Simplex Locks: An Illusion of Security
by Scott Skinner and Emmanuel Goldstein
No lock is one hundred percent secure. As any locksmith will tell you, even the best lock can be opened if one wishes to invest the time and resources. However, a good lock should at least be secure enough to prevent the average person from compromising it. Common sense dictates that a lock which can easily be opened by anyone is simply not a safe lock to use.
While an average person may not have the necessary skills and expertise to use a lock pick or a blowtorch, almost everyone has the ability to count, and the ability to count is all that is necessary to compromise a Unican/Simplex push-button lock. In addition, one needn't count very high. Only 1085 combinations are used, and in most cases this number is reduced considerably.
Anyone can easily open a Simplex lock by merely going through all the possible combinations. As arduous as this may sound, members of 2600 average ten minutes when put to the task. This method becomes even easier if one can find out the "range" of the combination. For instance, if one knows that only three push-buttons are being used, then one merely has to go through 135 combinations. In this example, a Simplex lock can be compromised in under five minutes. With some models (particularly the commonly used 900 series), a new combination can then be set without a key. One can literally lock someone out of their own home.
Far worse than the low number of combinations is the illusion of security that surrounds the lock. We called ten locksmiths at random and were told that "thousands," "millions," and in some cases "a virtually unlimited number" of combinations were available. These claims are somewhat misleading considering the actual number of possible combinations. In addition, no locksmith was able to tell us exactly how many combinations were available, nor did any locksmith believe us when we told them.
Simplex advertisements also claim that these "maximum security" locks are "ideal for security-sensitive areas" and that some models meet the requirements of the Department of Defense Security Manual. We contacted Simplex to find out just what these requirements are. According to Thomas Nazziola, Vice President of Marketing, the locks comply with paragraph 36a of the Department of Defense Security Manual (DoD 5220.22-M).
Mr. Nazziola refused to quote paragraph 36a of the manual as he felt it was "restricted." However, he summarized the section by claiming that Simplex locks comply with the DoD Security Manual for security-sensitive areas.
2600 was able to obtain a copy of this "restricted" manual just by asking. Upon close examination of paragraph 36a entitled "Automated Access Control Systems," we were unable to find any information concerning mechanical push-button locks.
The section that does apply to Simplex locks is paragraph 36 entitled "Electric, Mechanical, or Electromechanical Devices." According to this section, mechanical devices which meet specified criteria may be used "to control admittance to controlled areas during working hours." [emphasis added] While there is an element of truth in Mr. Nazziola's claim, he did not tell us that according to the DoD Security Manual. Simplex locks may not be used as the only lock source except during "working hours."
In addition, it is relatively easy to meet the requirements of the DoD Security Manual. Virtually any combination lock with changeable combinations, and indeed even padlocks, will meet these requirements.
Although Simplex claims that "thousands of combinations are available," in truth only 1085 combinations are used. Another 1085 combinations are available in the guise of "high security half-step codes." These are codes which require the user to push one or more buttons only halfway. Because of the extreme difficulty in setting and using these half-step codes, Simplex advises against their use, and in most cases, does not even inform the user that these codes are available.
According to one locksmith, "[Simplex] only suggests it for really high security installations. Government installations. For the average consumer, they don't want anyone to know about it."
We shudder to imagine which high security government installations are using Simplex locks as the only lock source. The "high security codes" are an example of misleading information being used to sell the locks (in this case, to the U.S. government). Naturally, the addition of 1085 combinations does not make the lock considerably more secure. (If 2170 combinations seems like a large number, consider that a $5 Master lock has 64,000.) In addition, we have yet to find one single instance where the half-step codes are used.
We have found that numerous organizations use Simplex locks as the primary lock source. Among the guilty parties in the New York metropolitan area are Federal Express, United Parcel Service (UPS), Citicorp Center, John F. Kennedy International Airport, and the State University of New York at Stony Brook. Others around the nation include General Motors, the State Department, McDonald's, NSA, and the University of Wisconsin.
The biggest offender is Federal Express, which uses Simplex locks on over 25,000 dropboxes nationally. According to Robert G. Hamilton, Manager of Corporate Identity [sic] for Federal Express, "[Federal Express dropboxes] are extremely secure. As a matter of fact, there's probably double the cost of security built into these boxes than what's necessary. The idea of having somebody put something extremely important and vital - and it's obviously important and vital or they wouldn't ship it Federal Express - in one of these unmanned receptacles was, I mean security was uppermost on people's minds... [The dropboxes] are like vaults."
