Editing Safe-cracking (section)

==Physical methods==
Safes have widely different designs, construction methods, and locking mechanisms. A safe cracker needs to know the specifics of whichever will come into play.

=== Lock manipulation ===
[[Lock (security device)|Lock]] manipulation is a damage-free, combination-based method.  A well known surreptitious bypass technique, it requires knowledge of the device and well developed touch, along with the senses of sight and possibly sound.

While manipulation of combination locks is usually performed on Group 2 locks, many Group 1 locks are also susceptible. The goal is to successfully obtain the combination one number at a time.<ref>Archived from [https://web.archive.org/web/20161222161226/http://www.northlandlocksmith.com/2016/12/09/safe-lock-manipulation the original] on December 9, 2016</ref> Manipulation procedures vary, but all rely on exploiting mechanical imperfections in the lock to open it, and, if desired, recover its combination for future use. Similar damage-free bypass can also be achieved by using a computerized auto-dialer or manipulation robot in a so-called [[brute-force attack]]. These auto-dialer machines may take 24 hours or more to reach the correct combination,<ref>[https://web.archive.org/web/20170801070401/https://learn.sparkfun.com/tutorials/building-a-safe-cracking-robot Archived] August 1, 2017</ref> although modern devices with advanced software may do so faster.

Mechanical safe locks are manipulated primarily by feel and vision, with sound sometimes supplementing the process. To find the combination the operator uses the lock against itself by measuring internal movements with the dial numbers. More sophisticated locks use advanced mechanics to reduce any feedback available to a technician in identifying a combination. These group 1
<ref>[https://web.archive.org/web/20170628171053/http://www.lockwiki.com/index.php/UL_768#Group_1 archived] from original June 28, 2017</ref> locks were developed in response to group 2<ref>[https://web.archive.org/web/20170628171053/http://www.lockwiki.com/index.php/UL_768 archived] from original on June 28, 2017</ref> lock manipulation.<ref>[https://web.archive.org/web/20160809033616/http://www.navfac.navy.mil/navfac_worldwide/specialty_centers/exwc/products_and_services/capital_improvements/dod_lock/SecurityHardware/CombinationLocks/ProductInformation/FF-L-2937_Locks.html archived] from original on August 9, 2016.</ref> Wheels made from lightweight materials will reduce valuable sensory feedback, but are mainly used for improved resistance against radiographic attacks.<ref>[https://web.archive.org/web/20170628171053/http://lockwiki.com/index.php/UL_768 Archived] from the original on June 28, 2017.</ref> Manipulation is often the preferred choice in lost-combination lockouts, since it requires no repairs or damage, but can be time consuming for an operator, with the specific difficulty depending on the unique wheel shapes and where the gates rest in relation to them. A novice's opening time will be governed by these random inconsistencies, while some leading champions of this art show consistency. There are also a number of tools on the market to assist safe engineers in manipulating a combination lock open in the field.

Nearly all combination locks allow some "slop", or deviation, while entering a combination on the dial. On average, 1% radial rotation in either direction from the center of the true combination number allows the fence to fall despite slight deviation, so that for a given safe, it may be necessary only to try a subset of possible combinations.<ref name="isbn0-393-01921-7 ">{{cite book |first=Richard P. |last=Feynman |title=Surely You're Joking, Mr. Feynman!: Adventures of a Curious Character |editor=Leighton |editor-first=Ralph |language=en-us |publisher=[[W. W. Norton]] & Company |year=1985 |isbn=0-393-01921-7 |oclc=10925248}}</ref> Such "slops" may allow for a margin of error of plus or minus two digits, which means that trying multiples of five would be sufficient in this case. This drastically reduces the time required to exhaust the number of meaningful combinations. A further reduction in solving time is obtained by trying all possible settings for the last wheel for a given setting of the first wheels before nudging the next-to-last wheel to its next meaningful setting, instead of zeroing the lock each time with a number of turns in one direction.

=== Guessing the combination ===
{{Further|Password cracking}}
A safe may be compromised by using a manufacturer-set combination. Known as try-out combinations, these allow an owner initial access to their safe in order to set a new unique one. Sources of
try-out combinations exist by manufacturer.

Other easy-to-guess combinations include a birthdate, street address, or driver's license number.

=== Autodialer ===
Autodialing machines have been developed to open safes. Unlike fictional machines that can open any combination in a matter of seconds, such machines are usually specific to a particular type of lock and must cycle through thousands of combinations before success. Such a device was created by two students from the [[Massachusetts Institute of Technology]], which took 21,000 tries to open a Sargent and Greenleaf 8500 lock on a Diebold Safe. Lockmasters, Inc. markets the QX3 Combi Autodialer (LKMCOMBI) that works on a variety of 3 and 4 Wheel combination safe locks.<ref>{{cite press release | title=Dialer ITL-2000II | publisher=Zieh-Fix, Inc. | url=https://www.zieh-fix.com/en/dialer-lkmcombi.html | access-date=2020-10-12 }}</ref>

Another computer-aided method uses tools similar to autodialers, which instead make measurements of the internal components of the lock then deduce the combination in a way similar to that of a human safe cracker.  Mas Hamilton's SoftDrill was one such device, but is no longer in production.

=== Weak-point drilling ===
[[File:Safecracking-Drill-Rig.png|thumb|Safe-drilling with a drill rig]]

Some safes are susceptible to compromise by [[drilling]]. Manufacturers publish tightly-guarded drill-point diagrams for locksmiths for specific models. Drilling is an aid in  bypassing the locking mechanism, as well as gaining more information about it in order to defeat it. It is the most common method used by locksmiths on malfunctioning or damaged locks, and commonly used in burglary.

