Slashdot Mirror
Vulnerabilities Discovered In Prison SCADA Systems
phaedrus5001 writes with an excerpt from an Ars Technica article: "Researchers have demonstrated a vulnerability in the computer systems used to control facilities at federal prisons that could allow an outsider to remotely take them over, doing everything from opening and overloading cell door mechanisms to shutting down internal communications systems. ... The researchers began their work after [John] Strauchs was called in by a warden to investigate an incident in which all the cell doors on one prison's death row spontaneously opened."
All your jails are belong to us!!
The terrorists will get loose, we must spend money and fix this problem. Seriously, what benefit to the public is given by disclosing that there are serious security flaws with prison controls. Smells like fear to me.
This research was published in July and presented at Defcon in august. The original Wired story is here.
Remember, there were no nuclear weapons before women were allowed to vote.
With the holiday layoffs occurring and the housing market still in shambles, it is only fitting somebody has found a way to break into prison for the free room and board.
The US has a corrections industry with an extremely strong lobby that pushes not just Congress, but judges (whom are elected) to be "tough on crime", or else they will be replaced by people on the bench who are.
Of course, handing over this to the private sector means that any security other than the obvious is done at the bottom most cost.
So, if one would expect a prison locking system to actually be secure from clued people, it wasn't in the contract and paid for, so it wasn't done. It is only a matter of time before this is used for hits on well known prisoners, either by people paid by rich victims, or a gang who managed to hire or coerce someone with IT knowledge.
Think COs wouldn't stick a USB flash drive into a machine and run stuff? A good number actually wouldn't and stay to their sworn oath. Others would plug a USB flash drive into a computer either out of curiosity, or because they are getting paid by other people in a prison gang. Smuggling a Stuxnet variant in on a fingernail sized drive is a whole lot easier than smuggling in a bag of weed or meth.
DUPE.
I guess someone didn't turn down that neon-blue "romulan ale" being passed around at Defcon back in *AUGUST*. And damn, it must have been potent...
Seriously, I've had some long benders, fierce hangovers, and have one friend who started their current drugs-n-alcohol extravaganza during the Clinton years, but it's an amazing coincidence that submitter AND /.'s editors have collectively been this far out of it since the news of Prison SCADA risks made the national news around that time.
Hey, editors: be on the lookout for two other SCADA stories you've no doubt missed since August: the SCADA security work done by my friends at Idaho National Laboratory and the Duqu worm (aka spawn-of-Stuxnet).
No connection to outside network.
2 - don't allow employees to stick their usb drives in work computers
Or,
run Linux
Or,
disable Autorun in Windows
3. problem solved
Now pay me my $80,000 in consulting fee (minus the 40% that will be kicked back to the prison guard union of course)
Most SCADA systems are written by engineers. One of the primary concerns is getting all of the software into a small space (usually something like a 32k prom chip). They aren't usually coded to be security safe (breaking in requires physical access to the hardware, since they aren't usually connected to the internet, and changing the firmware requires pulling the tape off the top of the chip, putting it in a uv eraser for 15 minutes, then reprogramming it. SCADA software involves a lot of bit-banging software. Its usually housed in an ugly metal box. There usually isn't a CAT5 connection, there usually is an RS232 connection.
this stuff happening. you guys who have worked in corps know how it works.
geek: "hey boss this shit is broken"
boss: "how much will it cost to fix it"
geek: "more than 0 dollars"
boss: "fuck it. oh, and i didnt say that"
"Researchers have demonstrated a vulnerability in the computer systems used to control facilities at federal prisons that could allow an outsider to remotely take them over"
By any chance are these SCADA units connected to the Internet, if so then the morons who implimented such a system should be locked up in prison, except they most probably would escape by utilizing some Windows virus. It is taken as given that these systems are running on Microsoft Windows? Give the history of these SCADA systems, who in their right mind, in this day and age would ever connect such systems to the Internet.
Slammer worm crashed Ohio nuke plant net Aug 2003
Did MS Blaster crash the power grid? Aug 2003
I guess those 9 year old kids in China took the term jail break....literally.
The unforunate thing is SCADA is not designed with security in mind, in general. As AC says some posts above --^ , the actual devices on doors, valvles, etc. usually use RS232.
