Vulnerabilities Discovered In Prison SCADA Systems 128
phaedrus5001 writes with an excerpt from an Ars Technica article: "Researchers have demonstrated a vulnerability in the computer systems used to control facilities at federal prisons that could allow an outsider to remotely take them over, doing everything from opening and overloading cell door mechanisms to shutting down internal communications systems. ... The researchers began their work after [John] Strauchs was called in by a warden to investigate an incident in which all the cell doors on one prison's death row spontaneously opened."
Uh oh (Score:1)
All your jails are belong to us!!
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
The registry replaces INF files, and the time to search it is infinitesimal. It really doesn't matter how many irrelivant entries are added, as it does not impact the lookup time for the relevant entries. For that to happen the registry would have to increase in size du
Re: (Score:2)
I thought the whole point of SCADA was that it was dark fibre and not connected to teh ebil interwebs.
Re: (Score:1)
Re: (Score:2)
Re: (Score:1, Offtopic)
I tried to.
Damn thing wouldn't install.
Kept complaining that my windows were missing. Damit, they are
right there in front of you, filling in the huge holes in the walls!
Re: (Score:1)
Re: (Score:2)
not really.
if anyone can do it, it's some prison contractor/electrician with google - he's the one who knows which locks are at which address, which nodes connected to which.
unless the alternative to solitary is giving him stacks of manuals, wire pliers and a laptop with internet access and couple of radio-modems.but the powers that be were more worried probably about control systems in some of their other. more important than prison, systems, for no good reason. long solitary is just used as a way to keep
Re: (Score:2)
It takes a lot more than opening doors at a prison to escape. Even if you open the magnetic doors and confuse the computers, you still have to get past the physical locks, non-networked cameras, and physical guards to get out. And even if you can get past all that and the fences, you'll just be adding years onto your sentence when you get caught. Why would someone like Mitnick be stupid enough to risk a 20-year stint at a Maximum security prison just to escape a 5-year stint at a minimum security one?
Re: (Score:2)
Wow. The difference between trying to see things from the other side of the lawn and having an opinion of my own seem to have converged. I never meant to say Mitnick deserved to be in solitary, I was merely trying to understand why the other side felt it was justified. My bad for not being specific enough.
Re:omg, quick, someone spend money!!! (Score:5, Funny)
Re: (Score:2)
Then ... fuck them.
In a prison?
Re: (Score:2)
So the guards can telecommute.
Then ... fuck them.
Isn't that simple?
If I were you I'd ask Santa Claus for a sense of humour, only six weeks to go.
Re: (Score:2)
As for "security flaws with prison controls" - your paying top $ in state taxes per prison control system for contractors ect.
You have the right to know where your state tax $ will go and what your getting from your prison system.
Re: (Score:2)
s/state/federal/g
Federal prisons, not state.
Re: (Score:2)
Still, if someone wanted to open a door and they have access to that machine they can do it. It's not like these systems have a lot of internal security controls on them, the general assumption is that if you have access and know what to do then you probably have permission to do it.
Repeat (sort of) (Score:2)
This research was published in July and presented at Defcon in august. The original Wired story is here.
Re:Repeat (sort of) (Score:5, Informative)
Slashdot ate the link. here:
http://www.wired.com/threatlevel/2011/07/prison-plc-vulnerabilities/ [wired.com]
Definitely not unexpected... (Score:3, Interesting)
The US has a corrections industry with an extremely strong lobby that pushes not just Congress, but judges (whom are elected) to be "tough on crime", or else they will be replaced by people on the bench who are.
Of course, handing over this to the private sector means that any security other than the obvious is done at the bottom most cost.
So, if one would expect a prison locking system to actually be secure from clued people, it wasn't in the contract and paid for, so it wasn't done. It is only a matter of time before this is used for hits on well known prisoners, either by people paid by rich victims, or a gang who managed to hire or coerce someone with IT knowledge.
Think COs wouldn't stick a USB flash drive into a machine and run stuff? A good number actually wouldn't and stay to their sworn oath. Others would plug a USB flash drive into a computer either out of curiosity, or because they are getting paid by other people in a prison gang. Smuggling a Stuxnet variant in on a fingernail sized drive is a whole lot easier than smuggling in a bag of weed or meth.
Re: (Score:2)
I keep seeing lots of post on Slashdot, about all the prisons that are privately owned.
Are there really THAT many of them that have been outsourced? I don't know that I've ever heard of any for profit prisons in any state I've lived in.
Where are all these private prisons located? I'm guessing most are in CA....but are they that prevalent across the entire US?
DUPE - Hung over since Defcon? (Score:1)
DUPE.
I guess someone didn't turn down that neon-blue "romulan ale" being passed around at Defcon back in *AUGUST*. And damn, it must have been potent...
