Comment On The Key Lock Box

Total number of combinations assuming no repeats (ie 8888) is: 10 * 9 * 8 * 7 = 5040 I know that's not the answer, but its 0:30 am over her...

Inefficient but simple solution in Ruby:

(0..9999).map{|i| "%04i" % i}.join

That's the same system as the door entry on my workplace! I've been wondering how short a sequence would be enough to brute-force it for ages.

No repeats would be a bit strange, why wouldn't there be repeats? Without repeats it would be 10^4 aka 10,000 codes, or 40,000 individual digits.

Assuming the best redundancy possible, the first code will take 4 key presses and each additional keypress will get another combination for 9999 additional codes, that's 10,003 digits bare minimum.

This seems like an interesting challenge. I think it would be useful if we had a program to test a given output to confirm it is correct.

Oops, I meant 'with repeats'.


Also, Frank, I think a person could pick the lock faster than they could enter a code of at least 10,003 digits. Even if they had to learn lockpicking from scratch.

I didn't actually check this but wouldn't you grab a large quantity of possible combinations simply by:

n = total numbers ;
for ( int i = 1 ; i <= n ; i++ )
num = 1 ;
for ( int j = 2 ; j <= n ; j++ )
num = ( num + i ) % n ;

Isn't TRWTF that there's a Thread in the "Coders Challenge" forum here on TDWTF which is about three years old, and covers exactly that problem?

http://forums.thedailywtf.com/forums/t/5824.aspx

I had to block the stupid http://please-support.thedailywtf.com/ subdomain to be able to get to this page... great work, Alex!

π (pi) will open any door.

WITH numbers AS
(SELECT LEVEL - 1 AS num
FROM DUAL
CONNECT BY LEVEL < 11)
SELECT SYS_CONNECT_BY_PATH (num, '-') AS combination
FROM numbers
CONNECT BY NOCYCLE PRIOR num <> num;

...now that's a neat trick!

When I bought my house, someone left one of these (the type was a 4-digit lock where you scroll the individual digits into place and push a button to open it). Knowing that there were only 10,000 possibly combinations I decided to brute force it open (change a digit, push the button, repeat).

It ended up taking about 10 minutes. The correct combination turned out to be my house number! Tried it on another house for sale in the neighborhood... success. (I did not enter the house, just tested the code on the box.) I informed the builder selling the houses and they assured me that they take security very seriously. There wasn't anything in the houses though since they were new.

Planning to rob some houses, are we? ;-)

Vollhorst:

I had to block the stupid http://please-support.thedailywtf.com/ subdomain to be able to get to this page... great work, Alex!

At least he makes it easy for us to block. I now have a filter that blocks anything with "please-support" in the URL because it's obviously going to be an advert or a beg. Screw your livelihoods, website owners!

C# brute force method. Uses string search to avoid duplicates.

        //Brute Force method. Accepts up to 16 buttons

        string CreateLockBoxSequence(uint numberOfDigits, uint numberOfButtons)

        {            

            

            StringBuilder output = new StringBuilder();

            uint numberBase = 10;

            if (numberOfButtons > 10)

            {

                numberBase = 16;

            }

            if (numberOfButtons > 16)

            {

                throw new ArgumentException("Number of buttons cannot be greater than 16");

            }

            uint loopCount = (uint)Math.Round(Math.Pow(numberBase,numberOfDigits));

            for (uint i = 0; i < loopCount; i += numberBase)

            {

                //This loop serves to  omit unused digits.

                for (uint k = 0; k < numberOfButtons; k++)

                {

                    StringBuilder formatBuilder = new StringBuilder();                    

                    string sequence = Convert.ToString(i + k, (int)numberBase);

                    for (int j = sequence.Length; j < numberOfDigits; j++)

                    {

                        formatBuilder.Append("0");

                    }

                    formatBuilder.Append(sequence);

                    sequence = formatBuilder.ToString();

                    //Append if the sequence doesn't already exist

                    if (!output.ToString().Contains(sequence))

                    {

                        output.Append(sequence);

