A look at and teardown of three different types of Australian made high security Ross safe locks.
Ross 700 high security key lock
Ross 1000 Electronic keypad lock
Ross 1000 Bluetooth lock
https://rosslocks.com.au/
Part 2: More info, teardown of a TUVS Cablox 6 lever key design, and retrofitting an existing Guardall safe: https://www.youtube.com/watch?v=gsfDx7B9sks
BONUS video: Key safe lock comparison: https://www.youtube.com/watch?v=7xF1RCVw4Fc
00:00 - Mailbag
01:32 - Three different types of safe locks
05:54 - Which lock type is best?
06:59 - Visual and thermal attacks on Keypad locks
08:14 - Ross 700 High security 9 lever safe key lock Teardown!
11:35 - Ross 1000 series Keypad lock Teardown!
16:41 - Ross 1000 series Bluetooth Lock Teardown
17:32 - Magnetic attack?
18:08 - Gallium lock attack
Forum: https://www.eevblog.com/forum/blog/eevblog-1509-the-art-of-high-security-safe-locks/
Support the EEVblog on:
Patreon: http://www.patreon.com/eevblog
Odysee: https://odysee.com/ @eevblog:7
Web Site: http://www.eevblog.com
EEVblog2: http://www.youtube.com/EEVblog2
EEVdiscover: https://www.youtube.com/eevdiscover
AliExpress Affiliate: http://s.click.aliexpress.com/e/c2LRpe8g
Buy anything through that link and Dave gets a commission at no cost to you.
Donate With Bitcoin & Other Crypto Currencies!
https://www.eevblog.com/crypto-currency/
T-Shirts: http://teespring.com/stores/eevblog
#ElectronicsCreators #Security #Locks

Hi this was going to be everyone's favorite segment mailbag but the cupboard is kind of bare and I was really excited about this one. so I couldn't wait for anything else to turn up to do like a full-on mailbag segment. So I'm going to open this I've got three separate packages they come from KJ Ross Security Locks Um, and here in Australia they're a prestigious Australian manufacturer of security locks and you know I've done quite a few videos on security locks. A bit of an interest of mine um, they've seen my videos.

yeah, they've been going like 70 years and uh, they make electronic locks here in Australia So you might be familiar with all the uh brands that I've talked about in previous videos. they're all International brands. Well, as far as I know, uh Ross locks are the only ones in Australia that actually make um, electronic locks here, so hopefully they're set. um, an electronic lock.

Fascinating to see that they actually make security locks here in Australia Bloody Ripper thousand series electronic combination say A Flock there you go. Very similar to one of the international brand ones. So oh, that's very nice. So we've got an electronic lock um a Smart Lock and a there you go wow that's chunky.

Oh I Feel the quality in that bad boy? Ow yeah these are all made in Australia I'll show you up close later but there I believe these are Ross designed um Keys you can get uh you should be able to get different uh key links on these so depending on like the thickness of your uh safe door or your other door that you try and do geez that's that's a solid chunky Beast So this is really cool. They've sent us in the three different types of locks which you can get on Modern safes and modern uh security doors and whatnot. Because they're not just uh for safes, you can install these on some and entry door to some sort of secure uh facility and that's why they have versions like this one that are a swing bolt uh design that actually swings in and it's got the curved front on it like that. Whereas this is your more uh traditional safe locking deadbolt design isn't that shiny.

That's like C-3PO shiny little Ross um highly reputable uh Australian Manufacturer They've been going for more than 70 years. family owned, uh business. They make some really awesome quality locks that certified I think they're certified to like VDS International standards and stuff like that but we've got three different types here and we've got the traditional uh key uh type Locker that's got the center Arrangement here with we'll have a look at the key in a second and then you've got a swing front plate like that which can go on your uh safe or your door or whatnot. Then you've got your modern Electronica lock like this which is just a standalone electronic art lock.

These are generally going to be a lot more secure than your key base ones because your key base ones If you've got the specialized picking tools, the custom picking tools, you can't pick them with just your regular you know, raking lock picking tools that your average Feast might have. you've got to have very specifically in custom designed tools for them. But anyway, they can actually be picked by a skilled picker with the Custom Tool. But these electronic safe locks.
These are incredibly secure. I'm not sure if anyone please leave it in the comments if you know if anyone has ever hacked an Australian uh made Ross electronic security lock, some of them more in the larger International Brands They have been hacked like you'll see somebody at Defcon doing a presentation or something. that they spent two years and yep, they finally hacked it and they found some side Channel Attack: Ultimately, this is on the front side of the safe and take it off to change the battery and you have access uh, to the battery power and to this interface as well. And if there's any side Channel attacks uh, possible via that then in theory it's possible.