"The dropboxes are like vaults." - Federal Express
These "vaults" were accessed by members of 2600 in less than ten minutes. The dropboxes are particularly insecure because Federal Express uses the same combination for all of their dropboxes in every state on the east coast! So by opening one dropbox, we now have access to thousands.
Members of 2600 also gained access to a UPS dropbox - in one shot. UPS did not even bother to change the default combination which is set by Simplex. And just like Federal Express, UPS figures that a single combination is good enough for every dropbox.
Another big offender is the State University of New York at Stony Brook, which uses Simplex locks in both dormitory and academic buildings. According to University Locksmith Gerry Lenox, "I don't consider [the Simplex lock] to be a secure lock. I prefer a deadbolt lock which operates with a key more than I would a Simplex lock... I think it's more of a convenience lock than it is a security lock." When asked why the university continues to use the lock, Mr. Lenox said, "[The university] did not consider contacting the university locksmith on his expertise. I had originally told them years ago when the Simplex locks were first introduced... not to use [the locks] in the dormitories." Not only are they being used in the dormitories, but the university is considering purchasing 1500 more for additional rooms.
The illusion of security Simplex is portraying with misleading advertising is that Simplex locks are just as secure, if not more secure, than key locks. The result of this myth is that many businesses, institutions, and homeowners confidently use Simplex locks as the only lock source despite the fact that the locks are inherently insecure. Even when locksmiths are consulted, we have found that they simply perpetuate the illusion of security by claiming that Simplex locks are "top of the line" and that "even the Department of Defense uses them."
Nowhere is it mentioned that Simplex locks should never be used as the only lock source. Even worse, Simplex is now aggressively pursuing the homeowner market with their new "residential" 6000 series. These new locks employ the same insecure mechanism, and are being marketed as primary locks.
Realistically, Simplex locks are more of a convenience lock than anything else. They are convenient because they do not require keys and the combinations are easily changed. However, this convenience backfires when it comes to security. These locks are so convenient that people tend not to use other locks that may also be present on the door.
For those organizations currently using Simplex locks, we recommend following the guidelines of the DoD Security Manual: "The locks may be used as the sole lock source only during working hours. For home or private use, we strongly advise that consumers use these locks in conjunction with a key lock and never as the sole means of security.
Hacking Simplex Locks
In this issue is a list of all possible combinations for Simplex locks.
We have divided the list into four groups according to how many push-buttons are used. The numbers listed in parentheses refer to push-buttons that must be pressed together. If you find that none of the combinations appear to open the lock, then it may be a rare instance of a half-step code. In this case, only the last number (or numbers if they are in parentheses) should be pressed in halfway and held while the knob or latch 1s turned. Slowly press in the push-button(s) until you feel pressure. If you hear a click then you have pushed the buttons in too far.
If all of this sounds complicated, then you are beginning to understand why it is that Simplex does not recommend the use of half-step codes, and subsequently why half-step codes are virtually never used.
Simplex locks come in many different shapes, sizes, and colors. However, the two models that you will most likely see are the 900 and the 1000 series. The characteristic features of the 900 series are five black buttons spaced in a circular fashion on a round, metallic cylinder. In addition, the 900 series utilizes a latch instead of a doorknob. The 1000 series is much larger, with five (usually metallic) push-buttons spaced vertically on a rectangular metal chassis. Unlike the 900 series, the 1000 has a doorknob.
We suggest that novices attempt their first hack on a Simplex 900 model. If the latch is located below the buttons, then the procedure is as follows:
1.) Turn the latch counterclockwise to reset the lock.
2.) Enter a combination from the list.
3.) Turn the latch clockwise to open If the latch is located above the buttons then simply reverse the procedure. Make sure that you reset the lock after each try.
To hack a 1000 model, simply enter a combination from the list and turn the knob clockwise. You will hear clicks as you turn the knob, indicating that the lock has been reset. It is sometimes difficult to tell when you have cracked a 1000 model by simply turning the knob. When you do get the correct code, you will hear a distinctive click and feel less pressure as you turn the knob.
