Safelock Systems Ltd is a trade distributor of locks for safes, stocking a range of products from leading manufacturers such as LA GARD, dormakaba and Tecnosicurezza. Director Jasmine Hunt-Brown tells us about a recent hot topic amongst security and insurance professionals.
I’ve got a secret code to get into your safe…
Ok, that’s not strictly true. We are not intending to go rogue and pilfer the contents of the nation’s safes!
There can be no secret or hidden codes in safe locks certified to EN 1300, which form the majority of our lock portfolio, and which are the only locks that can be used on safes certified to EN 14450 or graded to EN 1143-1 or EN 1143-2, or LPS 1183.
What we do have, is detailed knowledge of all the default codes used on all the electronic safe locks that we supply, and it is becoming more and more apparent that this would provide us with very easy access to many safes installed across the country.
Changing default codes
The issue arises because safe lock users are not changing the default codes that the locks are supplied with, which in practical terms, is the same as leaving the safe door open, and inviting the burglar in for a cup of tea. Any villain can obtain default codes simply by searching the internet or perusing our website, where the information is freely available in user operating manuals.
PSTI
Currently a Bill for new legislation is journeying through Parliament – the Product Security and Telecommunication Infrastructure Bill – which will, amongst other things, ban the use of default passwords on internet connectable devices, with significant fines for non-compliance by manufacturers. This is to protect against vulnerabilities that have historically allowed cyber-criminals to target certain products, such as routers or baby monitors.
EN 1300
The above legislation will not apply to non-internet-connectable devices like most safe locks, and as such there is no mechanism to prevent default codes from existing. The EN 1300 standard specifies that manufacturers must include in their operating instructions the notes below:
- The factory code shall be changed…
- No simple codes which are easy to guess should be chosen for coding…
- No personal data…should be used for coding…
However, the standard does not currently prevent a default, or ‘factory’ code from existing. Some locks on the market have a default code, others are supplied in factory condition so that they open when button 1 is pressed, and the lock must be activated either using the keypad or with software to use a full-length code. Pressing 1 in this instance is effectively a default code.
Realistically, it would not be appropriate to disallow default codes, there must exist a hierarchy of users, and there must be a starting point, whether that is the number 1 or the code 123456.
Manufacturers are however, starting to address changing codes in newer locks, such as in the 700 Series.
Forced code changes
Currently, on a 700 Series lock, when a new Manager or User is added to the lock, their code is not valid to open until it has been changed.
Lock code hierarchy
Whilst forced code changes for Users can manage the security implications of default opening codes, there still exists a risk with default codes set for other users. A proud new safe owner may be given an opening code of 123456, dutifully change it to something secure, but neglect to change the other default codes that might exist in the lock.
In many safe locks available on the market, there are Users who can open, and other users, often referred to as Master / Manager / Administrator, who perform other tasks.
In some instances, such users can open the lock. In many instances, the Master cannot open, but has the ability to create a subordinate user code who CAN open the lock. This is often referred to as ‘Manager Management’.
This ability is, in effect, an opening code because it has the power to create an opening code.
It is vital to advise safe lock owners that all default codes must be changed, including any listed Master or Manager codes. In situations where a service company holds top-level codes as part of their service contract, the code should be unique to each site.
Sharing codes
Whilst we are on the subject, it also seems that many users of electronic safe locks are sharing codes.
Perhaps this is inherited from the use of mechanical safe locks where only one code can exist, which might be the cut of a key or the numerical code for a mechanical dial combination lock.
One of the main advantages of electronic safe locks, is that they offer multiple codes and an audit facility to trace who has accessed the lock. If multiple users need to access a safe, then a lock with multiple codes should be selected so that each user can have their own code, and the audit accurately represents who has opened the safe.
Easy management
Management of the safe lock is far easier when users have their own codes. If one person leaves, only their code needs to be deleted, rather than changing the shared code for all.
Preventing lockouts
Users having their own code also protects against lockouts. Where a single opening code is shared, any person who knows the code has the ability to maliciously change the code and therefore prevent access to the safe by others.
Keypad wear
In the movies, we see the villain using a fingerprint duster to work out the code by dusting the keypad’s buttons. In real life, the use of shared codes, or codes which are never changed, will inevitably result in wear to the buttons over time, providing a permanent clue as to the composition of the code.
Easy to guess
We all do it, but using birthdays, phone numbers, any personal information, or a code pattern based on the orientation of the buttons, is highly inadvisable. Common 4-digit codes used for our smart phones are 1234, 0000, 2580, 2512, 1111, 5555. The most common 6-digit codes are 123456, 654321, 111111, 000000, 123123, 121212, 112233, 789456.
Penalty
The ‘penalty’ in an electronic safe lock is a period during which the lock cannot be operated, which is initiated by the entry of four incorrect codes. This security measure is intended to prevent brute-force attacks where burglars try to guess at the code. It does not however protect against the use of easy-to-guess codes or codes related to personal information.
Code expiry
Some locks in our portfolio have a code expiry function, which can mean either; that if a code is not used for a set (configurable) period, it self-deletes, OR that a user is forced to change their code after a set (configurable) period.
In conclusion
Default codes should be changed immediately, codes should not be shared, and codes should not be easy to guess or work out. When the code is changed, the safe door should be in the open position.
Our website has user operating instructions for every lock we supply, which include the procedures to change code. Over time, we are adding ‘How to change code’ videos to our You Tube channel, so there really is no excuse! Do it now!
Safelock Systems Ltd.
Tel: +44 (0)20 8949 1005
Email: sales@safelocksystems.com
Web & online store: safelocksystems.co.uk