Threephase

Creative and professional things by Chris Peplin

Safe Cracking at Home

19 October 2015

One of the most interesting places I’ve lived with my family is a late 19th century farmhouse in Ann Arbor. The house is huge, maybe 4000 sq. ft, and we lived in an apartment occupying the entire first floor. The most notable, permanent fixture in the apartment is this massive safe:

Front of closed safe

Our landlord mentioned that it was so big and heavy, the safe was wheeled in while the house was still under construction and the building was completed around it. The safe was locked, and she didn’t have the combination.

While we lived there, we occasionally joked about ways to crack the safe. The two leading ideas were:

  • Use an Arduino and a few stepper motors to iterate over every possible combination automatically, and just let it run while we lived there.
  • Host the equivalent of a rent party and have guests pitch in to hire someone to drill into the safe.

The mechanics of the automatic safe cracker eluded me, being more software and “light duty” hardware inclined, and some online research led me to believe that drilling would be very destructive and might not work. We let the ideas go, and just lived with the massive block of metal in our peripheral vision. The cats stared at it while in the litter box.

Giving Up

Two weeks from the end of our lease, I found myself sitting in front of the safe, feeling terrible about leaving such a challenge behind.

I read up on the basic safe cracking and learned there are more intelligent, statistical methods to find the combination than brute force. This seemed like it might be a good activity when not packing moving boxes.

The only marking on the safe were the company that manufactured or distributed it - Hall’s Safe & Lock Company. I found a post in an antiques forum (allexperts.com, sadly now removed from the web) describing the possible types of locks and how they might be unlocked. I hadn’t even thought of how it might be challenging to figure out the unlocking process even if I had the code.

Sticky Notes

Again, I felt like giving up, but I thought of how this might related to cracking a computer password in the 21st century. The most efficient way is often social engineering, especially if you can find the password on a sticky note near the computer in question. Whomever last opened this safe surely wrote the combination down somewhere. Suddenly, this caught my eye, in the doorjam of an adjacent utility closet:

Tape on Door Jam

Why is there a small piece of masking tape in the door jam? I looked closer and noticed it had very faint markings. I carefully removed it from the wall and was able to read it under the right lighting conditions, mostly.

Safe Combination

Transcribed:

67 p-bar x 2 79
115 p-bar x 1 = 60

There’s still a lot of mystery. What does p with bar over it mean? Is the last number 60 or 69? How do I actually use these numbers with the safe’s controls to open it?

Spinning the Dial

I was able to solve the last question thanks to the digitized Duke University Archive and this original instruction sheet for a Hall’s safe.

By seeing the description of how to unlock the safe with some sample numbers, I could decode the notation on the masking tape:

Decoded Safe Combination

The p with a bar over it turned out to be from the Latin “post”, meaning after. The last person to unlock the safe may have been a doctor, because I found this is a common abbreviation in medicine (or maybe a physicist, as a leared p-bar also stands for antiprotons).

The final procedure to unlock the safe was:

  1. Spin 3 times left to 67.
  2. Spin 2 times right to 79.
  3. Spin 1 time left to 115.
  4. Turn directly to 60 without spinning around.

It took only a few attempts once I found this formula, and finally the handle turned:

Safe cracked open

Riches

Immediately, I realized that trying to drill into the door would have been futile due to the depth:

Thick safe door

Even worse, a brute force physical approach would have wrecked the decoration on the interior door:

Interior door decoration

The suspense was high. The whole point of cracking a safe is to get what’s inside:

Empty.

Alas, it was empty except for a 20-year old thermostat and an old German stamp:

Deutfches Reich Stamp

The stamp is from approximately 1922, German Deutsches Reich 100000 Mark Postage Stamp. It’s available for a few dollars online, so while this exercise didn’t end in financial riches, I’m really glad to say I didn’t leave the house with the safe un-cracked.