Kidde Combination Key Boxes
Вставка
- Опубліковано 17 тра 2020
- Let's be honest, the market for residential key boxes is... not great. Products tend to be kind of iffy, and often they can be decoded or bypassed with ease. However, while it is not the absolute strongest unit on the market, I was impressed with this little design that Kidde/Supra has been quietly putting out on the market for years. Let's have a look under the hood and see how it works and whether there might be any ways to exploit it!
- -- ----- ----------
this is my personal web site. most things i create wind up online...
deviating.net
this is my company. we're good at stuff...
enterthecore.net
this is where i train. come and learn badass skills...
redteamalliance.com
- -- ----- ----------
Thank you for this video. Every picker loves showing how bad most keyboxes are and how easy they are to decode with no tools or trash laying around, but nobody ever makes a recommendation for one that's actually worth buying
I had purchased one of these almost 10 years ago and discovered it as I was preparing to move. Being more aware of locks and safety since then, I scouted around for videos about it and was surprised to hear your voice when I clicked on this link.
Glad to see even a decade ago my purchases were the least craptastic.
I'm pretty sure the default combo SPI is because they're assembled in South Padre Island.
i never knew that!
I was there last week but I didn't see them. Ur joking rite?
@@fredred8371 No joke. Can't remember where I heard it from.
the lever also drops further on the correct gate vs the false ones. make a line below the bottom of travel, toss a mechanical pencil line below it, any gate that allows the lever to go below your line is correct.
Now lets see what lockpicking lawer can do
not only was this fantastic,most safes use this, but you are my moment of zen , thx
That was an excellent video
I can’t wait to see the follow up on it
Thank you
With how wide those gates are you might be able to be 1 letter past and still have it count in which case if you were to attempt to brute force the combo you could cut your load in half and then add the decoding the last letter to make it even faster
exactly
Or you could just try S-P-I 🙄
The gate is about 1.5 letters wide. The gate in the wheel could be 1/2 of the wheel diameter and still require accurate dialing if the fence is thick enough. Dialing every letter off by one may or may not get the lock open depending on how accurate you were.
Thank you SO much for making this video. This is very helpful.
Dingle peninsula is an amazing place! Gorgeous scenery and lovely people.
@@brenryan1 It is indeed! But Kerry is not a million miles from Cork.
right... we bought the whiskey there because it's popular in many shops in Western Ireland. =)
Wow looks like a triple thumbs up! One for you Sr for the education, an other one to you for the effort and work you've done to make this video and of course a thanks to this company that made a good product and did so intentionally.
Recently tried a bottle of West Cork. Decent stuff. Really enjoying Jameson Cooper's Croze.
Cute. I wouldn't want a key box but I like the way they look.
The biggest problem I've seen with this style is most people don't turn the dial after locking or only turn 1/4 turn, thus you can turn dial back to last letter and it open right up, then uncover the back and you have the combo.
Have two of the Supra key boxes that use the 10 button design. I would assume its is of the lower security of their boxes. Its ok since I kept this box in a discrete location in the garage. Keypad to open the garage was modified so that only the keypad and its matrix of wires was in a weatherproof box outside and the electronics box were inside the garage in a safe location. External box was equipped with an instant tamper and with a shock sensor as well.
Sounds like a nice setup
When I saw this pop up in my email I was like "YES!!! Dev cracked it!!!" (cause I've been trying for a while)
I have a fair amount of vacation rental management companies as customers (well, I mean I did before "the 'rona", we'll see what happens going forward) and this is the box I recommend they use when the property owner wants to use a key box instead of the preferred hardware (A Kaba Eplex usually)... and it's mostly because, I STILL have YET to figure out a way to crack the damn thing without killing it...
I've known about the last wheel hack for a while, as well as the default code, but have YET to open one with anything but brute force.
Can it be manipulated? Probably, but the rental company, (and especially the property owner) don't want to pay for a SAVTA certified safeman who does manipulation's time for IDK, 2+ hours? or so..... (hell most of them complain about MY after REGULAR hour's prices)
Can it be busted? Yeah, and it can be done professionally looking (one drill point) and honestly doesn't take long if you know how.
BUT... It's actually a damn good little keybox, especially compared to pretty much everything else on the market.... Yeah, for the money, it's not bad.
Very informative video thanks👍
"This jawn over here..."
Your Philly is showing.