You will find that turning the latch on a 900 model requires less wrist motion and makes much less noise than turning the knob on a 1000 model. These details seem trivial until you realize that you may have to turn the latch or doorknob a few hundred times before you crack the lock.
We cannot stress enough how much easier it is when you know the range. For instance, if you know that only three digits are being used, then you do not have to waste time trying four digits. One way to find out the range is to stand nearby while someone punches in the code. You will hear distinctive clicks which will give you an idea of the range.
If you cannot stand nearby then try hiding a voice-activated tape recorder near the door. The tape recorder will remain off until someone comes up to punch in the code. You can then retrieve the recorder later at your convenience and listen for the telltale clicks. We find that this method only works in quiet areas, such as the inside of a building.
Another way to find out the range is to take a pencil eraser and carefully rub off a tiny bit of rubber on each of the push-buttons. When someone comes to enter the combination, they will rub off the rubber on all of the push-buttons that they use, while leaving telltale traces of rubber on the push-buttons that they do not use. This method works particularly well because you eliminate push-buttons, which drastically reduces the number of combinations that must be tried.
We find that certain ranges tend to be used more than others. Group B (three push-buttons) tends to be used in "low security areas," while Group C and Group D tend to be used in areas which seem like they should be more secure. We have never found a lock which uses a combination from Group A. For some reason, we find that the 1000 series mostly uses Group C (four push-buttons).
In addition, most combinations tend to be "doubles," which require at least two of the push-buttons to be pressed together. When you decide on a particular range to start with, try the doubles first. For instance, try: (12) 3 4 5 before you try: 1 2 3 4 5
We have never found a lock which uses a triple, quadruple, or all five push-buttons pressed at the same time.
Although we are providing a list of all the possible combinations, you may find it useful to invest some time and record these codes onto cassette. This makes it much easier for one person to hack a Simplex lock because he does not have to hold the codes in one hand while hacking, nor cross out the codes to keep his place. A Walkman also looks far less conspicuous than sheets of paper filled with numbers. The only drawback to using a Walkman is that the person hacking will not be able to hear anyone coming from a distance. We find it easier to hack Simplex locks in small groups, so that each person can take turns, and everyone has their ears open.
Finally, it is always good to take a few lucky shots before you initiate a brute-force hack. Always try the default combination (2 4) 3 before you try anything else. Above all, don't give up!
Even if you do not get the combination in ten minutes, you are still that much closer to figuring it out. We recommend that you do not stress yourself out trying every combination in one shot. A few minutes a day will do just fine, and the thrill of achievement will be well worth the wait.
Changing Combinations on the 900 Series You may change combinations to any sequence you wish, using any or all buttons, in any order, separately or pushed at the same time with other buttons. You cannot use the same button more than once in a combination. 1) With the door OPEN and the Simplex LOCKED, turn the FRONT CONTROL KNOB (marked "Simplex") to the LEFT, and RELEASE. Push the EXISTING combination and RELEASE the buttons. 2) Remove the screw in the Lock Housing with an Allen wrench. Insert the wrench into the screw hole and depress button within. Remove wrench. 3) Turn the front control knob (marked "Simplex") to the LEFT, and RELEASE. 4) Press the buttons in the sequence desired for your new combination. Record your new combination. 5) Turn the front control knob RIGHT. Your new combination is now installed. Before shutting the door, try it to be sure you have recorded it correctly. Replace the threaded screw in the Lock Housing. NOTE: If the front control knob opens the lock without pushing the combination, steps 3, 4, and 5 were performed out of order and your Simplex is in a "0" combination. To reinstall a combination, follow the above steps above, but omit step #1. |
1085 Possible Combinations Divided Into Four Groups
Note: Numbers in parentheses should be pressed together.
