Security expert claims he hacked Knox Box
The expert says he was able to reproduce a key to access the security boxes; the company is investigating the claim
By EMS1 Staff
SAN FRANCISCO — A security expert says he has identified a flaw in heavy metal boxes that are found outside many locked companies and apartments and warns that criminals can gain access to these businesses by reproducing master keys issued only to firefighters.
The boxes manufactured by Arizona-based Knox Co. are outside of millions of apartment complexes and companies across the country, including cities like Chicago, Atlanta and San Francisco, according to Reuters. Knox is looking into the claim.
Justin Clarke, a cyber security researcher said he was able to create a key that was able to open a Knox Box by ordering a box and blank keys and reproducing the master key that is usually issued to firefighters from the Box.
Knox officials said they were unaware of any safety issues with the boxes and would look into it. An engineer with company said he found the hacking hard to believe.
"I'm not saying that somebody can't eventually make one, but I haven't seen it yet," Knox Engineer Dohn Trempala said.
Clarke claims that because only one master key is issued for firefighters in each city, it is possible for a reproduced key to give criminals access to every box in that city.
Using a metal file, and specific measurements from the box, Clarke says he was able to make a "hacked" key in about four hours.
"A highly motivated criminal with plenty of time on their hands and incredible focus could do this. All it takes is time, focus and intent," said Clarke told Reuters.
Lock expert Marc Weber Tobias told Reuters he thinks the hack is possible and that Knox can prevent it by changing how it ships its product.
"What he did is not technical. It's not sophisticated," Tobias said. "It's good research. He alerted everybody to a vulnerability."
Tobias said that Knox should ship its boxes to customers without locks and send the locks directly to the fire department that would then install both the box and lock. Currently, fire departments install the boxes with the locks in place.
The FBI and Department of Homeland Security are also looking into the issue, Trempala told Reuters.
Jerry Clark Friday, March 01, 2013 3:23:48 PM First off, you cant order blank keys from Knox. They have a strict policy that requires verification from the department whenever keys are ordered (which includes a security code), and they are sent directly to a verified department address.
Secondly, you cannot as a contractor or private individual order a Knox system without first having obtained a form from the local AHJ (Department) that has to be signed by a designated member of the agency who's authorized signature is on file with Knox.
As the article states, its not impossible, but I would be HIGHLY skeptical, and would want to see this individual recreate this claim before I'll be too concerned. 
Rick Bean Friday, March 01, 2013 3:34:18 PM Yes; I don't get it. I used to handle these transactions for my former department. How did this expert get a box and a key in the first place? Jerry Clark Friday, March 01, 2013 3:36:43 PM he didnt get them off of eBay as claimed. I tried about 10 different key words, and the best I could get were the boxes for private gates that still require the main lock to be ordered from Knox.