Then a bus to get the data to the actual control computers. This could be RS422 I suppose, scientific stuff tends to use HIPB & GPIB, HVAC uses ARCNet (ARCNet uses token passing, so it has deterministic worst-case latency) and there's loads of RS232-to-ethernet converters on the market. Very few are SSH.
So, if you get access to that network, there are the controls anyway. So really, SCADA should be kept offline. SCADA software has not emphasized security either (from what I've read) since the whole thing was assumed to not be network connected.
So, keep it all offline, no problem. Make it internet accessible and you're probably boned. These places really should just have an "outside" computer for this and keep the SCADA offline where it belongs.
If I were designing a SCADA system from scratch, particularly where someone insisted on a network connection to remotely monitor the SCADA (which is why they are online at all to begin with, in general), ssh is really a must on the actual devices (they could have the ssh key printed on them). These obviously should still be on a seperate SCADA network. The SCADA computer itself has to run a secure OS, the ssh keys are particularly sensitive. No matter what OS, it really shouldn't have any extraneous ports serving up various services. The "remote" link, the best security-wise would be a leased line (and no internet connection on either end.). Second, a VPN, where nothing on either end of the VPN can reach the internet. Next best would be ssh. Both the VPN and ssh should be restricted by IP address. Even with just ssh and no IP restriction this'd be a pretty hard nut to crack.
open all doors maybe part of some fire plan / code in the software that is in place to do a fast open all and maybe based on code in other door locking systems (out side of prison) that unlocks all door in a fire.
Now some link that will be a easy target.
Fox river is the next prison to be hit.
remote maintenance / outside companies. nuke plants don't take short cuts like that. Now maybe prisons should be at the same level or at least be more safe then any old system.
An even easier solution: To open door, insert key and turn. Try and hack that...
Exactly. Hackers cannot remotely open cell doors if you connect the controls to any network. There is nothing wrong with a big lever and 2 armed guards.
Get ahold of metal, make lock pick. Steal key from guard, wait, insert, turn. Make mold out of soap, melt metal into it, insert into lock and turn.
There are vast numbers of SCADA systems that can be controlled by dialup modems. To find their numbers, just dial every number there is to see if you get a connection.
I once worked for a company that made SCADA software. Their package included of all the brain-dead things an Internet Explorer ActiveX control that was a port of their entire windows package to ActiveX. The company president told me that there was a natural gas tank somewhere that was controlled by this that had no password!
So all you need to do to make a natural gas tank blow up is to crawl the internet looking for a great, big ActiveX control that loads without a password. If you've found it and you load it in IE, then you'll get a schematic view of the tanks controls and sensors. Just dial the pressure way up, and it will explode.
But...they do. Viruses do infect nuke plants from time to time due to sloppy practices.
Fuck you.
Time to get out the wire cutters and solder, wrenches and remove these devices. Or FIRE the idiot who connected these devices to the web. If you are still using SCADA knowing what we know, you are 100% liable for all death, damage, and destruction. Better not let it get to a jury trial with me.
the idea of putting people in prison prison for "being" a hacker or "criminal" or any "dangerous" label you want to apply to them is morally reprensible. It's only right to punish people for stuff they DID. Not for accessory stuff such as *being* something. What if you had the ability to do something like that hack? What if you were targeted by the state for it? People seem to be forgetting the philosophical foundations behind our civilizations real fast.
We need a new law, use scada, get cracked, go to prison for stupidity.
Then (for about the only one real time) the government can create teh jobs!
By re-building the manual labor jobs to replace the scada lazy police state crackerheads and make a secure america again.
Hire the man to go out to the dam each day and turn the knob by hand
An electric door lock is fine when the door can't cause harm. A Prison with no doors can cause harm.
Predictions
After the ows is beaten down off the streets into the hospital by the oath breaking police state.
After the people finally withdraw consent because of the corruption in the US Government.
After the cult of power is indicted, and found guilty, and put away of course.
After the banksters printing press is smashed
til then, we might need the exploit a while longer to let the people who did nothing back out.
(queue the "You got another thing coming!" - Judas Priest)
I think you mean to indicate, they...say they don't do that.