                    }

                }

            }

            return output.ToString();

        }

Addendum (2010-03-31 10:21):
This method produces 10,124 digits for a (4,10) input.

static int buttons = 10;
static int digits = 4;

static void res(List<int> combs, List<int> nums, int digs)
{
int i;
if (digs == 0)
{
for (i = 0; i < digits; i++) Console.Write(combs[i]);
return;
}
for (i = nums.Count -1 ; i >=0 ; i--)
{
int oldnum = nums[i];
combs.Add(oldnum);
nums.RemoveAt(i);

res(combs, nums, digs - 1);
combs.RemoveAt(combs.Count - 1);
nums.Add(oldnum);
}

}

static void Main(string[] args)
{

List<int> comb = new List<int>();
List<int> nums = new List<int>();
for (int i = 0; i < buttons; i++)
{
nums.Add(i);
}
res(comb, nums, digits);
}

Frank:

Quite honestly, this is a ethically questionable code challenge.

You're not only revealing how these lock boxes work (Which, yes, would be commonly available information), but you're announcing "to the world" that they're simple to break into, with a solution to how to do it.

I'm sorry but revealing commonly known information is not "ethically questionable". You seem to be suggesting that this knowledge, whilst widely known, should not be shared. What this amounts to is the real-life version of security by obscurity and we all know where that leads - a false sense of security that may feel nice but doesn't actually protect you in any way.

Sharing common knowledge is NEVER morally questionable. If anything, it is morally questionable to attempt to hide or cover up such information.

1) Bad guys already know. Homeowners should know too so they can make an informed decision about using lock boxes or not.

2) It's not the weakest link. Want to break into a house? Pretend you're interested, take a tour and leave a window unlocked. That'll also give you a chance to see if there's anything worth stealing and if there is an alarm system.

3) You've still got 10,000 or however many combinations there are to go through. This would just show a way to hit them all.

MyKey_:

Inefficient but simple solution in Ruby:

(0..9999).map{|i| "%04i" % i}.join

Similar one in Groovy

(0..9999).each() { printf("%04d", it) }

well, it's a Hamiltonian path around the graph of permutations of length n-1. Perhaps in the morning the name will come to me, or Wikipedia will divulge the answer.

Alex Papadimoulis:

Taking it a step further, the sequence 4-8-2-9-5-1-4-5 would cover the codes 4-8-2-9 8-2-9-5 9-5-1-4 and 5-1-4-5.

... and if your code works as well as this, you can leave out possible combinations... like 2-9-5-1...

new lockboxes used in my area help to prevent the brute force...
http://www.sentrilock.com/lblive/

only the buttons in the right order for the box will open it, 3 wrong tries and it locks out for 60 seconds, and the codes only work for 1 day.

that being said, with the traditional push buttons, the realtor's phone number or the house address are common codes =o(

db48x:

It's not ethically questionable at all. It's far better to encourage people to think critically about the security measures that they employ than it is to try to hide this kind of information. Hiding information never works, those people who would abuse it already have it, while the rest of us need to be sure we understand how the technology around us works.

Just because the information is available, and people are made aware of what the issue is, doesn't necessarily mean they'll change.

It's continually proven (especially to those in IT) that people will do the easiest, fastest, and simplest thing, and if they have routine? That wins over all.

There's a style of personality which fears change, whether it be physical (better lock), or mental (don't keep the house number, or year, as the combination, and change the combo from house to @&^*!$ house for crying out loud! A realtor I deal with has 16 houses for sale, all the same combination)

MichaelM:

Want to break into a house? Pretend you're interested, take a tour and leave a window unlocked.

Or just put a brick through it like everyone else. But considering this was in the context of real-estate, why the hell would you want to break into an EMPTY house anyways?

BillyTheSquid:

Just because the information is available, and people are made aware of what the issue is, doesn't necessarily mean they'll change.

-snip-

A realtor I deal with has 16 houses for sale, all the same combination)

If any of those houses get broken into though, the home owner can then point to this website in establishing the realtor's liability for gross negligence.

