Some Background on Simplex Locks

No lock is one hundred percent secure. As any locksmith will tell you, even the best lock can be opened if one wishes to invest the time and resources. However, a good lock should at least be secure enough to prevent the average person from compromising it. Common sense dictates that a lock, which can easily be opened by anyone, is simply not a safe lock to use.

While an average person may not have the necessary skills and expertise to use a lock pick or a blowtorch, almost everyone has the ability to count, and the ability to count is all that is necessary to compromise a Unican/Simplex pushbutton lock.  In addition, one needn't count very high.  Only 1081 combinations are used, and in most cases this number is reduced considerably.

Although Simplex claims "thousands of combinations are available," in truth only 1081 combinations are used.  Another 1081 combinations are available in the guise of "high security half-step codes."  These are codes that require the user to push one or more buttons only halfway.  Because of the extreme difficulty in setting and using these half-step codes, Simplex advises against their use, and in most cases, does not even inform the user that these codes are available.  Naturally, the addition of 1081 combinations does not make the lock considerably more secure.  (If 2162 combinations seems like a large number, consider that a $5 Master lock has 64,000.)

It has been found that numerous organizations use Simplex locks as a primary lock source.  Among the guilty parties in the New York metropolitan area are Federal Express, United Parcel Service (UPS), Citicorp Center, John F. Kennedy International Airport, and the State University of New York at Stony Brook.  Others around the nation include General Motors, the State Department, McDonald's, NSA, and the University of Wisconsin.

The biggest offender is Federal Express, which uses Simplex locks on over 25,000 drop boxes nationally.  The drop boxes are particularly insecure because Federal Express uses the same combination for all of their drop boxes in every state on the east coast!  So by opening one drop box, we now have access to thousands.

Access was also gained to a UPS drop box -- in one shot.  UPS did not even bother to change the default combination, which is set by Simplex.  And, just like Federal Express, UPS figures that a single combination is good enough for every drop box.

Hacking Simplex Locks

What follows is a list of all possible combinations for Simplex locks.  They have been divided into four groups according to how many pushbuttons are used.  Listed after each group name is the total number of combinations in the group.  The numbers listed in parentheses refer to pushbuttons that must be pressed together.  If you find that none of the combinations appear to open the lock, then it may be a rare instance of a half-step code.  In this case, only the last number (or numbers if they are in parentheses) should be pressed in HALFWAY and held while the knob or latch is turned. Slowly press in the pushbutton(s) until you feel pressure.  If you hear a click then you have pushed the buttons in too far.  If all of this sounds complicated, then you are beginning to understand why it is that Simplex does not recommend the use of half-step codes, and subsequently why half-step codes are virtually never used.

Simplex locks come in many different shapes, sizes, and colors. However, the two models that you will most likely see are the 900 and the 1000 series.  The characteristic features of the 900 series are five black buttons spaced in a circular fashion on a round, metallic cylinder.  In addition, the 900 series utilizes a latch instead of a doorknob.  The 1000 series is much larger, with five (usually metallic) pushbuttons spaced vertically on a rectangular metal chassis.  Unlike the 900 series, the 1000 have a doorknob.

It is suggested that novices attempt their first hack on a Simplex 900 model.  If the latch is located below the buttons, then the procedure is as follows:  1) turn the latch counterclockwise to reset the lock;  2) enter a combination from the list;  3) turn the latch clockwise to open.  If the latch is located above the buttons then simply reverse this procedure.  Make sure that you reset the lock after each try.

To hack a 1000 model, simply enter a combination from the list and turn the knob clockwise.  You will hear clicks as you turn the knob, indicating that the lock has been reset.  It is sometimes difficult to tell when you have cracked a 1000 model by simply turning the knob.  When you do get the correct code, you will hear a distinctive click and feel less pressure as you turn the knob.You will find that turning the latch on a 900 model requires less wrist motion and makes much less noise than turning the knob on a 1000 model. These details seem trivial until you realize that you may have to turn the latch or doorknob a few hundred times before you crack the lock.

It cannot be stressed enough how much easier it is when you know the range.  For instance, if you know that only three digits are being used, then you do not have to waste time trying four digits.  One way to find out the range is to stand nearby while someone punches in the code.  You will hear distinctive clicks, which will give you an idea of the range.  If you cannot stand nearby then try hiding a voice activated tape recorder near the door.  The tape recorder will remain off until someone comes up to punch in the code.  You can then retrieve the recorder later at your convenience and listen for the telltale clicks.  It was found that this method only works in quiet areas, such as the inside of a building.  Another way to find out the range is to take a pencil eraser and carefully rub off a tiny bit of rubber on each of the pushbuttons.  When someone comes to enter the combination, they will rub off the rubber on all of the pushbuttons that they use, while leaving telltale traces of rubber on the pushbuttons that they do not use.  This method works particularly well because you eliminate pushbuttons, which drastically reduces the number of combinations that must be tried.

It has been found that certain ranges tend to be used more than others.  Group B (three pushbuttons) tends to be used in "low security areas," while Groups C and D tend to be used in areas which seem like they should be more secure.  A lock, which uses a combination from Group A, has never been found.  For some reason, the 1000 series mostly uses Group C (four pushbuttons).  In addition, most combinations tend to be "doubles," which require at least two of the pushbuttons to be pressed together.  When you decide on a particular range to start with, try the doubles first.  For instance, try "(12)345" before you try "12345."  A lock, which uses a triple, quadruple, or all five pushbuttons pressed at the same time has never been found.

Although a list of all the possible combinations is provided, you may find it useful to invest some time and record these codes onto cassette.  This makes it much easier for one person to hack a Simplex lock.  A walkman looks far less conspicuous than sheets of paper filled with numbers.

Finally, it is always good to take a few lucky shots before initiating a brute force hack. Always try the default combination "(24)3" before trying anything else.  Above all, DON'T give up! Even if you do not get the combination in ten minutes, you are still that much closer to figuring it out.  It is recommended that you do not stress yourself out trying every combination in one shot.  A few minutes a day will do just fine, and the thrill of achievement will be well worth the wait.

Changing Combinations on the 900 Series

You may change combinations to any sequence you wish, using any or all buttons, in any order, separately or pushed at the same time with other buttons.  You cannot use the same button more than once in a combination.