I don't know what the hell you mean by "remote maintenance"... but plenty of remote industries do connect things. In fact, even if you're a big contractor with a policy against it--you probably do in practice. Oil, chemical, defense, water purification or processing, sewage, electric, telephony... they're *ALL* hooked up to the Internet.
And nuke plants. They've done it and not even fucking known about it.
But you know what, I'm not gonna cite it. I'll let you find the multiple published examples yourself.
Stuxnet managed to infiltrate Iran's nuclear facilities. There is no reason to believe security there is less stringent than it is in the US, Iran is possibly even more paranoid than the US is. There is also of course no reason to believe that Iranian scientists are harder to "social engineer" into sticking an infected USB key in a secure system than US scientists are - and that was the way the internal system got infected to begin with. Prison guards are probably easier to handle that way than scientists.
Real companies already do this. I worked as a computer tech at a large oil company in 1998. Their important computers were protected, with security guards on-site, and if you got past them and also had the correct electronic key-card for entry, you couldn't mess with the machines anyway because their input/output methods were LOCKED DOWN. The only way you'd get something off one of those machines would be to open it and take the hard drive out, and even then, you'd just get the small change stored on a dumb terminal. The security for the actual SERVERS running things was like Fort Knox in comparison to these client desktops.
If they could figure out security this well 1.5 decades ago, any company caught with their pants down in this century deserves to be pwnd.
Don't worry, you don't sound tinfoil-hattish. You do however, sound like a giant, moronic douchebag. Please don't procreate.
not really.
if anyone can do it, it's some prison contractor/electrician with google - he's the one who knows which locks are at which address, which nodes connected to which.
unless the alternative to solitary is giving him stacks of manuals, wire pliers and a laptop with internet access and couple of radio-modems.but the powers that be were more worried probably about control systems in some of their other. more important than prison, systems, for no good reason. long solitary is just used as a way to keep a lid on prisoners making statements nowadays and because that's closest you have to legal torture(if you need the prisoner to fess up to some crimes, because you don't know what he did - sweet eh?).
world was created 5 seconds before this post as it is.
What makes you thinking like that?
Do you really understand the kids in China?
I doubt that.
Why the FUCK are these things connected to the outside world?!
FUUUUUUUUUUUUUUUUUUUU
How is running Linux a solution?
Yep another typically ignorant post by someone who thinks they know security.
1 - Don't connect shit like this to the internet
Yes the airgap-it-and-fuck-it approach works really well for the targetted attacks on SCADA systems.
don't allow employees to stick their usb drives in work computers
Easier said then done, especially since you just removed their network connections. Like it or not USB as a system to transfer data is here to stay. It needs to be managed not banned. Sure the burn a CD approach works well but these days you can't necessarily take for granted that the computers given to employees are capable of this anymore.
run Linux
Yes the run-linux-and-fuck-it approach works really well for the targetted attack s on SCADA systems. This is as ignorant as post number 1. Actually worse so since you don't actually get the option of what system you run. You will get given the system from the vendor who provided you with the SCADA software. It will be locked down. This is not optional, or do you think people like attempting to maintain Windows NT4 computers for shits and giggles?
Here's an exercise, try find a SCADA vendor who will let you dictate what system you want to buy.
disable Autorun in Windows
My god you said something sensible from a security standpoint. But you've just closed one vector. One of the very many vectors, the weakest one being that humans can click on things.
problem solved
No sir you're did not solve the problem. You and people like you who take haphazard approaches to security and think you're so clever ARE the problem.
Not every prison is maximum security, just like not every prisoner is convicted of violent crimes. So it may be desirable to evacuate a prison if there is a fire or natural disaster or stuff of that ilk. Remoter administration may be useful for day to day operations too. So maybe it is best to avoid an antitechnology stance and ask how we can make these systems mor secure.
I worked in a county jail for a few days. The jail was new. Guards were still getting the hang of the door system operated from a single control room. These two prisoners in the hall, mopping the floor were joking about how doors would open and shut for no reason (guards learning how to use the system). As on queue three doors in a row open up. The two prisoners and I could see cars freaking driving on the road next door. One of these guys taps his mop to the window of the control room, points at the "road to freedom". The guard closed those doors pretty fast and was visibly embarrassed. Good times. :-)
NEVER underestimate the human factor. USB keys! Sheesh!
