Security Maxims: Feynman's Maxim

From Security Maxims
http://www.ne.anl.gov/capabilities/vat/seals/maxims.html

Feynman’s Maxim: An organization will fear and despise loyal vulnerability assessors and others who point out vulnerabilities or suggest security changes more than malicious adversaries.
Comment: An entertaining example of this common phenomenon can be found in “Surely You are Joking, Mr. Feynman!”, published by W.W. Norton, 1997. During the Manhattan Project, when physicist Richard Feynman pointed out physical security vulnerabilities, he was banned from the facility, rather than having the vulnerability dealt with (which would have been easy). [sic]

Many years ago, I read this book. Richard Feynman had a great analytical mind and was able to find methods to open the locked filing cabinets when he worked on the Manhattan Project at Los Alamos. They started as padlocks on rods and moved up to Mosler combination locks. (I should be clear about this. Sometimes he found bypass methods to take papers out of locked cabinets without opening the lock at all. Same difference really.) He used a remarkable set of problem solving skills often playing the people as much as the hardware.  Often it was a bit of both as he found he could quickly discover a partial combination from a lock when visiting a co-worker while the safe lock was opened. 

At one point he explains to a Colonel how he opened one highly classified safe and the order was given to not let Mr Feynman near your safe. The military guy did not take the advice from Feynman on how to eliminate this as a vulnerability for all people.

Read the book if you want some practical ideas on 'safe cracking'.  It is also one of the book which brought me into the trade.


--- --- --- --- ---
The contents of this post are released for non-profit or educational use in whole or in part provided this statement and the attribution below are kept attached.

Laux Myth ... Thoughts From a Locksmith
By MartinB, Found @ http://lauxmyth.blogspot.com/

Cell Phones and Driving.

OK. Yes. I have made driving mistakes while talking on mine.

I have also seen other drivers make terrible mistakes.

With rare exceptions, I have stopped talking while driving and you should to. I also think the time is coming when the insurance companies will see this as such a risk they will pull coverage if you have a collision while talking. (I think this will go ahead faster than waiting for either of our levels of government to act. Government regulation would be more balanced and transparent but I do not see it happening like that.)

Shocking Safe Lock

While thinking of my last post, I thought of this one. Some days the ideas just flow.


For many businesses which use the safe to hold rolls of coin and floats, the number of openings per day wear out the standard group 2 dial safe lock. And worse, from a security point of view the staff see it as a hassle to keep redialing the lock and so leave the safe open or only locked by turning above the drop but then it is really not locked at all. A common and valid way to overcome this is to move to a digital safe lock where the the staff can open as fast as dialing a phone and once the door is closed it relocks automatically. The higher level of compliance generates better security overall.

Which brings me to my story of the safe in question which was recently converted from a dial lock to a LaGard digital as seen here. About a week later, a manager phoned to say the new lock was giving staff shocks when they operated the safe. In our shop, we reminded them it holds two 9 V batteries in parallel. The most juice this can give is 9 V and people would barely feel that if at all. Beside, a short would make it so the lock would not work and since the lock still works it is not our lock. Seemed to settle this for a bit.

A few days later, the store manager was back. While she did not think it was the lock either but that is all which was new, she would risk the cost of a service call to find out for sure. I was put in my job box.

I arrive and do nice introductions. The manager shows me the container and I test the lock. Works -- no surprise. Look behind at batteries and wires. Boring. She explains it does not always happen. As chance would have it, an assistant manager comes into the office as I start asking if there are any special situations which make the shocks happen more often. She does not know of any. He does.

"If you are holding onto the door frame, it usually happens." I should have been thinking better at this moment. I put my hand on the portion of the door frame where he was pointing which had the paint worn off. I touched the face of the lock. Nothing. (Wait for it.) I touched the body of the safe. YIKES!! It was REAL and it was not 9 volts. I can not recall if I metered the voltage but I really did not have to do that to KNOW it was not a 9 volt source.

I then looked at the back of the safe and saw two different power chords going behind it into a small space of maybe 3/4 inch or 2 cm. Since I know most plug-ins extend more than this, I knew the power was from those. This safe would have been just over 1000 lbs or 450 kg and moved easily out from the wall with a crow bar, wedges and rollers. Once out about a foot, I could see the damage. It had crushed both plugs into the receptacle which it had also smashed in. I pulled both plugs out after putting on some rubber gloves. Both plugs were clearing folded but on one I could see a tiny shiny copper surface.

For those outside the trade, safes do move back. The door is always a significant percentage of the weight and slams the safe back a tiny amount each time the door is closed. This movement adds up since there is nothing to bring the safe away from the wall. If you install the safe ahead of an electrical outlet and ideally you would not, you then place a solid spacer to prevent exactly what happened here. In this case, I sold the store a chunk of wood and wrote on it to leave behind the safe. I also explained these two appliance plugs are no longer safe to use and the plug-in needs works too. Since I am not an electrician, I leave it to them to get those items repaired.

