Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security IT

Vulnerabilities Discovered In Prison SCADA Systems 128

Posted by Unknown Lamer from the release-the-prisoners dept.
phaedrus5001 writes with an excerpt from an Ars Technica article: "Researchers have demonstrated a vulnerability in the computer systems used to control facilities at federal prisons that could allow an outsider to remotely take them over, doing everything from opening and overloading cell door mechanisms to shutting down internal communications systems. ... The researchers began their work after [John] Strauchs was called in by a warden to investigate an incident in which all the cell doors on one prison's death row spontaneously opened."
This discussion has been archived. No new comments can be posted.

Vulnerabilities Discovered In Prison SCADA Systems More

Vulnerabilities Discovered In Prison SCADA Systems

Comments Filter:

  • Uh oh (Score:1)

    by Anonymous Coward

    All your jails are belong to us!!

  • This research was published in July and presented at Defcon in august. The original Wired story is here.

  • Definitely not unexpected... (Score:3, Interesting)

    by Anonymous Coward on Monday November 07, 2011 @11:34PM (#37981628)

    The US has a corrections industry with an extremely strong lobby that pushes not just Congress, but judges (whom are elected) to be "tough on crime", or else they will be replaced by people on the bench who are.

    Of course, handing over this to the private sector means that any security other than the obvious is done at the bottom most cost.

    So, if one would expect a prison locking system to actually be secure from clued people, it wasn't in the contract and paid for, so it wasn't done. It is only a matter of time before this is used for hits on well known prisoners, either by people paid by rich victims, or a gang who managed to hire or coerce someone with IT knowledge.

    Think COs wouldn't stick a USB flash drive into a machine and run stuff? A good number actually wouldn't and stay to their sworn oath. Others would plug a USB flash drive into a computer either out of curiosity, or because they are getting paid by other people in a prison gang. Smuggling a Stuxnet variant in on a fingernail sized drive is a whole lot easier than smuggling in a bag of weed or meth.

    • The US has a corrections industry with an extremely strong lobby that pushes not just Congress, but judges...

      I keep seeing lots of post on Slashdot, about all the prisons that are privately owned.

      Are there really THAT many of them that have been outsourced? I don't know that I've ever heard of any for profit prisons in any state I've lived in.

      Where are all these private prisons located? I'm guessing most are in CA....but are they that prevalent across the entire US?

  • DUPE.

    I guess someone didn't turn down that neon-blue "romulan ale" being passed around at Defcon back in *AUGUST*. And damn, it must have been potent...

    Seriously, I've had some long benders, fierce hangovers, and have one friend who started their current drugs-n-alcohol extravaganza during the Clinton years, but it's an amazing coincidence that submitter AND /.'s editors have collectively been this far out of it since the news of Prison SCADA risks made the national news around that time.

    Hey, editors: be o

  • No connection to outside network.

  • 2 - don't allow employees to stick their usb drives in work computers
          Or,
    run Linux
          Or,
    disable Autorun in Windows

    3. problem solved

    Now pay me my $80,000 in consulting fee (minus the 40% that will be kicked back to the prison guard union of course)

    • An even easier solution: To open door, insert key and turn. Try and hack that...

      • Get ahold of metal, make lock pick. Steal key from guard, wait, insert, turn. Make mold out of soap, melt metal into it, insert into lock and turn.

        • One prisoner picking a lock or duplicating a key is not that large of a problem in most prisons.

          The door to every cell at the same time while controls tell the guy in the guard booth that everything is fine is a problem in most prisons. The dangers presented by automation is some systems is orders of magnitude greater than the dangers presented by un-automated processes given the same level of effort by an attacker.

          • Re:Sure, then multiply by one thousand (Score:4, Informative)

            by jbengt ( 874751 ) on Tuesday November 08, 2011 @10:34AM (#37984650)
            Last time I was in prison (on work) was a long time ago, before digital controls became ubiquitous. Opening every door to every cell would have been a big problem where the worst criminals were. (Some were known to do fun things like throw shit (literally) on guards when they walked by.) However, to get out of a cell block, and again to get out of the inner yard, and again to get outside of the prison walls, one had to walk through 10 foot long vestibules with guards at each end. The doors of the vestibule were hard-wired so that one could not open unless the other was closed.
    • Exactly. Hackers cannot remotely open cell doors if you connect the controls to any network. There is nothing wrong with a big lever and 2 armed guards.
      • +1 . There is such a thing as too much automatization/computerization

      • Exactly. Hackers cannot remotely open cell doors if you connect the controls to any network. There is nothing wrong with a big lever and 2 armed guards.