But they're much more secure than these. but these are still like incredibly, uh, secure. And then we've got a modern uh Bluetooth lock. It's the same swing Bolter designer and this goes on the front of your safe instead of a keypad.

it's just got your batteries basically. um, gives you access with your shoe phone. um to your safe and you might think that's very unsecure. But ah, we'll have a look at it.

So this is the 700 Dart series lock and it uses I won't show you the actual key, but it uses a nine lever pick resistant uh lock in it. And I'll put up the details here. Of all the security stuff that they actually have built into just this regular uh key lock on this thing, it, you know it really is quite remarkable. It's double bidded.

as you can see on both sides, this one has nine different uh lever positions in there, so that's why it's a pretty thick and chunky boy. I'll show you a thinner six lever one later. Anyway, these are highly secure key locks. Um, so really, you don't have to worry about your average fees being able to get into this.

they really won't. And yes, it does actually have a reset hole on it, but that's um, that would be kind of difficult to get into when your safe is bolted in there against the wall. Yeah, good luck with that. But again, depending on the safe design, you might have a big cover plate over that that actually prevents physical access.

Um, to the reset pin. it's up to the safe designer. we're going to try it out. They actually have a key end to end uh key encryption which is on your phone and uh Ross Actually, uh formed a company in consultation with a couple of other uh companies called Veru and that's the app I just download it onto my shoe phone.

We'll try it in a minute and apparently it doesn't connect to the cloud at all. and uh, we've got our secure uh one-time key down here so we set it up. You can set it up on two different uh shoe phones so there's two owners and the good thing about this is you can have like our security guards come around for example and they can like audit the lock um as they're doing their rounds to make sure you know actually no one's actually gone into that room or whatever. A lot of electronic locks I think Ross do a version of this with a little LCD um on it like a smart LCD download the audit uh Trail for who's actually entered and when and stuff like that.
but of course which lock solution you choose depends on your requirements. If you've got like a gun safe or something like that and you absolutely must get into it, you know you don't want any battery to be dead and you don't want to be around or something like that you would use like a probably a key safe uh, lock like this. So unless you've physically lost the key oh yeah, forgot where you put it. Yeah, this is the most reliable uh mechanism electronic locks incredibly reliable.

but once again, and you know, in a real emergency um yeah, you could find Murphy's Law the battery's flat or something like that. But if you've got a safe I would recommend an electronic uh lock a quality electronic lock not one of the rip-off brand names you can buy rip off brand name ones on eBay don't buy them, they're crap and Bluetooth I'd really only recommended this if you have like a specific requirement for like Access Control where using your phone and the Bluetooth is you know, advantageous for just a home safe or something like that I I wouldn't want to do that. my phone's always locking up or doing something you know, dumb. So I would stick with just the regular dumb electronic uh keypad lock like this.

Now one of the scenarios where you might want to use a Bluetooth lock over a keypad lock and use your shoe phone to open it is that in a public environment, the keypad is susceptible to various visual attacks Either somebody's looking over your shoulder from a distance, they have a camera secretly set up, or something like that they can watch you put in the keypad, or um, if somebody has a thermal image in camera, you can get these uh for your phone. Now they can walk up behind you of course. and if I one, two, seven, eight for example and bingo we've actually got the pattern and that'll stay there for quite some time as you can see and that will tell us which buttons were actually uh, pressed and then it can limit the amount of code options. That's where you know you've got to have a physical device like this to actually, uh, open it.

and the spin combination locks. there also are susceptible to visual attacks as well. so that's where something like this would come in. and eventually over time some of the keys can actually wear out, so if you don't, uh, change the code around.

um yeah, you can see by visual wear as well. Or there could be another method to like reveal fingerprints and that sort of stuff and it just limits your code. uh, options. And then you can probably get in if you know, like the force six digits.
So let's tear down this 700 series Ross lock with nine levers. So we're talking 1.9 million combinations for the Dual bittered key here. I'll tell you what: I'm having a hard time getting this apart. the Machining the fit of this thing is absolutely incredible and this is one of the security features of the Ross locks.