Worse, this article is from 2004, though it's for the 5-button car door key pads. However, it references this concept, used to find the solution.

TheKoz:

that being said, with the traditional push buttons, the realtor's phone number or the house address are common codes =o(

The thing with those push button types, even if they've got metal buttons they still tend to wear very slightly with use. So after a while, four out of the ten buttons start to look worn and obviously used. Clearly the combination is made up of these four numbers so you can easily brute force it from this indication. I've used this trick seeveral times (never to break into houses but same principle).

I've seen those things but I don't think I've ever seen a UK estate agent using one. What's wrong with handing a copy of the keys to the estate agent?

Anonymous:

MichaelM:

Want to break into a house? Pretend you're interested, take a tour and leave a window unlocked.

Or just put a brick through it like everyone else. But considering this was in the context of real-estate, why the hell would you want to break into an EMPTY house anyways?

A lot of people, when they sell their house, are still living in it. The realtor shows it while they're at work, then they come home and live in it during the night. I know when I was a kid, the realtor would regularly come by when my brother and I were home from school but my parents hadn't gotten home yet.

Python (probably very naive!):

codeLength = 4

l = []

for i in xrange(0, (pow(10, codeLength) - 1)):

	s = str(i)

	if len(s) < codeLength:

		s = ('0' * (codeLength - len(s))) + s

	l.append(s)

print "".join(l)

meh:

If any of those houses get broken into though, the home owner can then point to this website in establishing the realtor's liability for gross negligence.

Raise your hand if you actually believe that.

Anon Ymous:

The correct combination turned out to be my house number! Tried it on another house for sale in the neighborhood... success. (I did not enter the house, just tested the code on the box.) I informed the builder selling the houses and they assured me that they take security very seriously.

Some blockheads would consider what you did breaking and entering, and some of those blockheads have badges. Be glad the builder wasn't quite that stupid.

It's not limited to key lock boxes: My workplace's electronic locks work that way too (which is good, because I often start by entering the code of the wrong floor)

Likewise. Assuming these things are hung around the front door handle (as Sentrilock's site illustrates them), what's to stop a criminal walking away with the box and taking it elsewhere to physically break open, then stroll back later with the key to let themselves in?

In Mathmatica:

DeBruijnSequence[Range[9999], 4]

But then that's probably too simple.

Frank:

Quite honestly, this is a ethically questionable code challenge.

You're not only revealing how these lock boxes work (Which, yes, would be commonly available information), but you're announcing "to the world" that they're simple to break into, with a solution to how to do it.

Why do I have issue with this? People selling their house have a realtor, who will use lockboxes. For the seller, there's no guarantee that others will use spin-wheel, combination, or push-button lockboxes, and the seller has no say on what will be employed.

You're now telling people how to get a key for doors to houses for people who are selling for one reason or another. Most will not use this information in a negative manner, however, some douche out there will take this information (which might not have been apparent) as an invitation to start ripping people off.

Think about it - you're selling your house. You're not home most of the time (Work), and neighbours are used to seeing people coming and going into your home. And then you find a website which is announcing a contest, for fun, on how to get a key for your house.

Strike anyone else as questionable / bad idea? Tinfoil hat wearer I'm not, I just have issues with other people's ethics (Such as the dick who did this to a friend some months ago)

Nice Troll

Total number of key presses is 10¨4 + 3 = 10003 (length of the De Bruijn sequence B(10,4))...

TRWTF is that these devices are used at all.

What's wrong with the access control system called "give a copy of the key to the realtor, and they keep it at their office when they're not showing the property"?

Anonymous:

MichaelM:

Want to break into a house? Pretend you're interested, take a tour and leave a window unlocked.

Or just put a brick through it like everyone else. But considering this was in the context of real-estate, why the hell would you want to break into an EMPTY house anyways?

I purchased a home recently, and I can say that 2 of the ~50 homes I toured were empty. More common than empty homes were homes with the people at home watching TV. Most homes still contained major appliances and other valuables(big screen TV, personal PC, video game systems, jewelry, etc.). In several cases, the only thing preventing someone from walking off with a fistful of gold was honesty.

