Safecracking 101

Not Doing it the Right Way

Lots of computer security practitioners appear to be fascinated with locks. It makes sense, really, since locks are one of the more complex and cool security systems humans know how to build. I know several practitioners who pick locks fluently, and one in particular who seems to know more about locks than most locksmiths. Picking locks has a certain hacker-cool appeal, I guess.

But, picking locks is for wimps. Why pick a lock when you can shatter it?

Un-safe At Any Speed

When I bought my house the basement came with a small safe that had been left down there by several generations of previous owners. It wasn't a particularly good safe, but it was heavy enough and dirty enough that it just sat there waiting for a purpose until my buddy DJ Maddog Mike came up for the weekend and we decided that it'd be a good day to mount the scope on my Barrett and dial it in.

For those of you who aren't into firearms, a Barrett is a .50 cal anti-material weapon. It fires the highly destructive .50 Browning machine gun round, which has been a mainstay of american ass-whipping technology since WWII. The .50 BMG round puts out (variously) 16,000foot/lbs of muzzle energy - about as much as an entire box of .44 magnum rounds, and makes a pretty serious mess out of anything it hits, with very few but notable exceptions. My Barrett is a model '95, that I bought back in the Internet bubble when I had more money than sense, and it sports a US Optics 3-22X zoom scope with an 80mm objective that sucks light in like the 429 V-8 engine in my farm truck gobbles gasoline. You can not only clearly see a squirrel with the thing at 600 yards, you can tell if the squirrel is nervous by its expression. It's quite a scope.

(Inside The Redneck Sniper Hide)

Mike and I took the farm truck, blankets, 2 cans of greek-made .50BMG, a bunch of sodas, screwdrivers, a level, and other goofy stuff and established a sniping position about 400 yards from one of the hillsides in my back yard. For fun, you can use the coke can for comparison and get an approximate idea how large the scope and the rifle are. We figured that using the hood of a pickup truck as a rifle-mount would earn us a place in bubba valhalla (where the ancient norse redneck warriors go when they die, to an endless party of beer-drinking, arm-wrasslin' and tractor pulls under the watchful eye of Odin, who looks suspiciously like a very grumpy one-eyed Richard Petty)


We sighted the rifle in with military ball and then set the safe and video camera up and switched over to APIT. APIT stands for "armor piercing incendiary tracer" - a round that carries an exploding charge which flashes on hard contact with a target, and a tungsten penetrator that carries through the target after the incendiary charge has gone off. In normal use, APIT would be employed against things that you want to simultaneously make a hole in and set fire to. Like a safe. Using this kind of stuff against a propane cylinder would be all wrong. So I won't post that video here.

This is the scene a fraction of a second after the APIT round hit the safe. You can see that the incendiary bursting charge has gone off.

When the round hits, it's "assertive" - from 400 yards away you can clearly hear the BOOM of energy being released and the rattle of mangled stuff flying around. And that's over the ringing in your ears from the muzzle blast of the rifle.

You'll notice the crushed bits of cinderblock to the left of the safe. Those were the leftovers from the cinderblock we used to make sure the rifle was sighted in properly. ;)

...And the safe is open!

The perspective is a little hard to make out in a still frame. What you can't see is the elegant aerial pirouette being made by the door, which has blown off its hinges and separated from the lock. Watch the video and you'll see it does a couple of nice 360's before it leaves the frame.

Picking this lock would have taken even an expert a few seconds! Mike and I had the safe open in the interval between frames of video. Under 1/30 of a second. Plus the amount of time it takes a 1/2" diameter bullet the size of your thumb to scream 400 yards and hit its target.







MPEG - 2.6MB 1/4 speed

After Action

The door of the safe landed about 5 feet away from the remains of the safe itself.

Entrance Wound
Darn, you can tell the scope isn't dialed quite right, yet. That shot is perfectly centered on the target, but it's about 4" high.

Doubtless you've seen those silly scenes in the movies where someone says something stupid about bullet damage like "it makes a small hole going in and a huge hole going out." Well, in the case of a .50BMG APIT hitting a safe, it makes a small hole going in, all right. About 1/2". It makes a small hole going out, too. About 1/2". My minimal understanding of ballistics tells me that the safe didn't slow the round down very much at all. A drill would have made a slightly cleaner hole but it would have taken much longer and been less fun.

Blast Damage

The interesting stuff happened on the inside of the safe, where the bursting charge for the incendiary went off. As you can see there is considerable scoring and flash residue from the explosion. In the image above, you can see the hole where the penetrator left the back of the safe, after the incendiary charge went off. The hole left by the penetrator is - about 1/2". It doesn't look like the safe deformed the penetrator at all, or even slowed it down. If you watched the video, though, you can tell that a considerable amount of energy was imparted to the safe by the round passing through it.

Exit Wound

This image is a bit blurry; sorry about that. I was laughing so hard when I shot this that the vibration reduction of my camera's lens wasn't able to compensate and keep the image sharp. The exit hole left by the penetrator is about 2" at its widest point. I speculate that, since the round hit at an angle to the back of the safe, the penetrator was probably spinning as it exited the back of the safe, enlarging the hole considerably.

Under the safe was a small crater in the hill, where the penetrator had exited stage left. Mike and I spent about 20 minutes digging to try to find it, but the hole went in quite a ways and we never were able to locate the penetrator or pieces of it.

Marcus J. Ranum
Morrisdale, PA, July 7, 2005