Slashdot Mirror
Vulnerabilities Discovered In Prison SCADA Systems
phaedrus5001 writes with an excerpt from an Ars Technica article: "Researchers have demonstrated a vulnerability in the computer systems used to control facilities at federal prisons that could allow an outsider to remotely take them over, doing everything from opening and overloading cell door mechanisms to shutting down internal communications systems. ... The researchers began their work after [John] Strauchs was called in by a warden to investigate an incident in which all the cell doors on one prison's death row spontaneously opened."
All your jails are belong to us!!
This research was published in July and presented at Defcon in august. The original Wired story is here.
Remember, there were no nuclear weapons before women were allowed to vote.
The US has a corrections industry with an extremely strong lobby that pushes not just Congress, but judges (whom are elected) to be "tough on crime", or else they will be replaced by people on the bench who are.
Of course, handing over this to the private sector means that any security other than the obvious is done at the bottom most cost.
So, if one would expect a prison locking system to actually be secure from clued people, it wasn't in the contract and paid for, so it wasn't done. It is only a matter of time before this is used for hits on well known prisoners, either by people paid by rich victims, or a gang who managed to hire or coerce someone with IT knowledge.
Think COs wouldn't stick a USB flash drive into a machine and run stuff? A good number actually wouldn't and stay to their sworn oath. Others would plug a USB flash drive into a computer either out of curiosity, or because they are getting paid by other people in a prison gang. Smuggling a Stuxnet variant in on a fingernail sized drive is a whole lot easier than smuggling in a bag of weed or meth.
So the guards can telecommute.
No connection to outside network.
2 - don't allow employees to stick their usb drives in work computers
Or,
run Linux
Or,
disable Autorun in Windows
3. problem solved
Now pay me my $80,000 in consulting fee (minus the 40% that will be kicked back to the prison guard union of course)
this stuff happening. you guys who have worked in corps know how it works.
geek: "hey boss this shit is broken"
boss: "how much will it cost to fix it"
geek: "more than 0 dollars"
boss: "fuck it. oh, and i didnt say that"
"Researchers have demonstrated a vulnerability in the computer systems used to control facilities at federal prisons that could allow an outsider to remotely take them over"
By any chance are these SCADA units connected to the Internet, if so then the morons who implimented such a system should be locked up in prison, except they most probably would escape by utilizing some Windows virus. It is taken as given that these systems are running on Microsoft Windows? Give the history of these SCADA systems, who in their right mind, in this day and age would ever connect such systems to the Internet.
Slammer worm crashed Ohio nuke plant net Aug 2003
Did MS Blaster crash the power grid? Aug 2003
I guess those 9 year old kids in China took the term jail break....literally.
So some well connected contractor can collect the max amount of ongoing maintenance work over many state systems with the min number of remote security cleared staff.
As for "security flaws with prison controls" - your paying top $ in state taxes per prison control system for contractors ect.
You have the right to know where your state tax $ will go and what your getting from your prison system.
Domestic spying is now "Benign Information Gathering"
open all doors maybe part of some fire plan / code in the software that is in place to do a fast open all and maybe based on code in other door locking systems (out side of prison) that unlocks all door in a fire.
Now some link that will be a easy target.
Fox river is the next prison to be hit.
remote maintenance / outside companies. nuke plants don't take short cuts like that. Now maybe prisons should be at the same level or at least be more safe then any old system.
Where the hell have you been the last 10 years, Prison? EPROMS were obsolete 10 years ago.
An even easier solution: To open door, insert key and turn. Try and hack that...
Exactly. Hackers cannot remotely open cell doors if you connect the controls to any network. There is nothing wrong with a big lever and 2 armed guards.
Get ahold of metal, make lock pick. Steal key from guard, wait, insert, turn. Make mold out of soap, melt metal into it, insert into lock and turn.
But...they do. Viruses do infect nuke plants from time to time due to sloppy practices.
That's probably about how long ago they were installed.
the idea of putting people in prison prison for "being" a hacker or "criminal" or any "dangerous" label you want to apply to them is morally reprensible. It's only right to punish people for stuff they DID. Not for accessory stuff such as *being* something. What if you had the ability to do something like that hack? What if you were targeted by the state for it? People seem to be forgetting the philosophical foundations behind our civilizations real fast.