Of course, the weakest link point still stands. You can learn lockpicking on your iPhone from the back door (typically not secure-locked) quicker than you can brute-force the entry code.

One brand of mechanical pushbutton lock I have encountered has the "any order" flaw combined with a "5 digit code always contains 678" flaw, leading to a *really* easy brute-force.

I'd never use this for evil but I have real trouble restraining myself from trying out of curiosity.

This should be it:

0000100020003000400050006000700080009001
1001200130014001500160017001800190021002
2002300240025002600270028002900310032003
3003400350036003700380039004100420043004
4004500460047004800490051005200530054005
5005600570058005900610062006300640065006
6006700680069007100720073007400750076007
7007800790081008200830084008500860087008
8008900910092009300940095009600970098009
9010102010301040105010601070108010901110
1120113011401150116011701180119012101220
1230124012501260127012801290131013201330
1340135013601370138013901410142014301440
1450146014701480149015101520153015401550
1560157015801590161016201630164016501660
1670168016901710172017301740175017601770
1780179018101820183018401850186018701880
1890191019201930194019501960197019801990
2020302040205020602070208020902110212021
3021402150216021702180219022102220223022
4022502260227022802290231023202330234023
5023602370238023902410242024302440245024
6024702480249025102520253025402550256025
7025802590261026202630264026502660267026
8026902710272027302740275027602770278027
9028102820283028402850286028702880289029
1029202930294029502960297029802990303040
3050306030703080309031103120313031403150
3160317031803190321032203230324032503260
3270328032903310332033303340335033603370
3380339034103420343034403450346034703480
3490351035203530354035503560357035803590
3610362036303640365036603670368036903710
3720373037403750376037703780379038103820
3830384038503860387038803890391039203930
3940395039603970398039904040504060407040
8040904110412041304140415041604170418041
9042104220423042404250426042704280429043
1043204330434043504360437043804390441044
2044304440445044604470448044904510452045
3045404550456045704580459046104620463046
4046504660467046804690471047204730474047
5047604770478047904810482048304840485048
6048704880489049104920493049404950496049
7049804990505060507050805090511051205130
5140515051605170518051905210522052305240
5250526052705280529053105320533053405350
5360537053805390541054205430544054505460
5470548054905510552055305540555055605570
5580559056105620563056405650566056705680
5690571057205730574057505760577057805790
5810582058305840585058605870588058905910
5920593059405950596059705980599060607060
8060906110612061306140615061606170618061
9062106220623062406250626062706280629063
1063206330634063506360637063806390641064
2064306440645064606470648064906510652065
3065406550656065706580659066106620663066
4066506660667066806690671067206730674067
5067606770678067906810682068306840685068
6068706880689069106920693069406950696069
7069806990707080709071107120713071407150
7160717071807190721072207230724072507260
7270728072907310732073307340735073607370
7380739074107420743074407450746074707480
7490751075207530754075507560757075807590
7610762076307640765076607670768076907710
7720773077407750776077707780779078107820
7830784078507860787078807890791079207930
7940795079607970798079908080908110812081
3081408150816081708180819082108220823082
4082508260827082808290831083208330834083
5083608370838083908410842084308440845084
6084708480849085108520853085408550856085
7085808590861086208630864086508660867086
8086908710872087308740875087608770878087
9088108820883088408850886088708880889089
1089208930894089508960897089808990909110
9120913091409150916091709180919092109220
9230924092509260927092809290931093209330
9340935093609370938093909410942094309440
9450946094709480949095109520953095409550
9560957095809590961096209630964096509660
9670968096909710972097309740975097609770
9780979098109820983098409850986098709880
9890991099209930994099509960997099809991
1112111311141115111611171118111911221123
1124112511261127112811291132113311341135
1136113711381139114211431144114511461147
1148114911521153115411551156115711581159
1162116311641165116611671168116911721173
1174117511761177117811791182118311841185
1186118711881189119211931194119511961197
1198119912121312141215121612171218121912
2212231224122512261227122812291232123312
3412351236123712381239124212431244124512
4612471248124912521253125412551256125712
5812591262126312641265126612671268126912
7212731274127512761277127812791282128312
8412851286128712881289129212931294129512
9612971298129913131413151316131713181319
1322132313241325132613271328132913321333
1334133513361337133813391342134313441345
1346134713481349135213531354135513561357
1358135913621363136413651366136713681369
1372137313741375137613771378137913821383
1384138513861387138813891392139313941395
1396139713981399141415141614171418141914
2214231424142514261427142814291432143314
3414351436143714381439144214431444144514
4614471448144914521453145414551456145714
5814591462146314641465146614671468146914
7214731474147514761477147814791482148314
8414851486148714881489149214931494149514
9614971498149915151615171518151915221523
1524152515261527152815291532153315341535
1536153715381539154215431544154515461547
1548154915521553155415551556155715581559
1562156315641565156615671568156915721573