Assuming I'm doing the right math, figuring out the last letter does bring the total possible combinations down from 17,576 to 676, which is a crap ton easier to brute force if it really came down to it. Would still be a terribly un-fun time.
see my other comment above. because of the wide gates, it's really only a brute force of 256 combinations in a perfect sense. and if you're likely to hit it within 50% of the attempts, that's a 20 minute process possibly.
@@DeviantOllam also most combo's have atleast 1 vowel in it and more then likely the 2nd turn is going to always be the vowel unless its not a word and abv. or words like the ect...
@@DeviantOllam 20 minutes for a keysafe sounds a lot better than most actual locks in the front door!
Haha, damnit Dev... I just saw this. I'd planned on shooting a video of this in a couple weeks when I was done with my class. Myself and another Oak City Locksport member determined we couldn't crack it due to the false gates. At least you can reduce the key space. Even made a cutaway metal plate to demo this.
I'm not sure I should be touching any of this. Wouldn't want to be branded a Kidde Fiddler :/
the housing is metal but aren't the code wheels plastic? I guess "not immediately obvious destructive entry" would be to push on the lug*... while heating it up xD make some extra gates in there xD
*obviously with a screwdriver or something to avoid burning fingers
Saw an interesting video by Potti314 yesterday forbidden numbers cool stuff
The default combination is SPI, since they were originally made by Supra Products Inc.
Assuming that the mile wide true gates got fixed, would the false gates be more effective if they were irregularly spaced with different widths?
Can you modify the code wheels so the real gate is similar to the false gates and vice versa?
You might be able to 3D print a new wheel with staggered gates or you could widen the false gates, yes
From an engineering standpoint, these are way better than any of the 4 wheel style locks. What would you recommend for a solution that doesn't break the bank if you need to keep a key at a property?
Hey Deviant not only the base housing is the same even the top housing is cast in the same style. The only think that's missing to make them interchangeable are probably the threads for the screws in the black top housing...
Found two broken open key boxes behind a grocery store. Did they go back to break in the properties? Probably.
I keep hearing 'Kitteh'... Sorry Deviant, wife has two cats...😂😂
Well shoot. I just got this after reading reviews that this was one of the better key locks. Do you have a good recommendation? I just want an actually strong lock box! Every one I come across has huge flaws in it.
Does the partial gate keep the rings in the fence to prevent them sliding out of alignment without requiring a tensioning spring to hold them? Or why was a partial gate used instead of a fully cut out gate? Prevents warping as the plastic cools during manufacturing by supporting the gap?
Could be many reasons. I don't know for sure
Manufacturing and alignment concerns sounds likely. It also keeps folks from installing the code wheels backwards.
isnt it so that you can print the letters on the whole wheel?
Omg thanks!!!🙏
How many users will set it to KEY?
Hah, probably a very non-zero number.
Hey Deviant, I love your channel and watch LPL and others and was wondering what your suggestion for house security would be?
i did a five-video series about this maybe a couple weeks ago
DeviantOllam Yes I watched all five videos. So primus and a system like that for a house. Alright Thanks, I love all of your talks and have watched most of them at least twice. Just watched your new video, I understand how u could be annoyed with all this I am too. Have a great day, or as good as it can be right now
Hey you should review the minterbox
5:56 for all of you who are like me and wanted to know how to change the code.
Love all your shit. Curious why you didn't try to decode first 2 wheels, given the comment about the true gate going slightly deeper. I bet you coulda popped it.
You have to decode the 2 remaining wheels with a method that's logically safe lock graphing. It gets tedious pretty fast. Considering that the input lever to move the fence is not the most exact thing ever, it might be hard to measure the fence level correctly if Kidde/Supra did good work and the fence has close enough match for both the 2 remaining wheels.
The gates are wide enough to be +/- one letter on either side. So you can go through the whole alphabet in 9 tries. If you know the last letter already, then it's at most 9x9=81 attempts for a low-skill attack.
