[617] Master School Locker Combination Lock Picked and Decoded (Model 1670)

this is the lock-picking lawyer and what I have for you today is the master lock model 1670 locker combination lock this lock or a variant of it is probably the most popular lock on school lockers in the United States and it has two features that make it particularly well-suited for the school environment first it has the keyed entry feature which allows school administrators to open the lock without looking up the combination and second it contains five preset combinations that can be rotated each school year such that a combination won't be reused until the last student who used it is no longer at the school we're going to do a few things with this lock today first of course we will pick it open second I'll talk about the design weaknesses that would allow this lock to be decoded and finally we only have the first of the five combinations so I'm going to show you how to figure out the other four combinations and also how to switch the lock between them so first let's get to picking you can see we have a pretty tiny little key way here and bidding that is above average so it should provide some challenge to get into that tiny key way I'm going to be using this little tension wrench from the peterson flat 5 and probably a standard hook in 18,000 so one is loose so is 2 3 4 is binding got a little click there 5 is binding got a click out of 5 back to the beginning nothing on 1 2 3 is binding got a click out of 3 it should just be one in 2 now number one is binding and it looks like we got it open you can see the bolt retracted okay let's relock this and next I want to talk about the features of this lock that would allow us to figure the combination out if you don't know it now earlier I said we were going to decode it and I think I probably used the wrong word we're going to brute-force the combination meaning dial all potential combinations but if you do it intelligently it's actually a pretty quick process now this has a 50 digit dial in a three number combination that means the number of potential combinations is 50 cubed or about 125,000 however there are three weaknesses to this lock that let us narrow it down so first the third digit of this combination actually doesn't matter at all we're going to dial it in the combination is 40 0 10 so let's go we're gonna turn it right a couple times and stop on 40 then we're gonna turn to the left pass 0 and then stop on it the second time and then for the last digit we're gonna turn right but the lock actually stops before you get to the last digit you just keep turning right until the bolt retracts so since the last digit doesn't matter we just narrowed this down from 50 cubed to 50 squared or from 125 thousand possible combinations to 2,500 the next weakness we can exploit is the size of the gates now our combination again is 40 0 10 but this lock doesn't really require precision so let's turn it past 40 around 39 let's actually do 38 and a half our next digit is 0 let's stop a little bit early let's see 49 you can see we still opened it up I did some testing and the gates seemed to be about two and a half to three digits wide so let's be conservative say two and a half what that means is that every number on this 50 digit wheel can be tested by trying just 20 positions so we just cut the number of possible combinations from 50 squared or 2500 220 square which is only 400 the final weakness we're going to discuss allows us to test those 400 combinations without fully dialing the or I'm sorry without fully dialing the full combination so I know that the first digit is 40 so let's just use that as an example let's say we are testing out 40 as a first digit and then for the second digit we would have to pass that digit once and then stop on it so I turn it to 40 now from this position I can test all possible second digits so what I would do is turn it forward two and a half and then turn it back and if I can get within five digits of the number I just tried I know it's not the correct one so I'll do from 42 and a half to 45 again if I can get within five digits I know that's the wrong one forty five up to forty seven and a half again I can see it's not the right one just keep advancing and I happen to know zero is the correct one and you can see we can't even approach the zero again so we know we had the right combination which also means it opened now using this method you can get through all 400 combinations pretty quickly I did some calculations and you can go through every possible combination and somewhere in the twenty to thirty minute range which means on average you're gonna open this up in about ten to fifteen minutes now that's not a small amount of time but it's also not a particularly long time to brute-force a combination lock okay finally I'm going to show you how to figure out the four combinations to this lock that we don't know and how to switch between them the important thing to remember about these is that all of the combinations are related to each other by an offset and but by that I mean if the let's say the combination is ten twenty thirty and the offset is five then the second combination will be 15 25 35 the issue is figuring out the offsets between the combinations because the offset between each one is different now you can determine the offset if you pay careful attention during the change process so before we start let's make a small chart here so we can write this down as we go along okay there are five different combinations then I'm gonna have a column for our offset and for the combination so for the first one we know it is 40 0 10 and let's go about figuring out what all the rest are so the combination let's see to change it there is a essentially a six step process first we turn the dial to the right or clockwise until word zero then we unlock it with the key then there's a small button on the back at this point we can press it in hold it down and turn the combination two digits in the clockwise direction we then relock it with the key and we turn the dial until there's a click okay I'm sure you heard that because it's really loud the combination is now changed but here's the important part if we pair pay careful attention to how much the dial turned before we heard that click we can figure out the offset here it turned between six and seven positions so let's round that up to seven and that's our offset for the number two combination it's actually negative seven because we were turning the numbers backwards so let's go to the chart here we have a negative seven offset that means we subtract seven from each of these digits so our second combination should be 33 43 and three so let's test that out 33 43 and 3 opened it up okay that's pretty good let's let's keep going and see if we can figure some more out we turn this till we hit 0 insert the key unlock it turn it two digits clockwise relock it and let's turn and listen for our click okay what was between 4 & 5 so let's round up to 5 that's actually negative 5 so subtracting 5 from each of these we get 28 38 and 48 so again let's try that one out 28 38 and we've got it open okay let's keep going get it to zero once again Oh bolts are loosing up here okay let's listen for our click and it's between five and six which means our offset is negative six and we have a combination of 22 32 and 42 it's again let's try that out it's 20 to 32 and once again we have got the combination and to find the final one okay it looks like it's between 7 & 8 so let's say we have an offset of negative 8 that should make our next combination 14 24 34 let's try it out 14:24 and it opened up now the interesting thing here is that each of these offsets if you were to take all five of the offsets they should add up to 50 so I could take a good guess on how far we're going to turn this wheel before it clicks here let's see we have 12 18 and 26 so we should have a a 24 offset here so let's turn it back to the normal combination and see if that is correct so we should have a long way to turn before we hear that click yep right on the 24th digit so to get back to the first digit we have a negative 24 offset so this video has already run long enough so that's it for today I hope this was helpful if you do have any questions or comments about this please put them below if you like this video and would like to see more like it please subscribe and as always have a nice day thank you

Channel: LockPickingLawyer

Views: 2,213,648

Keywords:

Id: stc2wQkZ65w

Length: 12min 16sec (736 seconds)

Published: Thu Feb 15 2018

Reddit Comments

[u/[deleted]]

These are going cheap on eBay right now. Just sayin'. :)