Hacker News Reader

Comment by olalonde | Hacker News Reader

If the combination does allow for wiggle room and the 1 in 8000 figure is correct, the code could have been brute forced in a couple hours. Source: my wife has a habit of forgetting the combination to her 3 digit luggage lock and I had to brute force it a few times (it's surprisingly quick, about 15 minutes) :)

View on HN

Did I ever tell you the story of how I had to break into the office of the Team Chief of the Logistics Readiness Center inside of the National Military Command Center in the Pentagon?

He had forgotten his briefing slides when he was about to go give an update on all logistics operations for the Chairman of the Joint Chiefs of staff, and he heard the door click behind him.

He had five minutes. He got there in time, with his briefing slides. I then told the Executive Officer of the Day what the combination was, and informed them that they probably needed to change that combo since I now knew what it was.

Ironically, I ended up going through all possible combinations without success. That's when I was told that I was turning the doorknob the wrong way, and I had to start over. It didn't take too long from there.

I had this in university - when I started some documents I needed were delivered to my uni mailbox which was guarded by a code, but we weren't due to get our code until we had completely "matriculated" (signed in, got our IDs, etc). So I just sat down with a couple of beers and set out out to try all 9999 combinations (it was thankfully in the 2000s or so).

Made me realise that my university mailbox wasn't actually that secure ...

Ok, here’s one for you. This is almost too painful to repeat it’s so bad. When I went to college, the university implemented at 4 digit prefix that students would use when dialing from a campus phone so they could charge long distance calls directly to their university bill. With only 9999 numbers allocated to 6000 students, it was comically simple to use a random number and make that long overdue call to mom.

Right. It lasted a month before it was scrapped.

In the town I live, there was an incident a few years ago with a teenager who got access to his mother’s handgun. She had the gun in a gun safe, with a four digit combo. The teen came home every day after school and started brute-forcing the password. 0000, 0001, and so on. He was determined and patient, and it worked.

https://www.pantagraph.com/news/local/crime-and-courts/teen-...

Some of these 3-digit locks are so simple/bad one can actually just see the open slot on each ring. After which you just have to align them. If that fails, some of them have just enough space so you can put something thin (like a needle with a bent end) and can feel where the slot is. Usually faster than brute forcing.

We used to do this for amusement with each other's 3-5 tumbler ski locks on the rides to races. It wasn't even brute force, just exploiting weaknesses in the manufacturing

The most useful trick was to put a bit of tension on the lock cable while turning the tunblers. Once we got a feel for it, we could often open unfamiliar locks almost as fast as if we had the combination, and didn't even have to look. You could just feel the gap slip into place.

The good thing about normal combination locks is that you can try all combinations sequentially with minimum movement.

  000 start
  001 1 move
  002 1 move
  ...
  008 1 move
  009 1 move
  019 1 move
  018 1 move
  ...
  011 1 move
  010 1 move
  020 1 move
  021 1 move
  ...

and so on.

I feel like saving 1 move in 10 (9 to 10 is 2 moves, 10 to 11 is back to 1 move) is not worth the mental capacity required to remember current up/down direction. Easier to let the muscles do the work and let your mind wonder.

That's a good point, though I do think that it's not that big of a mental hurdle. Consider knitting, for example.

That sounds similar to the concept of Gray code [0].

For electronic locks, there is a similar method that allows you to try a 4-digit code for each key press [1].

[0] https://en.wikipedia.org/wiki/Gray_code [1] http://alvaray.org/brute-forcing-pincode-keypads-using-combi...

Yup, that's the general idea I also had in mind.

Those "try all n in shortest combination" sequences are called De Bruijn sequences in general.

https://en.wikipedia.org/wiki/De_Bruijn_sequence

These codes have been used to break wireless garage door openers in comically little time: https://samy.pl/opensesame/

In practice 009 to 010 is a single move, because your thumb can cover and turn two or more wheels at once.

> Source: my wife has a habit of forgetting the combination to her 3 digit luggage lock

Luggage locks are notoriously easy to open just by listening to them carefully while you try to force them open and slowly turn each digit.

I bruteforced a 4-digit 2FA in 2 days, of course with the help of a small script instead of trying it myself. It's always fun to see dumb solutions work.

if it works, it's not a dumb solution :)

It is if olalonde doesn't want to have to break into his wife's luggage every couple of weeks...

"If it's stupid and it works, then it's not stupid" — my motto

Rephrasing for brevity: "Nothing stupid works."

I took two things away from my AI class.

1) If brute force doesn't work, you're not using enough.

2) Do the stupid thing first.

Reminds of things my dad would say about mechanical work...

"Use a bigger hammer". "If it jams, force it. If it breaks, it was going to break anyway".

I brute-forced a 32-bit random number generator in an internet worm, back in the day[1]. Brute force is underrated.

[1] http://www.icir.org/vern/papers/witty-imc05.pdf

Did you vary your code, or just try the same code until it was the correct one?

Would they have known about the wiggle room without opening the safe, though? I figured they found this out after inspecting the lock once the safe was open. So if they didn't know about this wiggle room -- or know what amount of wiggle was allowed -- could they have benefited in any way?

Article said they looked up the default combos previously, so they must know the brand and model. That's probably all that's needed to lookup the wiggle room.

Hahah I really appreciate the effort you put in with that

You are a statistically patient outlier. (however, maybe not on hacker news)

Reply on news.ycombinator.com