Stuxnet managed to infiltrate Iran's nuclear facilities. There is no reason to believe security there is less stringent than it is in the US, Iran is possibly even more paranoid than the US is. There is also of course no reason to believe that Iranian scientists are harder to "social engineer" into sticking an infected USB key in a secure system than US scientists are - and that was the way the internal system got infected to begin with. Prison guards are probably easier to handle that way than scientists.
it's still a huge problem if any node in the prison can be used to control the whole network of scada devices. so the network design would play a huge part. really, home automation parts would be easier to build separate networks for control systems with than scada, networks for observation and for control should be separate and of course the wiring shouldn't even go outside from the prison unit they're used to control. problem is they've just in just about all cases it seems built a prison/factory wide network they just attach stuff to.
remote link = security camera pointed at the display showing lock states and the guys watching them.
world was created 5 seconds before this post as it is.
not really.
if anyone can do it, it's some prison contractor/electrician with google - he's the one who knows which locks are at which address, which nodes connected to which.
unless the alternative to solitary is giving him stacks of manuals, wire pliers and a laptop with internet access and couple of radio-modems.but the powers that be were more worried probably about control systems in some of their other. more important than prison, systems, for no good reason. long solitary is just used as a way to keep a lid on prisoners making statements nowadays and because that's closest you have to legal torture(if you need the prisoner to fess up to some crimes, because you don't know what he did - sweet eh?).
world was created 5 seconds before this post as it is.
Yep another typically ignorant post by someone who thinks they know security.
1 - Don't connect shit like this to the internet
Yes the airgap-it-and-fuck-it approach works really well for the targetted attacks on SCADA systems.
don't allow employees to stick their usb drives in work computers
Easier said then done, especially since you just removed their network connections. Like it or not USB as a system to transfer data is here to stay. It needs to be managed not banned. Sure the burn a CD approach works well but these days you can't necessarily take for granted that the computers given to employees are capable of this anymore.
run Linux
Yes the run-linux-and-fuck-it approach works really well for the targetted attack s on SCADA systems. This is as ignorant as post number 1. Actually worse so since you don't actually get the option of what system you run. You will get given the system from the vendor who provided you with the SCADA software. It will be locked down. This is not optional, or do you think people like attempting to maintain Windows NT4 computers for shits and giggles?
Here's an exercise, try find a SCADA vendor who will let you dictate what system you want to buy.
disable Autorun in Windows
My god you said something sensible from a security standpoint. But you've just closed one vector. One of the very many vectors, the weakest one being that humans can click on things.
problem solved
No sir you're did not solve the problem. You and people like you who take haphazard approaches to security and think you're so clever ARE the problem.
I worked in a county jail for a few days. The jail was new. Guards were still getting the hang of the door system operated from a single control room. These two prisoners in the hall, mopping the floor were joking about how doors would open and shut for no reason (guards learning how to use the system). As on queue three doors in a row open up. The two prisoners and I could see cars freaking driving on the road next door. One of these guys taps his mop to the window of the control room, points at the "road to freedom". The guard closed those doors pretty fast and was visibly embarrassed. Good times. :-)
NEVER underestimate the human factor. USB keys! Sheesh!
While I don't doubt that there are hackable vulnerabilities in these systems, I'll bet you a donut that the cited incident of all the doors on death row opening was human error, or even a bug in the software, and not a hacking attempt.
Michael J.
Root, God, what is difference?
One prisoner picking a lock or duplicating a key is not that large of a problem in most prisons.
The door to every cell at the same time while controls tell the guy in the guard booth that everything is fine is a problem in most prisons. The dangers presented by automation is some systems is orders of magnitude greater than the dangers presented by un-automated processes given the same level of effort by an attacker.
Unless you're talking about a single cell in a municipal jail in some small town somewhere, I'm highly dubious that any serious vendor is offering a SCADA system for jail cells on the order of $20k for installation and an annual support contract of $400.
Then ... fuck them.
In a prison?
. . . the point, from a security perspective, is that if such things can happen because of machine or user error, then they can also be made to happen intentionally by an attacker. And, if it was machine error, that suggests than a would be attacker will be able to duplicate the error condition entirely computationally with no need for human interaction.
teddybear
Like we didn't know this would happen.
Comon, it's a fairly justified rant really - if you hear that kinda bollocks every day, you gotta crack some time....