Yep another typically ignorant post by someone who thinks they know security.
1 - Don't connect shit like this to the internet
Yes the airgap-it-and-fuck-it approach works really well for the targetted attacks on SCADA systems.
When did 'disabling all internet connectivity and don't let employees surf porn sites' suddenly become a bad approach? That's pretty much _THE_ most important security precaution you do when dealing with such systems.
What are you, a windows admin playing security professional?...
don't allow employees to stick their usb drives in work computers
Easier said then done, especially since you just removed their network connections. Like it or not USB as a system to transfer data is here to stay. It needs to be managed not banned. Sure the burn a CD approach works well but these days you can't necessarily take for granted that the computers given to employees are capable of this anymore.
It _IS_ easier said than done... But to do it you only need to disconnect all external USB ports, so it's not _THAT_ hard to do.
And why the fuck should the employees be using USB sticks anyway? The box should be locked shut with a padlock and threat of firing anyone who tries to mess around with the system.
Basic security, something you obviously know shit about.
run Linux
Yes the run-linux-and-fuck-it approach works really well for the targetted attack s on SCADA systems. This is as ignorant as post number 1. Actually worse so since you don't actually get the option of what system you run. You will get given the system from the vendor who provided you with the SCADA software. It will be locked down. This is not optional, or do you think people like attempting to maintain Windows NT4 computers for shits and giggles?
Here's an exercise, try find a SCADA vendor who will let you dictate what system you want to buy.
It is an option, buy from a different vendor. If all the prisons get new requirements from the government to use secured linux computers with specific software and configuration, you bet the vendors will be crawling over each other to meet those requirements.
Yes the airgap-it-and-fuck-it approach works really well for the targetted attacks on SCADA systems.
out of curiosity, is it the airgapping to which you disagree, or the fuck-it attitude?
While I agree that any security measure when combined with the 'fuck-it' is utterly worthless, I kind of thought that airgapping critical systems referred to ensuring that they are completely inaccessible unless you are 1) physically at that specific terminal or 2) physically at a similarly secured terminal on an airgapped intranet.
if it is a matter of applying manufacture updates to the critical systems, I'm of the opinion that they can make a (big)house call to physically apply the updates for what they are being paid. Considering the amount of money that we throw at these problems, $0.555/mile is a pittance.
While I don't doubt that there are hackable vulnerabilities in these systems, I'll bet you a donut that the cited incident of all the doors on death row opening was human error, or even a bug in the software, and not a hacking attempt.
Michael J.
Root, God, what is difference?
If only life were so simple;
1. Don't allow people to steal.
2. Don't allow people to murder.
3. Problem solved. (No criminals, no jail, no jail scada vuln.)
"Shit" like this generally isn't just "connected to the internet". Your assumption that it is doesn't solve any problems. Guess what - the guys with the most motivation to subvert a jail scada system aren't going to find a way to get to the internet to then try and find a way back into the scada network when they're that physically close to it.
Linux can be subverted, maybe not as commonly as windows, but it happens.
Disabling autorun doesn't prevent someone from deliberately executing a program.
Guess what? Bad people do bad things that you don't expect.
Security isn't a problem to be solved. It's a process to be applied attempt to prevent or remediate a large number of problems. Most problems are human problems. Those guards for instance, are a strange mix - ignorant, bribe-able and complacent. One misses a USB key coming in from a visitor, another is bribed to allow "some alone time in the library", and a third has no idea what the difference is between the blue and yellow network jacks in the deputy wardens office that the well-behaved prisoner works in. Any of these in isolation is fine, but in combination...
And yes, IAAISE. (I Am An Internet Security Expert). And yes, I do work in the field of industrial network security (although, not jails). I suggest you go and read some Kevin Mitnick before proffering up your "expertise" again.
One prisoner picking a lock or duplicating a key is not that large of a problem in most prisons.
The door to every cell at the same time while controls tell the guy in the guard booth that everything is fine is a problem in most prisons. The dangers presented by automation is some systems is orders of magnitude greater than the dangers presented by un-automated processes given the same level of effort by an attacker.