Knowing that people are likely to have used an existing three letter word could help to make it quicker by trying those first. Would be pretty easy to write a small program that you could run on your phone where you enter the last letter and it tells you which combinations to try in order. Of course deduplicating away any words that are so close together that there is no need to try both. Bonus points for using Google Ngrams or similar to further prioritize based on word popularity 😉
@@mlenstra You'd want to include 4 and 5 letter words with 3 consanants. Long gone IT manager at a former employer used to keep server room keys in one of these and used FSH because he liked to fish. A friend raced pigeons and their bird coup was locked with BRD.
indeed... and also, if the last letter is known, and if it's possible to skip every other letter because of wide gates, that really only makes for 256 combinations needed for brute forcing at that point.
figure that, over time, you're likely to hit the "real" combination maybe 50% of the way through the process. and maybe dialing combinations can take place in under 10 seconds per attempt (that's even being a bit generous on my part)
that would mean that, on average, a brute force is possible in under 20 minutes. and, of course, it can be distributed out... attempt a dozen times while having a stroll around the building, and after 5 or 6 strolls and brief stops by the box, you've got a fighting chance of having discovered it.
I've done the manipulation on one or two of these.
Thank you for the useful and interesting video!
Also just FYI it's pronounced "Kid-eh" not "Kid-ee" :)
Thanks again!
Now we are going to see this on their advertising. "The least craptastic consumer grade locks."
Product seems to be branded Kidde, not Kiddie
Yeap...I should correct that :)
If the lug is metal and gates are plastic, won a hammer be able to smash it? Either the gates of the prongs?
Easier to just pry the face off with a screwdriver. The point of decoding is to covertly access something.
The only interface to the fence is that small plastic switch-like protrusion and if Kidde did their design correctly, the arm that holds that thing is weaker than the plastic wheel. You can execute denial-of-service attack by hitting the dial or the swich off the face.
The box, and the cover are all metal. It will be pretty hard to pry it off with a screwdriver.
@@MikkoRantalainen I see, that makes sense
Just some googling found this:
"Kidde Lock Box, Mortise, 5 Key Capacity, Mounting Type: Surface"
They have it going for them.
ah yes, the Kidde model 534
I have a similar box but the dial is replaced with mechanical push buttons, I don't know what its weakness is I do know that it can't be shimmed. I need a lock box for the kids but everything's such low quality. Why can't I find a high security lock box that is harder to open than my front door?
Knox box is crap because the municipal master keys are out in the wild and there is no accountability for lost keys.
The variant with multiple buttons is crap. You can try to push the opening switch and while holding it, any button that's bind is part of the combination. As Dev said, this is the least-crappy product the market has or ever had (I did my research about 5-8 years ago and ended up getting this exact box thinking it was the least-crappy thing that does exist).
"This is the least crap-tastic ... of the consumer grade ones I have found" = Closest you're gonna get to an endorsement from Dev.
How to open sackle
This is great, thanks for making this. I was just watching a video on the basics of safe manipulation last night (ua-cam.com/video/4A-p_sCqq8M/v-deo.html). I picked up this exact lockbox about 6 months ago solely because it didn’t seem like it could be easily decoded like the Master and knockoff combination boxes. Nice to know that not only was it not a complete waste of money as a lock box, it can also be used to understand safes. Looking forward to future videos on this. Thanks again!
So... you're just saying a little plumbing torch would have it open in approximately 20 seconds?
If you want to go destructive, yeah. That could indeed work.
But what if the keys inside are made of safety chocolate?
I was thinking the same thing when I saw that the wheels were plastic
This is an example of a case where having 3D printed keys would be benificial - if you had 3D printed key in the box, any attack that goes for the plastic inside the lock would also destroy the key.
If I saw a last letter of X I'd probably think EAX, EBX, ECX, RAX, RBX, etc. x86_64 register names.
Unless you're attacking a fellow geek, those are not the options that most people go after.
5:20 ooohhh no.... you can bind them can't you..
If I need to get to a spare key, the first 3 letters that come to my mind is FUK.
do the demo using the gray box, not the black one.
yeah... the lighting would have been better possibly. (i was lazy and didn't opt to back out the screws)
the internal parts are all still black, however.
You could hold the clear plate with screws though. That'd make it easier to put it in a small vice and maybe get a small LED light inside the box. A dab of whiteout on the black parts could be used to make relative motion easier.
@@pcoueffin wow that sounds like a lot of effort. I could see attempting it, but I've got a lot of work to do around the bed.
@DeviantOllam Why don’t you design fixes for companies? I’m sure they would pay you greatly for your knowledge. Ie this video... Make your false gates truer, three or four that shows the same as your true gates. But all in all, locks are just to keep the honest people honest. Right?