Is Your Garage Secure?

It may be insecure by design, but you can fix that!

By Jeremy Reeder, Certified Professional Locksmith. (C) 2009 The Safe House. Originally published in Keynotes, Volume 55, Issue 7, July 2009.

In this article, we’ll examine the security of a typical manually-operated garage-door and a typical electrically-operated garage-door. I will demonstrate major vulnerabilities in each of these systems and show how those vulnerabilities can be easily exploited to unlock the doors. Then we’ll discuss how the security of these doors can be improved by a professional installer.

Manually-operated door

In figure 1, we have a typical manually-operated garage-door in the process of being broken into. The door has a locking T-handle in its horizontal center. At the back of the handle is a cam. Inside the door, a spring-loaded latch is mounted on the left side and another on the right, each locking to its respective rail. (See the right latch in figure 2.) A single cable attaches the two latches and runs through the handle-cam. When the handle is unlocked with a key and rotated counter-clockwise, it rotates the cam to pull the two latches, releasing the door so it can be lifted.

Figures 1 thru 3

Vulnerability #1

The biggest problem I see with this design is that the latch-cable is completely exposed on the inside of the door. This makes it very easy to unlock the door with nothing more than a simple tool fashioned from a metal coat-hanger. That’s what was being done in figure 1.

For a demonstration of the tool in action, see figure 3. The door was lifted slightly to insert the tool under the left side. The hooked inside end of the tool was then lifted and hooked over the top of the cable. As pictured, the tool was then used to pull the cable downward. Since both latches are operated by the same cable, this action retracted both latches, unlocking the door very easily.

Vulnerability #2

The lock-cylinder within the T-handle uses a single-sided key with five cuts. The cylinder contains five simple wafer-tumblers. This is a rather low-security lock-cylinder that can be picked easily by raking. It’s the same with every garage-door handle I’ve seen, whether T-shaped or L-shaped.

Solution

Rather than cable-operated spring-latches, I suggest a sliding bolt that securely locks the door to the rail. One such lock is shown in figure 4. Mounted to the door, it does a nice job of securing the hot-rod car in figure

1. If the ability to lock or unlock the door from the outside is not required, this lock is a great choice. There’s no lock-cylinder to pick, and the lock-bolt sticks through the rail about an inch. The bolt is pretty difficult to grab and retract with a coat-hanger, but it has a padlock-shackle hole in the end just in case you’re paranoid.

Figures 4 & 5

If it is a requirement that the lock be operable from the outside of the door, then there are similar locks available that can be operated by the tail-piece of a rim-cylinder. I suggest a cylinder with good pick-resistance features, as any lock-cylinder that can be picked by raking should not be considered a high-security lock and is hardly worth installing.

Electrically-operated door

In figure 6, we see a typical electrically-operated garage-door on a two-car garage. The door is operated simply by pushing a button mounted on a wall inside the garage, or on a remote inside a car. A motor turns a sprocket that pulls a chain. The chain moves a trolley along a rail. The trolley is connected to the door by a steel arm. It pulls the arm to pull the door open and pushes it to lower the door back down.

Figure 6

The door ordinarily can’t be moved manually, but there is an emergency release-lever in case of power failure. A short red rope is attached to the lever so that people don’t have to reach so high to pull the lever. When the lever is pulled down, either directly or by the rope, the door-arm disengages from the chain-driven trolley. The door can then be lifted manually.

Modern electric garage-door openers can be operated by wireless remotes and are equipped with technology designed to prevent the door from being opened by unauthorized remotes. I presume that the latest garage-door openers effectively mitigate this threat, but the extent to which they do so is a subject of debate. I have not conducted an analysis of the security of radio communications in wireless garage-door systems, so any associated vulnerabilities will not be addressed in this article.

Vulnerability #1

The electric opener on this door came with a remote designed to be mounted on the visor of a car. And that’s usually where remotes like this are stored, as they’re too large to carry conveniently in a pocket. But the problem is that anyone who breaks into the car can get the remote and use it to get into the garage. Cars are pretty easy to get into, so this certainly undermines a garage’s security.

Vulnerability #2

This door is just as vulnerable as the manually-operated door examined earlier. The emergency release-lever can be pulled using the coat-hanger tool like the one shown earlier. In fact, it’s even easier on this door because the tool’s path is more direct. Insert the tool over the door near its horizontal center, as in figure 6. Slide it toward the center until it stops alongside the door-arm. Then pull the tool back, along the trolley-rail, until it hooks the release-lever. (On this particular door, it helps that the door has windows. But, with a little practice, this can be done on any electric garage-door.) With only a slight tug, it will cause the release-lever to pivot downward, releasing the door-arm from the trolley. (See figure 7.) Now the door can be lifted freely by hand.

Figure 7

Alternatively, the release-lever can be retracted from a few feet to either side of the door’s center with a flat metal rod. It has to be a lot stiffer than a hanger though. The rods used to fasten chain-link fencing to fence-post work well for this purpose.

Solution

As for preventing unauthorized access to an authorized remote (vulnerability #1), this can be achieved by having key-chain remotes instead of visor-mounted remotes. If you wouldn’t leave keys lying around visible inside your car, then you shouldn’t leave a plainly-visible garage-door remote on your car’s visor either. You can easily carry a key-chain remote with you and keep it in your pocket, greatly increasing your awareness of exactly where that remote is. So that’s what I recommend doing.

I spoke to a professional garage-door installer about vulnerability #2, regarding pulling the release-lever from outside of the door. He knew of no way to address this vulnerability. I searched for products that prevent tools from being used to operate the release lever, but I found none. So I developed my own solution.

On another two-car garage, I rendered this attach unsuccessful by mounting barriers along the top of the door. The purpose of the barriers is to prevent the insertion of tools that can be used to pull the release-lever. For maximum effectiveness, I chose to fasten an 8-foot barrier on the wall over the doorway and an additional, overlapping barrier on the door itself, the full width of the 16-foot door.

For the wall I used a single 8-foot piece of 3/4” angle-aluminum, which is being fastened to the wall in figure 8. For the door I used two 8-foot lengths of 1” angle-aluminum. In figure 9, one of these has been installed but the other side of the door is still bare. Note that the washers were placed between this barrier and the door to align it properly with the wall-mounted barrier. Also note that, in the testing phase, the pan-head screws on the wall-mounted barrier snagged the door-mounted barrier. So the holes were counter-sunk and the screws were replaced with flush-head screws. Then the second door-mounted barrier was installed as seen in figure 10.

Figures 8 thru 10

The coat-hanger only works well when the attacker has relatively unobstructed access at or near the horizontal center of the door. With these barriers installed, I was unable to insert the hanger within four feet of the center. I was barely able to insert it from five and a half feet away! As for the flat bar, it has worked well when the attacker had unobstructed direct access from four feet away or so. But with these barriers, I was unable to insert the bar anywhere along the entire width of the door.

Voila! Security! I’m sure there are other vulnerabilities that have not been addressed in this article, but we’ve found a few gaping security holes and found easy ways to close them. With thirty dollars’ worth of aluminum, a garage that could previously be opened in seconds by an amateur without special tools has been converted into an automobile fortress!