Slashdot Mirror
Judge Sentences Man To One Year In Prison For Hacking Smart Water Readers In Five US Cities (bleepingcomputer.com)
An anonymous reader writes: A Pennsylvania man was sentenced to one year and one day in prison for hacking and disabling base stations belonging to water utility providers in five cities across the U.S. East Coast. Called TGB, these devices collect data from smart meters installed at people's homes and relay the information to the water provider's main systems, where it is logged, monitored for incidents, and processed for billing. Before he was fired by the unnamed TGB manufacturing company, Flanagan's role was to set up these devices. After he was fired, Flanagan used former root account passwords to log onto the devices and disable their ability to communicate with their respective water utility providers' upstream equipment. He wasn't that careful, as the FBI was able to trace back the attacks to his home. Apparently, the guy wasn't that silent, leaving behind a lot of clues. Flanagan's attacks resulted in water utility providers not being able to collect user equipment readings remotely. This incurred damage to the utility providers, who had to send out employees at customer premises to collect monthly readings. He was arrested in Nov 2014, and later pleaded guilty.
I am not even a security professional. Hell, I'm retired. Even *I* know that you revoke passwords when you fire someone - and if they can't be revoked, you change them. (That they can't be revoked is another matter - and probably another stupid fucking idea.) Ideally, you revoke their access before you fire them and when they're unable to access the system by means of physical separation.
"So long and thanks for all the fish."
In what universe is accessing a system using the device password you were issued "hacking"? Attack, yes, unauthorized access, yes, hack? Not so much.
It was definitely an illegal intrusion of a computer system, but is it really "hacking" if all he did was use root passwords he had while he was on the job?
that's not hacking.
meh. Against stupidity even the gods themselves contend in vain.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Free water?! It's not like the stuff just falls out of the sky for free. Oh wait...
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
..defendant...remotely accessed a TGB...and and changed the password to "fuckyou."
Wouldn't that imply that the passwords on these internet connected devices are being stored in plaintext somewhere? I'm no security expert, but that seems like it's a bad idea.
"This incurred damage to the utility providers, who had to send out employees at customer premises to collect monthly readings."
But that's the way water meters have ALWAYS worked.
Did the water rates go down when the new meters were installed? No? Then where are the supposed "damages?"
Wouldn't it be easier to turn them back on rather than take monthly readings manually?
Surely the issue becomes apparent pretty quickly.
I don't bake cakes for people who covet their neighbor's goods.
In many smaller cities and towns, the water treatment plants are older (circa 1970's or so) and expensive to maintain. I live in one such city, along the Potomac River, and our water bills are combined with sewer and trash pickup. We're billed once every 3 months, and the typical bill is easily in excess of $350. Trash collection is only once per week here, with no yard waste pickup - so it really only amounts to $80 or so of the total bill. The rest is sewer and water, which go hand-in-hand.
If you have a small water leak, such as a toilet that keeps running after you flush it and you don't catch and correct it immediately? It can easily run the water bill up to the $600-800 range.
So yeah.... there is actually some incentive for a dishonest person to hack the system in some way, if possible.
I don't bake cakes for people who look at porn (I don't do much baking).
That's nothing - the government is cancelling all health insurance and planning to kill 22 BILLION people. I heard it on Hillary Clinton's Twitter feed.
Consider, Aaron Swartz faced less jail time.
This guy got a 1 year sentence but faced up to 90 years and a $3 million fine.
This pretty well backs up my theory that Aaron may have never had to serve any time as a member of the general population of a federal prison, and even if he did it would not have been anything even close to the maximum.
"His name was James Damore."
he could have made a lot of money. Quietly kept his root access, put in a few logging scripts that would have searched and told him where water usage had dropped in for a couple of days ... probably a good sign that people are away on holiday ... sold this information on to his friend Burglar Bill who could have paid the properties an uninvited visit; very hard to trace this back to leaked water readings [pardon the pun]. This is why accepting smart meters into your house that allow real time water/electric/... usage is a huge security risk.
The utilities all claim that it is perfectly safe - something that this story shows is a lie -- or at best wildly optimistic. The reason that they want to do this is to increase their profits - but the cost is your household security; but they don't care about that.
The police are forcing me to bake a cake for a gay couple's wedding. But Jesus told me that gay buttsex is against God's law. Whatever should I do?
This is indeed a conundrum.
The only way out of it is to have gay buttsex with Jesus in the hope that it will change his opinion. But you need to make it REALLY GOOD for the plan to work, so I suggest practicing on your dog first. That way, if you get caught, you can claim that you're dyslectic and have difficulty distinguishing between "god" and "dog".
"What do you mean I have to get out of my car? Send him to prison!"
For being a bunch of idiots. This guy doesn't deserve jail time for idiot decisions by management. The fact that this sort of crap makes it through our legal system is an immense sign of failure.
You should do what your moral code tells you to, but you should also be prepared for the consequences.
In case anyone is interested, the Department of Homeland Security has a well-regarded CERT that is dedicated to Industrial Control Systems. It even offers free classroom training and free assessments of the information security posture of utilities and other organizations.
We all know you can't fire the person with root access to your devices. These companies never learn. /s
Oh noes. Someone had to use employees.
But that's the way water meters have ALWAYS worked.
Did the water rates go down when the new meters were installed? No?
Yes. Yes they did. Any other questions?
Slashdot story in 2017.