A $200 robot cracks a SentrySafe combination lock in about half an hour

For Christmas 2016, SparkFun founder Nathan Seidle's wife gave him a second-hand $120 SentrySafe combination safe whose original owner had forgotten the combination, with a challenge: open it. Over four months, Seidle and SparkFun colleagues Rob Reynolds and Joel Bartlett built a fully automated cracker from about $200 of off-the-shelf and 3D-printed parts — an Arduino, a motor, magnets, a dial coupler, and sensors detecting the handle turning and the dial passing zero. In the demo he gave WIRED, published 21 July 2017, it opened the safe in 15 minutes; the max is 73, half that on average.

The speed comes from three composed shortcuts. First, the safe tolerates error — 11 or 13 opens when 12 is set — so the bot tries every third number, dividing a million combinations by three. Second, ordering attempts so two rotors stay put while only the last moves cuts a try to four seconds, bringing the worst case to about a day and 16 hours. Third, the anti-cracking notches on the third rotor betrayed it: the one holding the combination slot was a hundredth of an inch narrower, automated measurement found it in seconds, and the search divided by 33.

SentrySafe, in a statement to WIRED, did not deny the vulnerabilities but argued the attack took 'tremendous effort, uninterrupted time in a controlled environment' — realistically very difficult, if not impossible, for the average person in the field. Seidle counters that anyone can reproduce his bot from cheap open-source parts — that is the point — while noting burglars have cheaper ways in anyway. At Defcon he planned to crack a newer $160 SentrySafe live, defeating its key lock by shoving a Bic pen body into the round keyhole: 'They added a layer of security that is completely useless.'

The anti-cracking notches meant to defeat human manipulation became the tell — machines can measure what fingers cannot feel.

The shortcuts compose: tolerance divides by three, the ordering trick cuts a try to four seconds, the notch divide by 33 — a million combinations fall to 73 minutes.

It took $200 of hobby parts, making the point that cheap robotics is resetting the threat model for physical security vendors.

Anti-manipulation features are measurable. If a defense works by feel — a notch, a click — a machine can measure it, and 'unfeelable by hand' is not a security margin.

Seidle demonstrated the robot live at Defcon 2017 on a newer, larger $160 SentrySafe, whose added key lock fell to the Bic-pen trick. He framed the work as mostly harmless DIY fun, a warning about cheap safes, and an invitation: other makers are welcome to apply parts of his approach to other models, including higher-end safes whose rotors may lack the giveaway.