Group A 1 2 3 4 5 12 13 14 15 21 23 24 25 31 32 34 35 41 42 43 45 51 52 53 54 (12) (13) (14) (15) (23) (24) (25) (34) (35) (45) (51) (52) (53) (54) |
Group B 123 124 125 132 134 135 142 143 145 152 153 154 213 214 215 231 234 235 241 243 245 251 253 254 312 314 315 321 324 325 341 342 345 351 352 354 412 413 415 421 423 425 431 432 435 451 452 453 512 513 514 521 523 524 531 532 534 541 542 543 (12)3 (12)4 (12)5 (13)2 (13)4 (13)5 (14)2 (14)3 (14)5 (15)2 (15)3 (15)4 (23)1 (23)4 (23)5 (24)1 (24)3 (24)5 (25)1 (25)3 (25)4 (34)1 (34)2 (34)5 (35)1 (35)2 (35)4 (45)1 (45)2 (45)3 3(12) 4(12) 5(12) 2(13) 4(13) 5(13) 2(14) 3(14) 5(14) 2(15) 3(15) 4(15) 1(23) 4(23) 5(23) 1(24) 3(24) 5(24) 1(25) 3(25) 4(25) 1(34) 2(34) 5(34) 1(35) 2(35) 4(35) 1(45) 2(45) 3(45) (123) (124) (125) (134) (135) (145) (234) (235) (245) (345) |
Group C 1234 1235 1243 1245 1253 1254 1324 1325 1342 1345 1352 1354 1423 1425 1432 1435 1452 1453 1523 1524 1532 1534 1542 1543 2134 2135 2143 2145 2153 2154 2314 2315 2341 2345 2351 2354 2413 2415 2431 2435 2451 2453 2513 2514 2531 2534 2541 2543 3124 3125 3142 3145 3152 3154 3214 3215 3241 3245 3251 3254 3412 3415 3421 3425 3451 3452 3512 3514 3521 3524 3541 3542 4123 4125 4132 4135 4152 4153 4213 4215 4231 4235 4251 4253 4312 4315 4321 4325 4351 4352 4512 4513 4521 4523 4531 4532 5123 5124 5132 5134 5142 5143 5213 5214 5231 5234 5241 5243 5312 5314 5321 5324 5341 5342 5412 5413 5421 5423 5431 5432 (12)34 (12)35 (12)43 (12)45 (12)53 (12)54 (13)24 (13)25 (13)42 (13)45 (13)52 (13)54 (14)23 (14)25 (14)32 (14)35 (14)52 (14)53 (15)23 (15)24 (15)32 (15)34 (15)42 (15)43 (23)14 (23)15 (23)41 (23)45 (23)51 (23)54 (24)13 (24)15 (24)31 (24)35 (24)51 (24)53 (25)13 (25)14 (25)31 (25)34 (25)41 (25)43 (34)12 (34)15 (34)21 (34)25 (34)51 (34)52 (35)12 (35)14 (35)21 (35)24 (35)41 (35)42 (45)12 (45)13 (45)21 (45)23 (45)31 (45)32 3(12)4 3(12)5 4(12)3 4(12)5 5(12)3 5(12)4 2(13)4 2(13)5 4(13)2 4(13)5 5(13)2 5(13)4 2(14)3 2(14)5 3(14)2 3(14)5 5(14)2 5(14)3 2(15)3 2(15)4 3(15)2 3(15)4 4(15)2 4(15)3 1(23)4 1(23)5 4(23)1 4(23)5 5(23)1 5(23)4 1(24)3 1(24)5 3(24)1 3(24)5 5(24)1 5(24)3 1(25)3 1(25)4 3(25)1 3(25)4 4(25)1 4(25)3 1(34)2 1(34)5 2(34)1 2(34)5 5(34)1 5(34)2 1(35)2 1(35)4 2(35)1 2(35)4 4(35)1 4(35)2 1(45)2 1(45)3 2(45)1 2(45)3 3(45)1 3(45)2 34(12) 35(12) 43(12) 45(12) 53(12) 54(12) 24(13) 25(13) 42(13) 45(13) 52(13) 54(13) 23(14) 25(14) 32(14) 35(14) 52(14) 53(14) 23(15) 24(15) 32(15) 34(15) 42(15) 43(15) 14(23) 15(23) 41(23) 45(23) 51(23) 54(23) 13(24) 15(24) 31(24) 35(24) 51(24) 53(24) 13(25) 14(25) 31(25) 34(25) 41(25) 43(25) 12(34) 15(34) 21(34) 25(34) 51(34) 52(34) 12(35) 14(35) 21(35) 24(35) 41(35) 42(35) 12(45) 13(45) 21(45) 23(45) 31(45) 