Stealing Money from a Safe with a Vacuum

Clever:

The burglars broke into their latest store near Paris and drilled a hole in the "pneumatic tube" that siphons money from the checkout to the strong-room.

They then sucked rolls of cash totalling £60,000 from the safe without even having to break its lock.

I like attacks that bypass the defender's threat model.

Tags: , , , ,

Posted on September 28, 2010 at 2:42 PM • 42 Comments

Comments

Dman • September 28, 2010 3:15 PM

While I dont see any details of the security system and am not familiar with this type of device this seems like a simple fix. Make the tube one way with some sort of one way block that allows money to go through the tub into the safe but not out of the tube.
I am hoping there is more to this system than appears because from the limited details given this is gross neglegence not to mention just plain dumb.

RH • September 28, 2010 3:22 PM

I can't view the article, because my corporation blocks thesun.co.uk, but don't people usually design vacuum systems such that a plenum prevents things from being sucked up like this?

Its really easy to make one too, we have 3 outside a building to just remove sawdust from the air

William • September 28, 2010 3:24 PM

The article says these thefts have been going on at the same supermarket chain for four years. You'd think they'd have engineered a simple fix to make the tubes one-way.

Rex • September 28, 2010 3:40 PM

Hit the same way 15 times in four years!!
The management of that supermarket chain must be slow learners.

Cybergibbons • September 28, 2010 3:41 PM

Interesting - I want more details on how this was done though. I've never been in a supermarket in France, but nearly all of the large Tesco stores in the UK have pneumatic tubes from each of the checkouts to a strong room (no windows, double "airlock" doors, alarmed). The pods simply drop into a receiver, and then they are removed, counted, wrapped, and moved into a strong room (which is more like a safe).

Even smaller supermarkets normally keep the cash in a deposit safe, and although there are weaknesses and bypasses on these, you can't use a vacuum cleaner to get anything out.

I wonder if these French stores are 24 hour but don't employ cash handlers all the time - so the pods stack up in some kind of receiver, which can then be vacuumed out?

Anyway, anyone with any ideas?

Cybergibbons • September 28, 2010 4:26 PM

Having a look at this, there do seem to be direct feed safes, with the tube feeding directly into it. I can't see the need for these - if the volume of cash is so low that it doesn't need dealing with straight away, why not just use a normal deposit safe?

It also seems that "parachute bags" instead of the hard pods are in use now, and again I can see these being easier to suck up.

Stealing cash from supermarkets is generally quite a good place to do it - totally unsorted, unrecorded notes. It's also surprising the sheer amount of cash that can be held in a supermarket late on a weekend (though I think the cash handling systems in the UK have caught up with 24 hour and weekend opening now).

Stealing cash is a mug's game though.

Robert Merkel • September 28, 2010 4:55 PM

Even if there was the equivalent of a one-way valve on the safe, if you had a vacuum and could run it for long enough you'd still be able to steal bundles of cash as they came past.

jgreco • September 28, 2010 5:02 PM

Unless cleverly designed, a long bendy piece of wire could be fed down into the safe, to hold a one way valve open.

Honestly I find it incredibly surprising that this works at all, so maybe I am incorrectly visualizing how the system works.

Thomas • September 28, 2010 6:36 PM

@Rex
"Hit the same way 15 times in four years!!
The management of that supermarket chain must be slow learners."

Alternatively it's an inside job and the 'vacuum thieves' are being blamed as decoys.

Daew • September 29, 2010 2:02 AM

@Cybergibbons
Monoprix stores are not 24 hours and it seems that the design of the tubes was poor-designed. From what I understand, it seems that all the tubes join near the safe.

qwertyuiop • September 29, 2010 5:55 AM

15 atacks in four years - I can only assume they no longer have insurance cover for the theft of cash!

da • September 29, 2010 8:14 AM

It's funny to see my local supermarket quoted in Bruce's blog.

Too bad it's for such a lack of reactivity after 15 successful attacks...

Clive Robinson • September 29, 2010 9:59 AM

@ Anon,

"Fool me 14 times, shame on you.."

Ahh a quote from Futurama's Amy Wong when Zoidburg gets a little frisky.

kandy • September 29, 2010 10:59 AM

candice bergen was still a young hottie when she did that at 11harrowhouse, or was it 17charterhouse?

Neil in Chicago • September 29, 2010 12:01 PM

This is a gem for when you're trying to explain the sideways thinking of hackers (hat color notwithstanding), or how thinking defense without thinking about attack is inadequate.

walterzuey • September 29, 2010 1:32 PM

My best friend worked at a pizza place with a safe 25 years ago. When he came to work one morning, the floor was wet. He couldn't find the source of the leak until he opened the safe to find it soggy and devoid of cash.

Anders Larsen • September 29, 2010 4:54 PM

This was the main theme of the 1963 danish movie "Støvsugerbanden" (The Vacuum Cleaner Gang)

Nick P • September 29, 2010 8:21 PM

This is the first time I've heard of such a system being used in retail and it sounds ridiculous. I could be misreading the article, but it appears that this is an automated "cash drop." The traditional methods are already satisfactory, so I don't see why they add complexity to the process. Here's an example of how a major retailer in the US does it.