Is that uh yeah, they're so well machined and well there we go. We got oh they all popped out. Oops! all the levers are kamagatsa and check out that that is one solid Die Cast piece. Wow, What's more amazing is the design of this 700 series.

Look at this. They've got nine. Count them, nine different levers. So right off the bat that is difficult and then they're alternately sprung.

so this top plate is sprung this side, the next plate is sprung this side so they're alternately sprung so that adds to the difficulty of uh, picking this right off the bat and there you go. We can see in there you can see how that turns and these are all very precisely machined. They're absolutely incredible. I Have actually spoken to Ross Locks and they do extol the virtues of their Precision their in-house precision machine.

There are in-house security controlled CNC machines for the Uh plate so this is a lever and this is going to have of, um, various I I Probably can't even tell you every single thing on here. um, but they got false gates in here and anti-picking measures which are going to make them difficult as I said alternately sprung on opposite sides. That makes it more difficult again. and I believe some of these like rounded Corners in here and don't know exactly where, but they actually have uh patterns on these uh kinds of things which um, yeah, makes these incredibly difficult to pick even with the uh, the actual customized picking tools not like you buy the you know 800 customized picking until you stick it in, you turn it and does the job.

No, you've got to have the skill. You've got to have the tools. You've got to have the talent. and then you'll notice that the bolt throw.

This entire bolt plate here goes right through the middle. That makes it more difficult to, uh, keep tension on this thing when you're trying to pick it where you see the curtain down in there as well that'll have its own sprung uh lever as well. So this is why this is known as a very difficult uh lock to pick. So um yeah, you can feel pretty confident if you've got one of these bad boys on your uh safe, that's for sure.

and I won't take it apart any further. But under the underside of the bolt plate you can see the curtain there and that I believe will have a spring lever in there as well. So if you picked this side, you've still got to get through um and apply tension and pick the other four on the other side. So uh yeah, that's just.
oh, it's unbelievable. Yeah, I'm not even going to try so it might look, you know, fairly simplistic, but there's a lot of uh lock design art that goes into this and probably half a dove dozen different uh, you know, anti-pick measures. so that's why it's got the reputation that it does. Yeah, so I just put that back together and I cannot believe the just the Precision in the Machining of all this thing.

There's nothing loosey-goosey in there. It's really a top quality key lock. It won't get much better than that in the world. All right, a tear down of the 1000 series electronic lock I mean all the interesting stuff is in here because this is where the secure keys are kept.

This is just a digital interface. I Mean you know you can smash this off. You can get access, uh, to these, uh, you know, wires and everything. but you're still not going to be getting able to get into this unless I said as I said, there's some side channel, uh, data attack or something like that, or potentially, um, some sort of like high voltage, you know, overload or something that can actually get in.

There is like one attack method. Apparently one of the brands is susceptible. not this one. I believe.

But where you can like fill them up with conductive liquid and you can activate the solenoid in them, you may have to avoid the warranty. Is that a one of those security jobbies? Yep, Void Void Void Void void. Thank you very much for playing. It's going to lift off.

Will it be potted? No, it's not potted. Safe manufacturers they can like take additional steps as I said, like to cover the reset. Um, whole. They could like do their own world in long hair.

If they really wanted to, they could pot it. If they really wanted to, they could do whatever. But anyway, we're in. There's the swing bulk mechanism and you can see how that.

the solenoid. Oh it's not a solenoid, it's a motor. It's a motor. Drive good.

So this will not be susceptible to a magnet attack, a magnetic attack to activate a solenoid, you've got to actually drive the motor and the little, uh, you know, worm drive down there has got a swing this back. um and then the swing bolt will activate. So yeah, apparently. um, this thing has like a I think like 10 times the um strength that's required by the Australian standard.

So this actually does come provided with a master code which you can and should always override. So I won't show you that. but I will enter that now. Oh, there we go.

Oh it swung back. Uh yeah, that was obvious. that was a um, that was the pivot point there. Oh yeah, there we go.

and we're in like that. And yeah, I think you can program the uh, delay time? Geez, there's no Gap in there is there. That's good. There's no play in that at all when I release this because it's done its time out thing boom and you ain't getting back in.
So yes, you can have uh, super codes and stuff like like, you know, for super uh users, master override codes. Yeah, they tell you. change the super code, add or delete manager codes, enable or disable manager code. Oh there you go.