32(45) (12)(34) (12)(35) (12)(45) (13)(24) (13)(25) (13)(45) (14)(23) (14)(25) (14)(35) (15)(23) (15)(24) (15)(34) (23)(14) (23)(15) (23)(45) (24)(13) (24)(15) (24)(35) (25)(13) (25)(14) (25)(34) (34)(12) (34)(15) (34)(25) (35)(12) (35)(14) (35)(24) (45)(12) (45)(13) (45)(23) (123)4 (123)5 (124)3 (124)5 (125)3 (125)4 (134)2 (134)5 (135)2 (135)4 (145)2 (145)3 (234)1 (234)5 (235)1 (235)4 (245)1 (245)3 (345)1 (345)2 4(123) 5(123) 3(124) 5(124) 3(125) 4(125) 2(134) 5(134) 2(135) 4(135) 2(145) 3(145) 1(234) 5(234) 1(245) 4(235) 1(245) 3(245) 1(345) 2(345) (1234) (1235) (1245) (1345) (2345) |
Group D 12345 12354 12453 12435 12534 12543 13452 13425 13524 13542 13245 13254 14523 14532 14235 14253 14352 14325 15234 15243 15342 15324 15423 15432 21345 21354 21453 21435 21534 21543 23451 23415 23514 23541 23145 23154 24513 24531 24135 24153 24351 24315 25134 25143 25341 25314 25413 25431 31245 31254 31452 31425 31524 31542 32451 32415 32514 32541 32145 32154 34512 34521 34125 34152 34251 34215 35124 35142 35241 35214 35412 35421 41235 41253 41352 41325 41523 41532 42315 42351 42513 42531 42135 42153 43512 43521 43125 43152 43215 43251 45123 45132 45213 45231 45312 45321 51234 51243 51324 51342 51423 51432 52314 52341 52413 52431 52134 52143 53412 53421 53124 53142 53214 53241 54123 54132 54213 54231 54312 54321 (12)345 (12)354 (12)435 (12)453 (12)534 (12)543 (13)245 (13)254 (13)425 (13)452 (13)524 (13)542 (14)235 (14)253 (14)325 (14)352 (14)523 (14)532 (15)234 (15)243 (15)324 (15)342 (15)423 (15)432 (23)145 (23)154 (23)415 (23)451 (23)514 (23)541 (24)135 (24)153 (24)315 (24)351 (24)513 (24)531 (25)134 (25)143 (25)314 (25)341 (25)413 (25)431 (34)125 (34)152 (34)215 (34)251 (34)512 (34)521 (35)124 (35)142 (35)214 (35)241 (35)412 (35)421 (45)123 (45)132 (45)213 (45)231 (45)312 (45)321 3(12)45 3(12)54 4(12)35 4(12)53 5(12)34 5(12)43 2(13)45 2(13)54 4(13)25 4(13)52 5(13)24 5(13)42 2(14)35 2(14)53 3(14)25 3(14)52 5(14)23 5(14)32 2(15)34 2(15)43 3(15)24 3(15)42 4(15)23 4(15)32 1(23)45 1(23)54 4(23)15 4(23)51 5(23)14 5(23)41 1(24)35 1(24)53 3(24)15 3(24)51 5(24)13 5(24)31 1(25)34 1(25)43 3(25)14 3(25)41 4(25)13 4(25)31 1(34)25 1(34)52 2(34)15 2(34)51 5(34)12 5(34)21 1(35)24 1(35)42 2(35)14 2(35)41 4(35)12 4(35)21 1(45)23 1(45)32 2(45)13 2(45)31 3(45)12 3(45)21 34(12)5 35(12)4 43(12)5 45(12)3 53(12)4 54(12)3 24(13)5 25(13)4 42(13)5 45(13)2 52(13)4 54(13)2 23(14)5 25(14)3 32(14)5 35(14)2 52(14)3 53(14)2 23(15)4 24(15)3 32(15)4 34(15)2 42(15)3 43(15)2 14(23)5 15(23)4 41(23)5 45(23)1 51(23)4 54(23)1 13(24)5 15(24)3 31(24)5 35(24)1 51(24)3 53(24)1 13(25)4 14(25)3 31(25)4 34(25)1 41(25)3 43(25)1 12(34)5 15(34)2 21(34)5 25(34)1 51(34)2 52(34)1 12(35)4 14(35)2 