Aww crap - my post was ambigious - I meant the GP rant...maybe... or whatever - I give up today....
It takes a lot more than opening doors at a prison to escape. Even if you open the magnetic doors and confuse the computers, you still have to get past the physical locks, non-networked cameras, and physical guards to get out. And even if you can get past all that and the fences, you'll just be adding years onto your sentence when you get caught. Why would someone like Mitnick be stupid enough to risk a 20-year stint at a Maximum security prison just to escape a 5-year stint at a minimum security one?
SJW: Someone who has run out of real oppression, and has to fake it.
They're not. They are hooked to computers with USB drives though, so a hack could conceivably be inadvertently installed (why the fuck does even Server 2008 still have autorun turned on by default?)
Still, if someone wanted to open a door and they have access to that machine they can do it. It's not like these systems have a lot of internal security controls on them, the general assumption is that if you have access and know what to do then you probably have permission to do it.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
The box should be locked shut with a padlock and threat of firing anyone who tries to mess around with the system.
So when the system needs maintenance and configuration what happens? Oh, that's right, your magical Linux system never needs maintenance, and you're so perfect that your design will never need updating. You don't do this out in the real world, do you?
If all the prisons get new requirements from the government to use secured linux computers
Then the new attack vector will target Linux computers. And all the new systems will suck for the first five years as the programmers learn a completely new interface and new set of APIs. And gaping security holes will appear as they try to work around the new OS. Again, it's pretty obvious you really don't do this out in the real world.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
Shut down all the garbage smashers on the detention level!
So the guards can telecommute.
Then ... fuck them.
Isn't that simple?
If I were you I'd ask Santa Claus for a sense of humour, only six weeks to go.
To have a right to do a thing is not at all the same as to be right in doing it
I hope you're aware that the term "backdoor penetration" could be misconstrued by those of a choldishly prurient nature as referring to male homosexual anal intercourse?
To have a right to do a thing is not at all the same as to be right in doing it
All of these problems could be reduced if you maintain physical separation between critical equipment and the outside Internet. Yes, it might require prison personnel to use a physically different computer to access the Internet but sometimes the inconvenience is justified. As far as court documents, the document handling parts of a prison would be on the Internet side of the separation. Of course, this could equally apply to nuclear power plants, chemical plants or any place where it is imperative to keep hackers or viruses from taking over vital systems.
You all need to get your minds out of the gutter. Does everyone on this site have a dirty mind or something?
I'm the real Vorokrytin P. Winterbuttocks.
Too bad they did not have another faulty system at the same time that forced all the main water lines to blow, and drown all the inmates that are supposed to be dead in a few anyways....would save this country an enormous amount of money, me thinks.
You just don't get it do you?
You as a contractor are proposing a system that doesn't exist and won't meet the customer's requirement.
Locking down a system physically makes it overly difficult to maintain. "_THE_" most important security precaution is not removing something that may be useful. "_THE_" most important security precaution is thinking about security in a systemic approach. All your fancy projects will get owned by their own employees.
You're only saving grace is that you don't actually work in the industry which is clearly shown by your persistence that a) you can find a vendor which will provide you with a SCADA system that runs linux, and b) you think that actually means anything when it comes to procurement of such a system. For this I am thankful.
The Fuck-it mainly.
There's much to be said about air-gapping systems, however often these systems exist for data collection and their whole purpose is to exist as part of a larger network which for pretty much any multi-national company will include some form of connection to the internet.
Security is something that should be driven not by an airgap, but by a complete culture, by network design. Saying simply that something should not be connected to the internet is ignoring the realities of why many of these systems exist, and is ignoring the fact that there are many perfectly secure ways to allow this kind of data transfer.
There are so many plants these days basically run by remote control that it's time people started thinking about it on the whole rather than focusing their energies on fruitlessly locking down a single system. SCADA is a complex beast.
Would your rather an uppity and anally retentive person designing your network, or someone why appears to have just taken Comp101 and calls themselves a security expert.
Well, I think you're worthless. If it were up to me, I'd dump you in a hole and leave you to die.
404: sig not found.
s/state/federal/g
Federal prisons, not state.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Wow. The difference between trying to see things from the other side of the lawn and having an opinion of my own seem to have converged. I never meant to say Mitnick deserved to be in solitary, I was merely trying to understand why the other side felt it was justified. My bad for not being specific enough.