Need help cracking lock box system

thesatguy wrote

The electronic keypads automatically stop working every thirty days. This is a built-in security feature that was touted as added protection in the event someone lost their keypad or had it stolen. Once a month we call Supra's computer and get a numeric code that must be entered into each keypad to keep it from automatically deactivating. The 30 day automatic deactivation provided just one more level of security. If Supra cuts us off from being able to get the activation codes, we won't be able to use the key pads to open the lock boxes. If we could change the keypads so they would not automatically deactivate or if we could generate our own activation codes, we could continue to use our lock box system long enough to be able to switch over the system at

Steve Smith

Maybe I would not have plonked him if he would have been more diplimatic in his original post instead of showing up out of the blue sky saying he wanted to know defeating instructions.

He has never posted before that I know of and he didn't even read the FAQ first. It's customary to at least explain the situation better at first when wanting to know something involving security. All he really did was ramble on about who he was.

Coming here for the first time and asking information on how to 'crack' a lock box system is not the proper way to introduce yourself to a locksmith news group.

Like Key said it's not personal. I just didn't like his original style.

I can see the point of Supra "Locking" you out if no contract, but, what happens to the keys inside these locked box's?

Are you expected to incur the expense of having a Locksmith physically go tto each property to open it & make keys?

Something stinks in Denmark!!!!

Newnsie

did one the other day that failed... 2 minutes work...

--Shiva--

No, he is asking how to defeat the 30 day internal clock and while Supra's idea to automatically drop-dead every 30 days may be a benefit it also means that they must supply refresher codes forever. The contract probably 'is subject to change with notice' and they have told the mls to pay up each time. My guess is that if paying each time was part of the original deal mls wouldn't have selected this product. All they need is a simple key generator for the lockbox and they could generate their own keys forever. If it was me I would be suing Supra (GE) for theft since they have denied the lawful owner the legal use and benefit of his property.

If you have a problem with a lockbox - keyed and/or electronic - a locksmith would be the right place to get assistance. Clearly the mls purchased the lock boxes and its not a lease and now GE has purchased Supra and dropped the product line in favor of something that generates on-going monthly revenues. Remember when folks got Best locks installed in all the doors in their building; locksmiths couldn't rekey them or make keys because they couldn't get the key blanks. Folks were stuck with a building full of worthless locks that only one place could maintain. Some buyers understood that and were happy with that idea but third parties that came along later and were forced into replacing every lock in the building were not so happy. These lock boxes were not cheap and mls would not have made the purchase knowing the boxes could suddenly drop dead. Somebody probably scammed somebody here.

ethics. I take my ethics very seriously and I resent your implication to the contrary. My inquiry for help to this newsgroup is no different than someone who asks you to help them open the lock on THEIR house or THEIR car or THEIR safe, etc. This is OUR lock box system that we bought and paid for it with the expectation of being able to continue to use it as long as we desired.

Part of the security of such a system is that the keys (keypads) deactivate every month just in case one has fallen into the wrong hands or a realtor fails to return it. Think of it as a 'PIN'. The realtors keypads are re-activated once a month, verifying that they are still with the MLS.

Helping him re-activate the keypad is similar to getting giving him a PIN for an electronic lock. It allows anyone who has the keypad to open the device without proving that they are still with the MLS that contracted for the service.

If Steve were really a disgruntled Realtor who got tired of paying MLS fees, but who kept his keypad because, after all, he paid for it...... Well, lets just say that he'd have all the advantages of MLS without the fees.

Daniel

inquiring

Perhaps

mentioned

not

by

help

re-reading it, he is not

make it work as

would be of no value to

defined by the end user

don't know w/o being

as I read it, he is asking how to defeat Supras security. doesn't matter what he does or does not own. if he would get an answer on this open forum? it would be defeating instructions.

my¢

in

inquiring

Perhaps

mentioned

not

wrong by

help

re-reading it, he is not

make it work as

would be of no value to

defined by the end user

don't know w/o being

(keypads)

the wrong hands

The realtors

are still

giving him

the keypad to

the MLS that

of paying MLS

for it......

MLS without

agree !!! my point exactly...

You raise a valid concern, but it's not entirely correct. Access to the lock boxes is only one very small part of MLS membership. Agents still need access to our online MLS system to get property information and they still have to make appointments with the listing company to show properties. We are a small board and if a non member calls to make an appointment and indicates that they have a lock box key, it would soon be reported to our board office. For many many years we used the mechanical lock boxes that used the round keys. We never once had a problem with a Realtor who was no longer an MLS member using their old key. But, it could happen and that's one reason we went to the electronic system.