Excuse me sir, would you please remove the pole from your ass. It makes you look uppity, and others feel uncomfortable.
Unless you're talking about a single cell in a municipal jail in some small town somewhere, I'm highly dubious that any serious vendor is offering a SCADA system for jail cells on the order of $20k for installation and an annual support contract of $400.
. . . the point, from a security perspective, is that if such things can happen because of machine or user error, then they can also be made to happen intentionally by an attacker. And, if it was machine error, that suggests than a would be attacker will be able to duplicate the error condition entirely computationally with no need for human interaction.
teddybear
Like we didn't know this would happen.
Comon, it's a fairly justified rant really - if you hear that kinda bollocks every day, you gotta crack some time....
Aww crap - my post was ambigious - I meant the GP rant...maybe... or whatever - I give up today....
It takes a lot more than opening doors at a prison to escape. Even if you open the magnetic doors and confuse the computers, you still have to get past the physical locks, non-networked cameras, and physical guards to get out. And even if you can get past all that and the fences, you'll just be adding years onto your sentence when you get caught. Why would someone like Mitnick be stupid enough to risk a 20-year stint at a Maximum security prison just to escape a 5-year stint at a minimum security one?
SJW: Someone who has run out of real oppression, and has to fake it.
The box should be locked shut with a padlock and threat of firing anyone who tries to mess around with the system.
So when the system needs maintenance and configuration what happens? Oh, that's right, your magical Linux system never needs maintenance, and you're so perfect that your design will never need updating. You don't do this out in the real world, do you?
If all the prisons get new requirements from the government to use secured linux computers
Then the new attack vector will target Linux computers. And all the new systems will suck for the first five years as the programmers learn a completely new interface and new set of APIs. And gaping security holes will appear as they try to work around the new OS. Again, it's pretty obvious you really don't do this out in the real world.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
Shut down all the garbage smashers on the detention level!
Remove that capability. There is no reason to evacuate prisoners and risk their escape.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
All of these problems could be reduced if you maintain physical separation between critical equipment and the outside Internet. Yes, it might require prison personnel to use a physically different computer to access the Internet but sometimes the inconvenience is justified. As far as court documents, the document handling parts of a prison would be on the Internet side of the separation. Of course, this could equally apply to nuclear power plants, chemical plants or any place where it is imperative to keep hackers or viruses from taking over vital systems.
Too bad they did not have another faulty system at the same time that forced all the main water lines to blow, and drown all the inmates that are supposed to be dead in a few anyways....would save this country an enormous amount of money, me thinks.
You just don't get it do you?
You as a contractor are proposing a system that doesn't exist and won't meet the customer's requirement.
Locking down a system physically makes it overly difficult to maintain. "_THE_" most important security precaution is not removing something that may be useful. "_THE_" most important security precaution is thinking about security in a systemic approach. All your fancy projects will get owned by their own employees.
You're only saving grace is that you don't actually work in the industry which is clearly shown by your persistence that a) you can find a vendor which will provide you with a SCADA system that runs linux, and b) you think that actually means anything when it comes to procurement of such a system. For this I am thankful.
The Fuck-it mainly.
There's much to be said about air-gapping systems, however often these systems exist for data collection and their whole purpose is to exist as part of a larger network which for pretty much any multi-national company will include some form of connection to the internet.
Security is something that should be driven not by an airgap, but by a complete culture, by network design. Saying simply that something should not be connected to the internet is ignoring the realities of why many of these systems exist, and is ignoring the fact that there are many perfectly secure ways to allow this kind of data transfer.
There are so many plants these days basically run by remote control that it's time people started thinking about it on the whole rather than focusing their energies on fruitlessly locking down a single system. SCADA is a complex beast.
Would your rather an uppity and anally retentive person designing your network, or someone why appears to have just taken Comp101 and calls themselves a security expert.
Wow. The difference between trying to see things from the other side of the lawn and having an opinion of my own seem to have converged. I never meant to say Mitnick deserved to be in solitary, I was merely trying to understand why the other side felt it was justified. My bad for not being specific enough.