The safe lock and the entry pad must have the same super code encryption or the unit will not work So presumably if your uh keypad fails like this um, you would need your you would have to tell them your uh super code to uh and then they could program that at the factory presumably and then send you a new one anyway. I Am impressed by the quality of construction here. It's really nice. everything's looks pretty Schmick and tight fit in shouldn't spring out anywhere there you go.

Okay, so what does that do? Is that just like an anti-tamper boom like that? Okay, yeah, I can only presume that this as an additional protection here for any sort of you know, drilling. or Brute Force attack on the side or something like that to get in there and you can see how that works there. there's that little pin on the bottom which then engages that down in there. so I'm not sure you're going to be able to bump attack that the weight just isn't there.

like the weight in the pin isn't there to actually bump attack that I don't I I Don't think you're going to be doing it? No. Nope. I'm not there. Nope.

I'm not seeing it I think that I think that's pretty good. So I Really like the uh, simplistic design of that and how it's assembled and this is a real high quality lock. I Really like it. Get your money's worth here.

There's the main board that's our motor. Drive Um, that's an L9 double one, zero or something. Um, so that's a dual Channel motor driver. It's got a big R series diode or is that back to back right across the uh battery.

but I can get a high res photo that always on my EV blogger Flickr account. There you go. They've got a resettable fuse over there nice and Overton I think I See there. There's absolutely nothing special there that's a Novoton uh, 805.1 micro controller.

Um, it doesn't have any like uh, you know, secure encryption, uh, features or anything like that. no a physical dye Hardware security or anything like that. but once again, you don't need that. And you know your other major brand locks don't have those either because you don't need it.

You're physically inside a safe, so like, as long as you uh, detected in terms of you know, power line attacks and stuff like that. but apart from that, there's you know there's nothing to it. You don't need much in it. the uh, the actual Uh code is kept inside the non-volatile memory inside this puppy.

so unless you can get physical access to it, um, yeah, good luck. So yeah, physically, that's very impressive. They use a separate Uh plate down there. It's very minimalist design.

They've got anti uh tamper plate that's like press fit uh, folded over into there the big supports. You're not going to smash this puppy open anytime soon. And here's inside the 1000 series Bluetooth lock with a wave key override here and I have taken the screw out of there. and if we take that plate off Tada, this is a six lever design.
Count them. Looks like they got a back plate on there just to keep all that in place. And these Springs up against the solenoid. here.

they just allow the plates to actually swing back. So yeah, that's exactly the same. Arrangement Except they've added the key override in there. so that is.

Uh, that's quite novel how they've done that. And of course, this is a universal mounting footprint so they all have to. You know, they can't just make it any uh, size they want so it's all got to fit in there. so that's that's rather neat.

So that allows the solenoid all the key to actually operate that need, huh? Just to show you that that's not susceptible to a magnetic attack. I've got my, uh, Neodymium huge neodymium magnet in my sock here. It's barely magnetic because this is all stainless steel. So yeah, there's no way that we can get in there and manipulate that with a huge big neodymium magnet which will boom.

There's absolutely nothing on the bottom of that board, so it's just the one Bluetooth chipset. You can see little itty bitty motor drive under there and that's all she wrote. So yep, it's all in the software. now.

The one thing that you'll notice with the design of these is that they're all stainless steel and this is done for a reason. Like all the internal plates are stainless steel, all the internal levers. they're all stainless steel and this is actually to prevent or it help reduce what's called a gallium attack and gallium is a a metal you can go look it up. I I Think the lock picking lawyer has done a video where he's like completely melted a lock away.

like just crumbles away after like four or five hours of gallium attacking the aluminum in that. but they build these out of stainless steel so that that is much less susceptible. I Think it's still like in theory possible it would take like forever. so these are going to be better than like a die Caster alloy lock like this one which could be more easily and faster eaten Away by a gallium attack.

and once again, you can see that they've got our full skates in here for all of these uh levers. so that uh, you know it just makes it more difficult to pick. but in this particular case, it's a six lever uh, wave key which isn't nearly as good as the Ross r700. Still, it's and of course you can order it with or without uh, the lock override system if you don't want that.

All right. So let's see if I can turn this once again the tolerance. If the tolerance is slightly off somewhere you're going to come a gutter and it's not going to open. There's something.
Ah, here we go. I Try it again. Holding the top plate on it will then open up and we can push that through like that. But if you get tricked on any of those full skates, you're going to come regards a bit.