21(35)4 24(35)1 41(35)2 42(35)1 13(45)2 12(45)3 21(45)3 23(45)1 31(45)2 32(45)1 345(12) 354(12) 435(12) 453(12) 534(12) 543(12) 245(13) 254(13) 425(13) 452(13) 524(13) 542(13) 235(14) 253(14) 325(14) 352(14) 523(14) 532(14) 234(15) 243(15) 324(15) 342(15) 423(15) 432(15) 145(23) 154(23) 415(23) 451(23) 514(23) 541(23) 135(24) 153(24) 315(24) 351(24) 513(24) 531(24) 134(25) 143(25) 314(25) 341(25) 413(25) 431(25) 125(34) 152(34) 215(34) 251(34) 512(34) 521(34) 124(35) 142(35) 214(35) 241(35) 412(35) 421(35) 123(45) 132(45) 213(45) 231(45) 312(45) 321(45) (12)(34)5 (12)(35)4 (12)(45)3 (13)(24)5 (13)(25)4 (13)(45)2 (14)(23)5 (14)(25)3 (14)(35)2 (15)(23)4 (15)(24)3 (15)(34)2 (23)(14)5 (23)(15)4 (23)(45)1 (24)(13)5 (24)(15)3 (24)(35)1 (25)(13)4 (25)(14)3 (25)(34)1 (34)(12)5 (34)(15)2 (34)(25)1 (35)(12)4 (35)(14)2 (35)(24)1 (45)(12)3 (45)(13)2 (45)(23)1 (12)5(34) (12)4(35) (12)3(45) (13)5(24) (13)4(25) (13)2(45) (14)5(23) (14)3(25) (14)2(35) (15)4(23) (15)3(24) (15)2(34) (23)5(14) (23)4(15) (23)1(45) (24)5(13) (24)3(15) (24)1(35) (25)4(13) (25)3(14) (25)1(34) (34)5(12) (34)2(15) (34)1(25) (35)4(12) (35)2(14) (35)1(24) (45)3(12) (45)2(13) (45)1(23) 3(12)(45) 4(12)(35) 5(12)(34) 2(13)(45) 4(13)(25) 5(13)(24) 2(14)(35) 3(14)(25) 5(14)(23) 2(15)(34) 3(15)(24) 4(15)(23) 4(23)(45) 4(23)(15) 5(23)(14) 1(24)(35) 3(24)(15) 5(24)(13) 1(25)(34) 3(25)(14) 4(25)(13) 1(34)(25) 2(34)(15) 5(34)(12) 1(35)(24) 2(35)(14) 4(35)(12) 1(45)(23) 2(45)(13) 3(45)(12) (123)45 (123)54 (124)35 (124)53 (125)34 (125)43 (134)25 (134)52 (135)24 (135)42 (145)23 (145)32 (234)51 (234)15 (235)14 (235)41 (245)13 (245)31 (345)12 (345)21 4(123)5 5(123)4 3(124)5 5(124)3 3(125)4 4(125)3 2(134)5 5(134)2 2(135)4 4(135)2 2(145)3 3(145)2 1(234)5 5(234)1 1(235)4 4(235)1 1(245)3 3(245)1 1(345)2 2(345)1 45(123) 54(123) 35(124) 53(124) 34(125) 43(125) 25(134) 52(134) 24(135) 42(135) 23(145) 32(145) 15(234) 51(234) 14(235) 41(235) 13(245) 31(245) 12(345) 21(345) (123)(45) (124)(35) (125)(34) (134)(25) (135)(24) (145)(23) (234)(15) (235)(14) (245)(13) (345)(12) (45)(123) (35)(124) (34)(1250 (25)(134) (24)(135) (23)(145) (15)(234) (14)(235) (13)(245) (12)(345) (1234)5 (1235)4 (1245)3 (1345)2 (2345)1 5(1234) 4(1235) 3(1245) 2(1345) 1(2345) (12345) |
Simplex Update and Corrections
Four superfluous codes were printed in the list of possible Simplex lock combinations on page 12 of the Autumn 1991 issue.
The codes:
51 52 53 54 |
are unnecessary because they are already included in the list under a different guise.
The code 51 for instance, is the same as 15 because the push-buttons are pressed together.
Subsequently, this brings the total number of possible combinations down from 1085 to 1081.