Dan Petro and Oscar Salaza - Hacking Smart Safes: On the Brink of a Robbery

The Anatomy of Commercial Smart Safes

Dan Petro and Oscar Salazar examine the security architecture of commercial "smart safes" deployed in retail businesses, restaurants, and financial branches. These connected safes combine physical armored vaults with digital bill validators, touchscreen management terminals, and network reporting interfaces to streamline cash handling.

Hardware Reverse Engineering and Bus Sniffing

The researchers reverse engineer several leading smart safe platforms, analyzing communication between the main computing unit, internal logic boards, and electronic lock solenoids. By tapping serial buses and inspecting PCB traces with logic analyzers, the authors uncover unencrypted internal communication channels carrying plaintext control commands.

Extracting Administrative Credentials and Solenoid Actuation

Petro and Salazar demonstrate multiple attack vectors, including sniffing supervisory PINs directly from ribbon cables and injecting malicious commands via exposed external USB ports. Using a custom microcontroller payload (Teensy), the researchers execute automated scripts that trigger the electronic lock solenoids, opening the physical safe vault in seconds.

Remediation and Embedded Physical Security Design

The presentation outlines critical engineering guidelines for electronic safe manufacturers. Securing connected physical security devices requires implementing end-to-end cryptographic authentication across internal component buses, disabling external debugging ports, and ensuring physical tamper detection circuitry cannot be bypassed externally.

(AI summary — Gemini 3.8 Flash)