It was a strange call but it all worked out to solve the problem and I had billable time. I think they were luck this was not found with a fire. Also, I have told this little tale at parties and now on the net. Seems electrocuting yourself is good for a laugh.


--- --- --- --- ---
The contents of this post are released for non-profit or educational use in whole or in part provided this statement and the attribution below are kept attached.

Laux Myth ... Thoughts From a Locksmith
By MartinB, Found @ http://lauxmyth.blogspot.com/

Midnight Shift is Always the Last to Know

So it was 3:30 am or some other time at night when I was ASLEEP and the phone rang. As I regained consciousness, I was told the story from a manager at a fast food place which stays open 24/7 of her safe which would not open. It seems our company moved it for renovation on Friday morning and now she can not open it. I had heard nothing of this move but that is unremarkable with the volume of work we have in our shop. The evening shift had opened it but now she can not. She knows she is using the right combination on a LaGard digital safe lock. This seems plausible since when she is done entering the code she reports a double beep as usual and she is not getting lock out delays.

For those in the technical end, you know where this is going. In my stupor I could think of a few ways a safe could lock up from a move. You could drop a bigger safe than I expect this place to have and break the glass relock plate. It would lock up good and fast. Also, with a smaller box, it may be badly out of level and twist to bind the door but again you will see that in door-run and rocking at the install. (The staff member we usually have do safe moves has way more experience than I and is very good at such details. He would NOT miss this.) However, it was all I could think of so asked her over the phone if the door had some play. She confirmed you could move the door in and out but a very small amount and it was 'about the same as yesterday'. Hmmm ... what is the problem??

I explained the midnight rates compared to the weekend day rates and also explained I did not know how a move could generate this problem. I also explained that if it were from the move it would be a no charge job but if not the restaurant would be charged. It is only fair to fully disclose and let the client decide. Given this and my wish to go back to bed, we agreed I would arrive there between 8 and 8:30 in the morning to see this safe. She agreed to a free coffee either way.

A different manager phoned a few hours later and said the safe was now open. I never did find out what the problem was earlier but suspect it was the operators. I hope in my slurry state I invited him to call again if the problem came back. (I was going to call this a PEAKs error meaning Problem Exists Above Keyboard but looked it up and it is not as common as I thought. Thinkers on design point out often the problem is the machine does not give good information to the user it is expecting some action and when you give it input it does not expect since you can not know what input the machine is expecting, it is not valid to call it human error.)

But now to get a bit more serious. If you can think of ANY way a safe move could generate a lock out, please toss it to me by email or as a comment.


And yet this call brought me back to a call years ago when I was newer to safes. It was well after midnight and they needed a safe open and had the codes. This is a high security place and each staff member keeps many safe codes all in small books which are closely held. This safe would not open for their known combinations. Given it was a dial safe I did the thinks I knew then. Basically, you test for various mechanical failures and carefully feel for changes in the dialing behaviour in terms of sound and feel. I did the set I knew. I did them again. And again. I had the staff check the codes with other staff who knew the same codes by phoning other poor sods in their sleep. We received confirmation the combination was right and yet it did not open. We contacted a manager and were approved to drill the next morning.

I went home and slept some. I went to the shop and loaded up tools where I was joined by a more experienced technician. We phoned to see if now was a good time and spoke to a different supervisor than was on duty at midnight. The safe was open and he knew nothing of my visit at 3 am. The combinations were changed during the evening shift and were not passed on. Well, that explains why the locks felt like they were in good condition.

It is true that the midnight shift is the last to know.


--- --- --- --- ---
The contents of this post are released for non-profit or educational use in whole or in part provided this statement and the attribution below are kept attached.

Laux Myth ... Thoughts From a Locksmith
By MartinB, Found @ http://lauxmyth.blogspot.com/

Inclusive Language and the WWW

You will notice I seldom refer to a locksmith as 'he' or 'him' since I know some women in the trade. I want my writing to speak to all and find I can do that without much effort and usually readers will not even notice it is gender neutral.

Likewise, I have written before on the Web and know it is World Wide. I will try to give measurements in imperial and metric. This is a bit tougher as most of the locks we deal with are given in specifications using thousandths of an inch or just 'thou' commonly.

I also know I will be read by many who do not speak English as a first language. This means some of my casual language, while funny here, is confusing in other places. I want to have fun but if you do not know what I mean, feel free to write a comment saying just that.

In fact, on any of these points, feel free to toss a message and I will edit a post if you convince me there is a problem.