ Pat Cahalan,
"so Bruce, if you could revert to childhood, would you rather be the safe builder, or the safe cracker?"
I don't know about Bruce (but we are of similar age) but I'd learnt to pick my first (byke combination) lock when I was eight and progressed up to a small safe when I was not quite in my teans.
Spent a little time in the green and asociating the UK F&CO DWS and helped develop a Picolo system amongst other things...
Then just a few years later I was designing electronic locks for the hospitality industry and a while after that at another more prestigious organisation designing high security biometric locks (got the heave-ho after showing the boss how to make fake finger prints with red wax rubber solution glue and a rubber glove which is something else I had learned when I was ten).
After bouncing through designing safety critical systems for the oil industry I went south of the equator to design crypto engines for one or two choice organisations on different continents.
So you could say I've been both but a "proper hacker" first and formost 8)
And as Bruce points out to make a good cipher system you have to know how to break other cipher systems first...
bob • November 24, 2008 9:33 AM
@Roger, Henning Makholm: The US Government uses electronic locks with a dial (XO7 for example) to secure a wide range of items that protection would be desirable for; such as classified info or weapons.
This is just a technology demonstrator, not intended to actually secure valuables. In the video they stated that they only had 2 motors (the left knob is on a "motor" - its how you get info INTO the Lego NXT brick), the right wheel obviously spins in sync with the motor that inserts and extract the bolts; so I can just manually turn the right dial and extract the bolts without bothering with a combo at all.
Also, the batteries in a running NXT dont last real long, what happens when it shuts down and stops listening?
Nami • November 25, 2008 2:54 PM
@Roger, Henning Makholm
As bob notes, there are some. The current model is the Kaba Mas X-09, which is a very neat little piece of work.
You can see it at http://www.mas-hamilton.com/a.php?page=x-09_main
James • November 28, 2008 4:50 PM
@Hennin Makolm
Yes, there are high security electronic combo locks that use a dial interface. As other have posted, the Kaba Max X-09 is one such lock.
Power comes from dial motion, as a fail safe for the locking mechanism and to eliminate dependence on external supplies. Because the dial is electronic, the numbers can move -- you view what you dial via a tiny, narrow-viewing-angle display on the top of the dial ring. The lock also incorporates several security features that are only possible electronically that make it essentially uncrackable. Specifically, the lock has lock-out/lock-down rules similar to bank pins. Too many bad combos locks the thing down. Same with dialing too fast -- you might be a robot dialer. Same with dialing for too long at a stretch. Same for making a dial motion that a human wrist couldn't replicate -- like continuous unbroken rotation.
Subscribe to comments on this entry
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.
|
| Subscribe |
Subscribe via Kindle |
| Blog Menu |
SearchPowered by DuckDuckGoBlog Home Page
Archives by Date2014 J F M
Tags  |
| Latest Book |
more books by Bruce Schneier |
|
Leave a comment