Each cash register has a maximum amount of money it can contain, in general and for large bills. After the register exceeds that maximum, with real-time notification, the cashier performs a cash drop. The cash is put in an envelope and dropped into a small drop box for which only a few trusted people have keys. At random intervals, an accountant picks up drops and puts them in the accounting room (isolated behind a strong steel door). Periodically, excess cash, tills, and vital documents are stored in a high quality safe with 10 minute opening delay. Any robbery requires surveillance, quick reaction and must be done in person. This results in at least one felony charge. The stores have never had a costly robbery, as the low cash and high risk act as a deterrent.

The system could definitely be improved. For instance, only a designated individual would have access to the drop boxes (and this may not be the accountant with access to the accounting room). The designated individual, perhaps a supervisor, would periodically take the drops and put them in the drop hole by the accounting door. This reduces the risk and requires two targets to consider: accountant for majority of cash and supervisor for whats in drop box (maybe nothing). Or the supervisor just immediately takes the money to accounting as its dropped (or ASAP). Each method involves costs and productivity tradeoffs, but the original lesser method already works.

Alvaro Cuadros • September 30, 2010 8:32 AM

Altough I agree with most of the comments , this actually reflects a lack of security that you can also see in Information Systems, where the whole security budget is used to protect data at rest and the transportation is neglected. No encryption, no VPNs,etc.

Let's learn from other's mistakes. :)

Nick P • September 30, 2010 9:33 AM

@ Alvaro Cuadros

I'll second that. In information systems, I'll add to it a failure to protect information during processing. Easily avoided design and implementation flaws cause more breaches than any other factor. Avoiding the majority comes at little cost. I say the extra cost should be considered part of the security budget, at least partially, because that's what it provides.

Jonathan Wilson • October 1, 2010 2:14 AM

I see these kinds of automated cash handling systems at supermarkets and department stores around here all the time.

Money goes into a sort of capsule thing which is put into a tube. The capsule is then fed into some kind of central output location and from there the cash is presumably loaded into a safe/armored car/whaetver (or possibly the central location IS the safe)

PSmith • October 1, 2010 3:25 AM

Finding the perpetrator could be simple. ...

If Inspector Clouseau would look for the one US elected representative whose name appears on flight arrivals for each of the dates of the thefts.

The wide-stance Republican perpetrator will be instantly identified from among his colleagues, who based on recent history all match him in this unusual billionaire servicing skill and wide-stance proclivity.

QED! Ymmv.

AvSec • October 1, 2010 3:45 PM

Bruce, like terrorists finding ways aroubd TSA's predictable checkpoint countermeasures, this is why we call them intelligent adaptive adversaries.

Nick P • October 2, 2010 11:14 AM

@ AvSec

"why we call them intelligent adaptive adversaries"

Sounds like way to many words to waste on some thugs.. I stick with crooks, criminals, pukes, and other one-word labels. ;)

Joe • October 14, 2010 4:58 PM

I used to be a checkout manager in a large supermarket in the UK. To explain how the pneumatic airtube system works is simple.

Each checkout has a send station which has a tube feeding the money which is sent in pods to a central cash office or strong room.

The pods are sent by the cashier at regular intervals throughout the day for security reasons to remove the risk of robbery through having excess cash at the tills.

The system is great as it saves management and security from having to go round with a trolley and complete manual cash collections.

The pods are received into a safe in the cash office and dealt with when time allows.
The only problem has been pods becoming stuck in the system when the suction fails. This usually means that the receiving safe door is open or there is a break in the tube network.

This is relatively rare, although can be stressful when trying to locate 40 pods full of thousands of pounds before you can go home.

I have used systems from Airtube group which are automated and Tesco used to use them. Tesco and Sainsburys now use Airlink (a newer company) to supply their tube systems and pods.

Whatever happened to Airtube Group, ten years ago they were leading the market and supplying every Tesco store. They were good systems, I suppose Tesco wanted the cheapest options.

I would say as a retail manager these systems are great in large stores where a high volume of cash is received.

I can image that eventually as technology progresses and companies aspire to cut costs that the airtube systems will lead the way for other methods. Airlink watch this space!

Checkout girl • October 19, 2010 4:50 PM

Ever heard of the cash tube thief who opened the pneumatic tubes in Tesco and Sainsburys whilst he entered the roof space via disabled toilets and took up to £90,000 over a period of time.

He took the pods out containing cash and then sent them back down the tube empty.

Who knows how he did it as the suction stops when the system has a break in vacuum. He is serving time in prison for burglary and if you google key words from this you can read the news articles.

Fanny • February 16, 2011 8:11 PM

The pod system rocks and more companies should use them. Back in the day all department stores used them. Check out cash railways website to see the old systems used in Allders Croydon etc.

Now Tesco, Asda, Sainsburys, Morrisons, Ikea, Wilkinsons, etc use them.

Check out Airtube Group or Airlink systems if you want to get a system.

Alan Redd • January 20, 2013 11:51 AM

Drilling a hole in the tube is not how these robberies occurred. Why drill a hole when you can just disconnect the tube? The drill was a long core drill used to drill away the anti-fish baffle. Easy to do because the 63mm metal tube opening in the safe acts as a stabiliser. Once the anti-fish baffle is out of the way you have a 63mm hole right over there the money is. Suck it, hook it, and grab it, whatever you’re into. Amazing anyone would give insurance cover to the receiving unit.

Leave a comment

Allowed HTML: <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre>

← Cultural Cognition of Risk NSA Publications →

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of IBM Resilient.