        Big lever: $80
        2 armed guards: $60,000 yearly
        SCADA-controlled deadlocks: $20,000 one-time fee, $400 yearly maintenance.

        The robot has paid for itself in less than half a year.

      • Re: (Score:2)

        by AmiMoJo ( 196126 )

        I don't know, the guys who work as guards tend not to be the sharpest tools in the shed. A well crafted text message appearing to come from the governor might be enough to convince one of them to pull it.

        • There is that, but the social engineering element exists whether the automated system is in place or not. Say there is a manual lever that opens all jail cells at once in one prison and a fully automated computerized system in another. In the first prison, the guard on duty, gets the text message (or phone call, or signed order) and hits the lever, opening all the doors. In the second prison, the guard on duty, gets the text message (or phone call, or signed order) and clicks a button with a mouse, opening

    • Yep another typically ignorant post by someone who thinks they know security.

      1 - Don't connect shit like this to the internet

      Yes the airgap-it-and-fuck-it approach works really well for the targetted attacks on SCADA systems.

      don't allow employees to stick their usb drives in work computers

      Easier said then done, especially since you just removed their network connections. Like it or not USB as a system to transfer data is here to stay. It needs to be managed not banned. Sure the burn a CD approach works well but these days you can't necessarily take for granted that the computers given to employees are capable of this

  • this stuff happening. you guys who have worked in corps know how it works.

    geek: "hey boss this shit is broken"

    boss: "how much will it cost to fix it"

    geek: "more than 0 dollars"

    boss: "fuck it. oh, and i didnt say that"

    • Yep, pretty much how it works in every corporation. Not gonna increase profit this quarter? Don't do it.

  • "Researchers have demonstrated a vulnerability in the computer systems used to control facilities at federal prisons that could allow an outsider to remotely take them over"

    By any chance are these SCADA units connected to the Internet, if so then the morons who implimented such a system should be locked up in prison, except they most probably would escape by utilizing some Windows virus. It is taken as given that these systems are running on Microsoft Windows? Give the history of these SCADA systems, who
  • I guess those 9 year old kids in China took the term jail break....literally.

  • open all doors maybe part of some fire plan / code in the software that is in place to do a fast open all and maybe based on code in other door locking systems (out side of prison) that unlocks all door in a fire.

    Now some link that will be a easy target.

  • Fox river is the next prison to be hit.

  • remote maintenance / outside companies. nuke plants don't take short cuts like that. Now maybe prisons should be at the same level or at least be more safe then any old system.

    • But...they do. Viruses do infect nuke plants from time to time due to sloppy practices.

    • Stuxnet managed to infiltrate Iran's nuclear facilities. There is no reason to believe security there is less stringent than it is in the US, Iran is possibly even more paranoid than the US is. There is also of course no reason to believe that Iranian scientists are harder to "social engineer" into sticking an infected USB key in a secure system than US scientists are - and that was the way the internal system got infected to begin with. Prison guards are probably easier to handle that way than scientists.
  • I worked in a county jail for a few days. The jail was new. Guards were still getting the hang of the door system operated from a single control room. These two prisoners in the hall, mopping the floor were joking about how doors would open and shut for no reason (guards learning how to use the system). As on queue three doors in a row open up. The two prisoners and I could see cars freaking driving on the road next door. One of these guys taps his mop to the window of the control room, points at the "road

    • Re: (Score:2)

      by 6Yankee ( 597075 )

      The two prisoners and I could see cars freaking driving on the road next door.

      SCADA - Several Criminals Are Driving Away

  • While I don't doubt that there are hackable vulnerabilities in these systems, I'll bet you a donut that the cited incident of all the doors on death row opening was human error, or even a bug in the software, and not a hacking attempt.

    • . . . the point, from a security perspective, is that if such things can happen because of machine or user error, then they can also be made to happen intentionally by an attacker. And, if it was machine error, that suggests than a would be attacker will be able to duplicate the error condition entirely computationally with no need for human interaction.

  • teddybear

    Like we didn't know this would happen.

  • Shut down all the garbage smashers on the detention level!

  • All of these problems could be reduced if you maintain physical separation between critical equipment and the outside Internet. Yes, it might require prison personnel to use a physically different computer to access the Internet but sometimes the inconvenience is justified. As far as court documents, the document handling parts of a prison would be on the Internet side of the separation. Of course, this could equally apply to nuclear power plants, chemical plants or any place where it is imperative to k

  • Too bad they did not have another faulty system at the same time that forced all the main water lines to blow, and drown all the inmates that are supposed to be dead in a few anyways....would save this country an enormous amount of money, me thinks.

Slashdot Top Deals

The Tao is like a glob pattern: used but never used up. It is like the extern void: filled with infinite possibilities.

Close