3D-printed 'Robotic Button Basher' cracks phones' PINs using persistence, luck
Created by Justin Engler and Paul Vines, the bot simply guesses all the possible PIN combinations
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.It's not the most high-tech threat to your phone but it is 100 per cent effective: the Robotic Reconfigurable Button Basher (R2B2) cracks the PIN number safeguarding your phone by simply trying every possible combination.
Created by security researchers Justin Engler and Paul Vines for Def Con - the hacker conference hosted in Las Vegas - the R2B2 costs around $200 and can crack a PIN code in around 20 hours.
Of course, anyone could crack a PIN code in this way (there's only 10,000 possible combinations - you just have to try them all) but why waste your time when cheap robot labour can do the job for you?
Speaking to Forbes Engler and Vines described how they constructed the bot from a combination of off-the-shelf and 3D printed components. An open-source Arduino controller; a couple of $10 servomotors; a webcam to see when the robot succeeds, and some 3D-printed parts from the pair's local hackerspace were all it took.
Although running every combination takes nearly a full day, researchers have shown that 26% of smartphone users use one of twenty most common PIN codes - either sequential codes (1234 is the most common), repeated digits (1111 and the like) or 'patterned' numbres (the cruciform 2468 or 'straight down the middle' 2580).
R2B2 did hit a problem with iPhones however, as iOS delays the user for each incorrect PIN they enter, leaving would-be thieves (or impatient robots) waiting hours before they can try again.
Still, Engler and Vines say the point of the project is simply to highlight how insecure four-digit PIN codes are. They're currently working on a version of their machine that will latch onto cash machines, as well as developing a version that uses electrodes instead of a 'finger' to work the touch pad. Dubbed Capacitative Cartesian Coordinate Brute-force Overlay (C3BO for short), this next-gen button basher should be revaled come Def Con next month.
Join our commenting forum
Join thought-provoking conversations, follow other Independent readers and see their replies
Comments