Drill-points are often located close to the axis of the dial on the combination lock, but drilling for observation may sometimes require drilling through the top, sides or rear of the safe. While observing the lock, the attacker manipulates the dial to align the lock gates so that the fence falls and the bolt is disengaged.

Bypass attacks involve physical manipulation of both the lock and its bolt mechanism.

Punching, peeling and using a torch are other methods of compromising a safe. The punch system is widely used by criminals for rapid entry. Punching was developed by Pavle Stanimirovic and used in New York City. Peeling is a method that involves removing the outer skin of the safe.

All quality safes protect against drilling attacks through the strategic use of specially tempered or alloyed hardplate steel, or composite hardplate (casting [[tungsten carbide]] chips into alloys such as cobalt-vanadium, designed to shatter the cutting tips of a drill bit). These include protecting the locking mechanism, the bolts, and areas where drilling could be used to advantage. Special diamond or tungsten-carbide drill-bits can make some headway with some hardplates, but it is still a time-consuming and difficult process.

Some high-[[security]] safes use a tempered glass [[relocking device|relocker]]. This has wires that lead from the glass to randomly located, spring-loaded bolts. If a penetrating drill or torch breaks the glass, the bolts are released, blocking retraction of the main locking bolts. A gas abrasive drill can sometimes be used to safely drill through a glass relocker.

[[Plasma cutting|Plasma cutters]] and [[thermal lance]]s can be as hot as {{Convert|2200|C||abbr=on}}, much hotter than traditional [[oxyacetylene torch]]es, and can be used to burn through the [[metal]] on a safe. Many modern high-security safes also incorporate additional thermal safeties to foil [[blow torch]]es and [[thermal lance]]s. These are usually in the form of fusible links integrated into the glass relocker cabling, which trigger it when a set temperature is exceeded.

Drilling is an attractive method of safecracking for locksmiths, as it is usually quicker than manipulation, and drilled safes can generally be repaired and returned to service.

=== Scoping ===
Scoping a safe is the process of drilling a hole and inserting a [[borescope]] into the safe to get an intimate look into a specific part of the [[security]] container. When manipulation-proof mechanical locks and glass re-lockers are implemented as security measures, scoping is the most practical option. One common method is called "scoping the change key hole." The safecracker will drill a hole allowing him to get his scope into a position to observe the change key hole. While spinning the dial and looking through the change key hole for certain landmarks on the combination lock's wheel pack, it is possible to obtain the combination and then dial open the safe with the correct combination. This method is common for a professional safe specialist because it leaves the lock in good working order and only simple repairs are needed to bring the safe barrier back to its original condition. It is also a common way to bypass difficult hard plates and glass re-lockers since the change key hole can be scoped by drilling the top, side, or back of the container.

=== Brute force methods ===
Other methods of cracking a safe generally involve damaging the safe so that it is no longer functional. These methods may involve [[Explosive material|explosives]] or other devices to inflict severe [[force]] and damage the safe so it may be opened. Examples of penetration tools include [[acetylene torch]]es, drills, and [[thermal lance]]s. This method requires care as the contents of the safe may be damaged. Safe-crackers can use what are known as jam shots to blow off the safe's doors.

Most modern safes are fitted with 'relockers' (like the one described above) which are triggered by excessive force and will then lock the safe semi-permanently (a safe whose relocker has tripped must then be forced, as the combination or key alone will no longer suffice). This is why a professional safe-technician will use manipulation rather than brute force to open a safe so they do not risk releasing the relocker.

=== Radiological methods ===

Penetrating radiation such as [[X-ray]] radiation can be used to reveal the internal angular relationship of the wheels gates to the flys mechanism to deduce the combination. Some modern safe locks are made of lightweight materials such as nylon to inhibit this technique, since most safe exteriors are made of much denser metals. The Chubb Manifoil Mk4 combination lock contains a lead shield surrounding part of the lock to defeat such attempts to read its wheels.

=== Tunneling into bank vaults ===

Large [[bank vault]]s which are often located underground have been compromised by safe-crackers who have tunneled in using digging equipment. This method of safe-cracking has been countered by building patrol-passages around the underground vaults. These patrol-passages allow early detection of any attempts to tunnel into a vault.

=== Safe bouncing ===
{{see also|Lock bumping}}
A number of inexpensive safes sold to households for under $100 use mechanical locking mechanisms that are vulnerable to bouncing. Many cheap safes use a magnetic locking pin to prevent lateral movement of an internal locking bolt, and use a [[solenoid]] to move the pin when the correct code is entered. This pin can also be moved by the impact of the safe being dropped or struck while on its side, which allows the safe to be opened.<ref>{{cite web|url=https://www.forbes.com/sites/marcwebertobias/2012/07/27/unsafe-gun-safes-can-be-opened-by-a-three-year-old/2/|title=Unsafe Gun Safes Can Be Opened By A Three-Year Old|author=Marc Weber Tobias|work=Forbes}}</ref><ref>{{cite magazine|url=https://www.wired.com/2012/07/gun-safes/|title=Kids Can Open Gun Safes With Straws and Paper Clips, Researchers Say|date=27 July 2012|magazine=WIRED}}</ref><ref>{{cite AV media|url=https://www.youtube.com/watch?v=eOdmMb90YEE |archive-url=https://ghostarchive.org/varchive/youtube/20211212/eOdmMb90YEE| archive-date=2021-12-12 |url-status=live|title=How to break into most digital safe's|date=1 March 2012|work=YouTube}}{{cbignore}}</ref> One security researcher taught his three-year-old son how to open most consumer gun safes. More expensive safes use a gear mechanism that is less susceptible to mechanical attacks.

=== Magnet risk === 
Low-end home and hotel safes often utilize a solenoid as the locking device and can often be
opened using a powerful [[rare-earth magnet]].