1574157515761577157815791582158315841585
1586158715881589159215931594159515961597
1598159916161716181619162216231624162516
2616271628162916321633163416351636163716
3816391642164316441645164616471648164916
5216531654165516561657165816591662166316
6416651666166716681669167216731674167516
7616771678167916821683168416851686168716
8816891692169316941695169616971698169917
1718171917221723172417251726172717281729
1732173317341735173617371738173917421743
1744174517461747174817491752175317541755
1756175717581759176217631764176517661767
1768176917721773177417751776177717781779
1782178317841785178617871788178917921793
1794179517961797179817991818191822182318
2418251826182718281829183218331834183518
3618371838183918421843184418451846184718
4818491852185318541855185618571858185918
6218631864186518661867186818691872187318
7418751876187718781879188218831884188518
8618871888188918921893189418951896189718
9818991919221923192419251926192719281929
1932193319341935193619371938193919421943
1944194519461947194819491952195319541955
1956195719581959196219631964196519661967
1968196919721973197419751976197719781979
1982198319841985198619871988198919921993
1994199519961997199819992222322242225222
6222722282229223322342235223622372238223
9224322442245224622472248224922532254225
5225622572258225922632264226522662267226
8226922732274227522762277227822792283228
4228522862287228822892293229422952296229
7229822992323242325232623272328232923332
3342335233623372338233923432344234523462
3472348234923532354235523562357235823592
3632364236523662367236823692373237423752
3762377237823792383238423852386238723882
3892393239423952396239723982399242425242
6242724282429243324342435243624372438243
9244324442445244624472448244924532454245
5245624572458245924632464246524662467246
8246924732474247524762477247824792483248
4248524862487248824892493249424952496249
7249824992525262527252825292533253425352
5362537253825392543254425452546254725482
5492553255425552556255725582559256325642
5652566256725682569257325742575257625772
5782579258325842585258625872588258925932
5942595259625972598259926262726282629263
3263426352636263726382639264326442645264
6264726482649265326542655265626572658265
9266326642665266626672668266926732674267
5267626772678267926832684268526862687268
8268926932694269526962697269826992727282
7292733273427352736273727382739274327442
7452746274727482749275327542755275627572
7582759276327642765276627672768276927732
7742775277627772778277927832784278527862
7872788278927932794279527962797279827992
8282928332834283528362837283828392843284
4284528462847284828492853285428552856285
7285828592863286428652866286728682869287
3287428752876287728782879288328842885288
6288728882889289328942895289628972898289
9292933293429352936293729382939294329442
9452946294729482949295329542955295629572
9582959296329642965296629672968296929732
9742975297629772978297929832984298529862
9872988298929932994299529962997299829993
3334333533363337333833393344334533463347
3348334933543355335633573358335933643365
3366336733683369337433753376337733783379
3384338533863387338833893394339533963397
3398339934343534363437343834393444344534
4634473448344934543455345634573458345934
6434653466346734683469347434753476347734
7834793484348534863487348834893494349534
9634973498349935353635373538353935443545
3546354735483549355435553556355735583559
3564356535663567356835693574357535763577
3578357935843585358635873588358935943595
3596359735983599363637363836393644364536
4636473648364936543655365636573658365936
6436653666366736683669367436753676367736
7836793684368536863687368836893694369536
9636973698369937373837393744374537463747
3748374937543755375637573758375937643765
3766376737683769377437753776377737783779
3784378537863787378837893794379537963797
3798379938383938443845384638473848384938
5438553856385738583859386438653866386738
6838693874387538763877387838793884388538
8638873888388938943895389638973898389939
3944394539463947394839493954395539563957
3958395939643965396639673968396939743975
3976397739783979398439853986398739883989
3994399539963997399839994444544464447444
8444944554456445744584459446544664467446
8446944754476447744784479448544864487448
8448944954496449744984499454546454745484
5494555455645574558455945654566456745684
5694575457645774578457945854586458745884
5894595459645974598459946464746484649465
5465646574658465946654666466746684669467
5467646774678467946854686468746884689469
5469646974698469947474847494755475647574
7584759476547664767476847694775477647774
7784779478547864787478847894795479647974
7984799484849485548564857485848594865486
6486748684869487548764877487848794885488
6488748884889489548964897489848994949554
9564957495849594965496649674968496949754
9764977497849794985498649874988498949954
9964997499849995555655575558555955665567
5568556955765577557855795586558755885589
5596559755985599565657565856595666566756
6856695676567756785679568656875688568956
9656975698569957575857595766576757685769
5776577757785779578657875788578957965797
5798579958585958665867586858695876587758
7858795886588758885889589658975898589959
5966596759685969597659775978597959865987
5988598959965997599859996666766686669667
7667866796687668866896697669866996767686
7696777677867796787678867896797679867996
8686968776878687968876888688968976898689
9696977697869796987698869896997699869997
7778777977887789779877997878797888788978
9878997979887989799879998888988998989999
000