The Supra system has a means for locking out a "disgruntled Realtor". We can deactivate any Realtor's key pad by means of planning a virus-like program on the key pads of a few of the most active Realtors. The virus jumps from their key pads to every lockbox they open and it then "infects" the keypads of the next agents who shows the property and then from their keypads to every lockbox they open. It will quickly move throughout the whole system and lock out the disgruntled Realtor. Of course I realize that defeating the 30 day deactivating mechanism might also defeat this virus-like deactivation. If it doesn't, then it's possible that Supra could use the virus to deactivate the whole system circumventing any defeat of the automatic monthly deactivation.

If our attorney tells us that it's legal to continue to use the lock box system past our contract expiration and if it's also possible to do so without Supra's 30 day activation, it will be for a short term, probably no longer than 6 months. The small compromise to security done by not having the 30 day deactivation feature for this short period of time is a risk we can take. However, I realize that you still don't know if I am who I say I am. At this point I feel it's unlikely that we will be able to continue to use our lock box system without Supra's blessings. But, if someone here was able to assist us, I could prove my identity and supply that person with contact information to my board of Realtors where it could be easily verified.

Steve Smith

Glen Cooper wrote

Perhaps "crack" wasn't the best choice of words for use in the subject. All too often, a newsgroup post will get lost among numerous other posts and it will not get any replies. My choice of words was designed to invoke interest so it would be read. I should have read the faq first. I did read several posts before I posted and I didn't see any mention of a faq. In any case, I'm sorry to have barged in with that post without doing more research first.

Steve Smith

I've come in late on this, so forgive me if this has already been answered, but if the 30 day expiration is a feature, can it not also be turned off?

It may be a setting controlled by the code and such. Theoretically they could send you a code or somethgin that will just make them active forever. But I've not worked with this system, but it ld seem reasonable. On the other hand if you terminate your service with them, perhaps it would be in your best interest to continue for a month or so past when you begin to implement the new system. I am pretty sure however that if your contract ran out, and you told them that you wanted access just to retrieve your property, they have some mechanism to let you do so. It sounds great to think that someone could have a system that forces you to pay forever, but legally there are way s to force an exit strategy.

-- A

You raise a valid concern, but it's not entirely correct. Access to the lock boxes is only one very small part of MLS membership. Agents still need access to our online MLS system to get property information and they still have to make appointments with the listing company to show properties. We are a small board and if a non member calls to make an appointment and indicates that they have a lock box key, it would soon be reported to our board office. For many many years we used the mechanical lock boxes that used the round keys. We never once had a problem with a Realtor who was no longer an MLS member using their old key. But, it could happen and that's one reason we went to the electronic system.

The Supra system has a means for locking out a "disgruntled Realtor". We can deactivate any Realtor's key pad by means of planning a virus-like program on the key pads of a few of the most active Realtors. The virus jumps from their key pads to every lockbox they open and it then "infects" the keypads of the next agents who shows the property and then from their keypads to every lockbox they open. It will quickly move throughout the whole system and lock out the disgruntled Realtor. Of course I realize that defeating the

If our attorney tells us that it's legal to continue to use the lock box system past our contract expiration and if it's also possible to do so without Supra's 30 day activation, it will be for a short term, probably no longer than 6 months. The small compromise to security done by not having the 30 day deactivation feature for this short period of time is a risk we can take. However, I realize that you still don't know if I am who I say I am. At this point I feel it's unlikely that we will be able to continue to use our lock box system without Supra's blessings. But, if someone here was able to assist us, I could prove my identity and supply that person with contact information to my board of Realtors where it could be easily verified.

Steve Smith

doesn't matter if you are who you say you are or not. doesn't matter if its 6 months or a one time thing. doesn't matter what your attorney says. you are still asking us you help you defeat the system on this open forum for any and all eyes to see. I can't amagine that any professional Locksmith will help you defeat any type security system. although, I may feel for you and your problem. looks like you will probably have to have Supra's blessings.

g'day

"Key" wrote

I can be emailed privately at snipped-for-privacy@ctliving.net.

Steve Smith

on

I can be emailed privately at snipped-for-privacy@ctliving.net.

Steve Smith ================ private email or not. still doesn't matter. you snipped the part where I said "I can't amagine that any Professional Locksmith will help you defeat any type security system."

my2

Do you have your expired codes? All of them? If you do post them to a crypto or mathematic NG and see if anyone will take a shot at determining a pattern and by extension the algorithim by which they are generated.

-snip- My guess is that if paying each time was part of the original deal

The method by which the codes are generated may be very simple or very complex. It's also possible that they are simply a pre-determined series of random numbers programed into the firmware and there is no pattern at all.

This is I suppose a valid point. Still if the poster is being 100% truthful the feature seems to be being used more to the benefit of Supra than to that of the end users it was supposed to benefit.

This is what I was hinting at to him in a previous post but it doesn't sound like it easy or straightforward to disable it.

Theoretically they likely could but I don't see them doing so.

Not always w/o abandoning the entire system and starting over from scratch.