AI
Code Storage Outside the Safe Breaks Security
Liberty Safe handed over a lock code to the FBI after receiving a search warrant. Omo and Rowley asked how that was possible for a disconnected safe. They bought a Liberty Safe TopLett, which uses a Securam lock. Inside the latch they found a Renaissance 78K0S microcontroller. They reverse engineered the firmware manually, writing their own disassembler. The lock had no secret backdoor. It uses two codes: manager and user. Liberty Safe kept a record of the manager code tied to the serial number. The end-user manual only mentions the user code. That practice made the code available to third parties.
Digital Locks Put Codes on the Outside
The Prologic L02 is Securam’s most popular digital lock, UL-certified. Omo and Rowley extracted the firmware from the keypad using the RL78 debug port. The debug password was all zeros. The unlock codes, including the super code, were stored in the keypad’s data flash — outside the safe. They were encrypted with XXTEA, but the 128-bit key sat in the same flash. A second model, the Scan Logic Basic, stored codes as plain text. The design put secrets on the attacker’s side of the steel.
Code Snatch Dumps Codes in 8 Seconds
The exploit tool, named Code Snatch, connects to the debug header visible through the battery door. It enters debug mode (not disabled), sends the zero password, injects a blob of code that dumps all flash contents over the debug UART. The entire readout takes 8 seconds. In the demo, the tool extracted code 001337 from a Prologic keypad. With that code, the safe opened immediately. The attack works on locks manufactured from May 2014 to March 2025, covering the RL78-based models.
Reset Heist Recovers Any Lock with Default Keys
The recovery feature on Prologic and Scan Logic locks lets a locksmith call Securam, enter a challenge, and receive a reset code. The algorithm uses XXTEA with an encryption code and recovery code. Both are symmetric: all secrets exist in the firmware. Omo and Rowley implemented the computation in a web app. They demonstrated resetting a lock using the default recovery code (99999) and default encryption code. The safe reset and opened with the default super code 111111. The attack works on any lock with recovery enabled and defaults unchanged. Securam’s own webinar said the encryption key is “usually never changed.”
15 Months of Disclosure, No Fix in Production
Omo and Rowley disclosed the vulnerabilities to Securam in April 2024. Securam responded with a threat: “We will refer this matter to our council for trade libel if you choose the route of public announcement.” The researchers delayed their talk by a year. In July 2025, Securam’s lawyers engaged, but no statement or fix was provided. A lock purchased in March 2025 still had codes in the keypad and the same default debug password. The researchers emphasized that organized crime and nation-state actors have the capability to build and use such tools.
UL Certification Lags Behind Modern Security
Almost all locks on the “Little Black Box” and “Phoenix” tool lists are UL high-security certified. Omo and Rowley argued that the UL standard is “wildly out of date for modern product security.” They called for a secure development framework: threat modeling, white-box testing, FIPS-level cryptographic evaluation, and side-channel resistance. The FDA and NHTSA have raised bars for medical devices and vehicles. The lock industry needs similar statutory requirements.
Notable Quotes
Usually never changed. Usually never changed. Mark Omo · ▶ 26:08
We will refer this matter to our council for trade libel if you choose the route of public announcement or disclosure. Securam response · ▶ 29:35
Your disclosure to our customers would interfere with our relationship with the customers. Securam response · ▶ 31:24
Key Takeaways
- Code Snatch extracts all safe codes in 8 seconds using a debug port with a default password.
- Reset Heist recovers any Securam lock with default encryption using a symmetric cipher.
- Over 3 million locks from 70% of the US smart lock market are vulnerable.
- Secure design must put unlock codes inside the safe, not in the keypad.
- UL high-security certification does not guarantee protection against firmware attacks.
About the Speaker(s)
Mark Omo is a professional security researcher and engineer with a background in consumer, medical, and aerospace products. He spends his days managing engineering teams and his nights hacking embedded hardware.
James Rowley is a professional security researcher and engineer focusing on embedded security and reverse engineering. He has presented at Hardwear.io and has been hacking since childhood. Both researchers conducted this work independently on nights and weekends.