Anonymous:

TheKoz:

that being said, with the traditional push buttons, the realtor's phone number or the house address are common codes =o(

The thing with those push button types, even if they've got metal buttons they still tend to wear very slightly with use. So after a while, four out of the ten buttons start to look worn and obviously used. Clearly the combination is made up of these four numbers so you can easily brute force it from this indication. I've used this trick seeveral times (never to break into houses but same principle).

You can even break into a new one pretty easily - because the mechanism is pretty cheap, and the stresses are uneven, your can apply tension (by pushing down on the 'open' button) and feel which pin is next.

I figured this out just by playing with one that was lying around for about 15 minutes, and after that, it took me just a couple of minutes to open any other one I came across. Strictly in the spirit of inquiry, of course.

People trusting their house keys to these cheap lock boxes is TRWTF.

How many internets do you win for a solution without any code?

http://www.hakank.org/comb/debruijn_k_10_n_4.html

Yeah, lockboxes aren't very secure. When I was shopping for my home, my real estate agent couldn't open the lock boxes because her nails were too long, so she asked me to open them for her. I quickly realized that all the lockboxes in the city had the same combination.

I worked as a consultant at an office that had a lock like this, requiring 3 digits. They were broken into, so they changed the combo. I had to come in on Saturday, and forgot the combo. So I tried 1-2-3 (try); 1-2-4 (try) ... It took about 5 minutes to open the door. Since it was Saturday, there was no one wandering the halls. I could have broken into any other office on the floor in the same 5 minutes.

These locks provide a sense of security, not actual security.

Yes, they are for convenience not security. The father in-law has a realty license and does the occasional transaction. The boxes around here have a wheel with letters on it. The combination is usually S-A-L-E and we confirmed this was the case about 80% of the time when he was arranging showings for us.

The occupant is expecting visitors escorted by an agent. The occupant then often secures those valuables that are easy to make off with.

That particular model lock box is super easy to open! Did this myself while I was a kid when I lost my key and my parents were selling the house.

Just put pressure on the release latch and gently prod each of the buttons. The buttons that are loose are not part of the combination. The others are, and it's not so much a sequence of numbers as it's a set of toggles. Release the latch, push all "stiff" buttons, push no "loose" buttons, and the latch will simply open.

I must break you.