So I've gotten all the levers out. You can see the bottom plate in there and that is the slide that goes over as you turn the key. Foreign.

Avatar photo

By YTB

26 thoughts on “Eevblog 1509 – the art of high security safe locks teardowns”
  1. Avataaar/Circle Created with python_avatars AlmostAnEngineer says:

    You now need to forward these onto LockPickingLawer for further analysis ๐Ÿ˜Š

  2. Avataaar/Circle Created with python_avatars CheeseParis says:

    LockPickingLawyer is already planning his next holiday in Australia

  3. Avataaar/Circle Created with python_avatars Jeff Card says:

    Those Ross locks look very 'Skookum' as we say here in Canada.

  4. Avataaar/Circle Created with python_avatars Botox Pig says:

    You sound incredibly biased. You do not talk like an engineer at all

  5. Avataaar/Circle Created with python_avatars Matty England says:

    Shaped charge

  6. Avataaar/Circle Created with python_avatars Im Me says:

    @LockPickingLawyer needs to be involved hereโ€ฆ

  7. Avataaar/Circle Created with python_avatars Dan says:

    I wonder if LockPickingLawyer can find some security flaws in these

  8. Avataaar/Circle Created with python_avatars SignallerK says:

    Why didn't they NFC, it should be more secure than BT?

  9. Avataaar/Circle Created with python_avatars Adrian Burt says:

    Visited Ross Locks Factory a month or two ago. Assembled one of the electronic locks and one of the key locks. Very impressive the standards they hold themselves to. It really shows through in the end product

  10. Avataaar/Circle Created with python_avatars Nobody Noone says:

    wtf is the "rubber glove treatment" lmao

  11. Avataaar/Circle Created with python_avatars Bolt VanderHuge says:

    damn you guys got some big spoons

  12. Avataaar/Circle Created with python_avatars Wayne Keenan says:

    I saw an ARM SWD connector and BLE logo, there's another MCU under that grey cover, or on the underside of the PCB, an nRF5x probably.

  13. Avataaar/Circle Created with python_avatars thekaduu says:

    EEVBlock…

  14. Avataaar/Circle Created with python_avatars tonttu303 says:

    Summon LPL

  15. Avataaar/Circle Created with python_avatars Sandy NรผรŸ says:

    โ€žVdSโ€œ is a german standard. It stands for โ€žVerband der Sachversichererโ€œ (Association of property insurers).

  16. Avataaar/Circle Created with python_avatars Alexander Khritonenkov says:

    Side channel attack definitely sounds interesting!

  17. Avataaar/Circle Created with python_avatars Sandy NรผรŸ says:

    Welcome to the Lockpicking Aussie ๐Ÿ˜„

  18. Avataaar/Circle Created with python_avatars Garrett Van Norden says:

    wheres the lock picking lawyer?

  19. Avataaar/Circle Created with python_avatars Poker Player says:

    Stick to electronics. Mechanical locks are the only reliable solution for guns.

  20. Avataaar/Circle Created with python_avatars TheBackyardChemist says:

    BT is notorious for having vulnerabilities being found in drivers and firmwares. Would not trust it for high sec.

  21. Avataaar/Circle Created with python_avatars Adam Lumpkins says:

    Dave, do you know if they ship to America reasonably priced?

  22. Avataaar/Circle Created with python_avatars Flying0Dismount says:

    If it's got Bluetooth in it, it ain't "high security"…

  23. Avataaar/Circle Created with python_avatars Joey Justin says:

    HI DAVE. REALLY REALLY GOOD CALL. THANKS FOR SAVING US ALL WITH A VIDEO. YES STEAL THE TIME WED RATHER WATCH YOU ALWAYS

  24. Avataaar/Circle Created with python_avatars A bit of a bit of a bit says:

    Yes, please do try a side channel attack!

  25. Avataaar/Circle Created with python_avatars Agrevated Hand diary says:

    Dude yay I found you ๐Ÿ˜€ on my old channel I used to watch you all the dang time, I thought you quit YouTube but it turns out I was typing the name wrong

  26. Avataaar/Circle Created with python_avatars Fit4Survival says:

    Love it!

Leave a Reply to Alexander Khritonenkov Cancel reply

Your email address will not be published. Required fields are marked *