Following up on my previous post about portable gun safes, Bitter had a DAC Fast Open Sportsafe sitting around that she had long lost the key for, and thought contained her passport. I decided to have a go at this, after watching some of the more detailed videos this guy produced explaining the common vulnerabilities. The good news is that the DAC Sportsafe, based on my non-expert attempts to crack, is good for protecting a gun from a young child. It doesn’t seem to open if you impact it any way that I could find, and rather than a latch, the electric motor extends and retracts a thick crossbar, which is held in the closed position by reasonably strong spring. The motor likely uses a worm gear to retract it against the spring. The mechanism from the inside is protected by plating, so any attack on the latching mechanism through the door or from exposed bolt holes will likely fail.
The bad news is that I did get into it, and now that I know how to do it, I could develop a tool to do it quickly. So for burglary, it’s not so great for someone who has knowledge on how to defeat it, and if it’s left unsecured to a floor or heavy furniture. The DAC’s fatal flaw is the rubber keypad, which if removed, allows both the electronics to be accessed through several holes. The DAC Sportsafe has an external power adapter that can be easily removed, also allowing access to the electronics inside. I did not explore attacks on the electronics, except to try a quick shorting attack on the external power adapter which did not work. With the cover off, a small gap can be noticed between the outside plate, and the plate they used to to “cover” the electronics. This gap allowed me to slip a blade from my Leatherman inside to push the crossbar out of the latch, pry the door back a bit, and then remove the blade, causing the door to open. The disappointment is that this could have been easily prevented by extending the steel plate a few millimeters so the plates overlapped. Bitter’s safe did not have power, so I could not try a learn button attack, to reprogram the access code, but a learn button attack on this safe is simple enough if you do not have the  base plate on, and the safe secured. You can do it with an old coat hanger. If you have a DAC Fast Open Sportsafe, the best thing you can do to helps is security is to properly secure it to a floor or furniture.
This is all making me wonder if people would pay 200-300 dollars for an electronic quick-open safe that is secure enough that you’d force an intruder or burglar to attack from the outside with cutting tools or drills. Most of these flaws are easily avoidable with a little engineering thought, and wouldn’t end up adding a whole lot to the overall production cost. Any cheap, portable safe is going to be vulnerable to cutting tools and drills, so the primary purpose of a safe like this is securing the gun against unauthorized access by children and burglars who don’t have the knowledge, tools, or time to engage in drilling or cutting. No safe is going to stop a determined professional who knows what he’s doing. I’d have to say the DAC Fast Action Sportsafe does a better job than most that we saw in the last post that had flaws, especially if properly secured to a floor or heavy piece of furniture, with the bolts installed properly and with thread lock used. I’d say if you’re going to buy a portable, Fast Open safe, this is a better option than many of the others that were exploited in Marc Tobias’s videos.
Once opened, was there in fact a passport inside? And did your attack render the safe non-functional for future use? Just curious…
Actually, no… there was no passport inside :) Only the battery sled, which was never securely fastened to the top of the safe, all the batteries, an owners manual for the safe, and lag bolts for securing it to the plate it comes with. That explains how it lost power, because when it moved, the batteries fell out of the unsecured sled that carries them.
I put the batteries back in and re-secured the sled to the safe. It works fine. My intrusion didn’t damage it. In fact, if I had been more careful, and not tried other methods that did not work, there’s be no evidence it was compromised.
I should also note I did not have a model to examine. I could see through the gap enough with a strong flashlight and squinting with my eyes to figure out enough of the latch mechanism to be able to jimmy it open. It took a few tries, but I got it.
” if people would pay 200-300 dollars for an electronic quick-open safe that is secure enough that you’d force an intruder or burglar to attack from the outside with cutting tools or drills.”
Please put me on the waiting list for 2!
Keypad combinations are convenient for those who must carry several large key rings. But most of those I have seen are inherently insecure.
The really sad part is how easy it is to prevent attacks on a keypad’s electronics. My unbranded $48.00 front door lock sends an embedded eight bit serialized “verification code” to unlatch the motor actuating board. The wrong code, or a short, disables the MAB for 299 seconds, essentially five minutes.
A few milliseconds later the keypad sends the seven digit door combination to the board. After 100 milliseconds the MAB latches and will only respond to the unlatch code.
Of course, it also takes a bit of care with the physical design of the door. The only thing that should go from the keypad to the MAB are the wires that power the keypad, and those holes should be the bare minimum necessary to do the job. Everything else should be well away from the hole.
Someone needs to get on the ball at the security companies.
Stranger