Seriously, I've had some long benders, fierce hangovers, and have one friend who started their current drugs-n-alcohol extravaganza during the Clinton years, but it's an amazing coincidence that submitter AND /.'s editors have collectively been this far out of it since the news of Prison SCADA risks made the national news around that time.
Hey, editors: be o
Re: (Score:2)
Re: (Score:1)
You all need to get your minds out of the gutter. Does everyone on this site have a dirty mind or something?
Easy Fix. (Score:2)
No connection to outside network.
1 - Don't connect shit like this to the internet (Score:2, Insightful)
2 - don't allow employees to stick their usb drives in work computers
Or,
run Linux
Or,
disable Autorun in Windows
3. problem solved
Now pay me my $80,000 in consulting fee (minus the 40% that will be kicked back to the prison guard union of course)
Re: (Score:1)
An even easier solution: To open door, insert key and turn. Try and hack that...
Easy... (Score:3)
Get ahold of metal, make lock pick. Steal key from guard, wait, insert, turn. Make mold out of soap, melt metal into it, insert into lock and turn.
Sure, then multiply by one thousand (Score:1)
One prisoner picking a lock or duplicating a key is not that large of a problem in most prisons.
The door to every cell at the same time while controls tell the guy in the guard booth that everything is fine is a problem in most prisons. The dangers presented by automation is some systems is orders of magnitude greater than the dangers presented by un-automated processes given the same level of effort by an attacker.
Re:Sure, then multiply by one thousand (Score:4, Informative)
Have we learned nothing from NetForce? (Score:3)
Re: (Score:2)
Re: (Score:2)
Exactly. Hackers cannot remotely open cell doors if you connect the controls to any network. There is nothing wrong with a big lever and 2 armed guards.
Big lever: $80
2 armed guards: $60,000 yearly
SCADA-controlled deadlocks: $20,000 one-time fee, $400 yearly maintenance.
The robot has paid for itself in less than half a year.
Where are those numbers from? (Score:2)
Unless you're talking about a single cell in a municipal jail in some small town somewhere, I'm highly dubious that any serious vendor is offering a SCADA system for jail cells on the order of $20k for installation and an annual support contract of $400.
Re: (Score:3)
Re: (Score:2)
I don't know, the guys who work as guards tend not to be the sharpest tools in the shed. A well crafted text message appearing to come from the governor might be enough to convince one of them to pull it.
Re: (Score:2)
There is that, but the social engineering element exists whether the automated system is in place or not. Say there is a manual lever that opens all jail cells at once in one prison and a fully automated computerized system in another. In the first prison, the guard on duty, gets the text message (or phone call, or signed order) and hits the lever, opening all the doors. In the second prison, the guard on duty, gets the text message (or phone call, or signed order) and clicks a button with a mouse, opening
Re:Ignorance is bliss (Score:2, Informative)
Yep another typically ignorant post by someone who thinks they know security.
1 - Don't connect shit like this to the internet
Yes the airgap-it-and-fuck-it approach works really well for the targetted attacks on SCADA systems.
don't allow employees to stick their usb drives in work computers
Easier said then done, especially since you just removed their network connections. Like it or not USB as a system to transfer data is here to stay. It needs to be managed not banned. Sure the burn a CD approach works well but these days you can't necessarily take for granted that the computers given to employees are capable of this
Re: (Score:2)
So when the system needs maintenance and configuration what happens? Oh, that's right, your magical Linux system never needs maintenance, and you're so perfect that your design will never need updating. You don't do this out in the real world, do you?
If all the prisons get new requirements from the government to use secured linux computers
Then the new attack vector will target Linux
Re: (Score:2)
You just don't get it do you?
You as a contractor are proposing a system that doesn't exist and won't meet the customer's requirement.
Locking down a system physically makes it overly difficult to maintain. "_THE_" most important security precaution is not removing something that may be useful. "_THE_" most important security precaution is thinking about security in a systemic approach. All your fancy projects will get owned by their own employees.
You're only saving grace is that you don't actually work in th
Re: (Score:2)
The Fuck-it mainly.
There's much to be said about air-gapping systems, however often these systems exist for data collection and their whole purpose is to exist as part of a larger network which for pretty much any multi-national company will include some form of connection to the internet.
Security is something that should be driven not by an airgap, but by a complete culture, by network design. Saying simply that something should not be connected to the internet is ignoring the realities of why many of thes
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Would your rather an uppity and anally retentive person designing your network, or someone why appears to have just taken Comp101 and calls themselves a security expert.
Re: (Score:2)
Re: (Score:2)
and for profit prisons probably never mention (Score:2)
this stuff happening. you guys who have worked in corps know how it works.
geek: "hey boss this shit is broken"
boss: "how much will it cost to fix it"
geek: "more than 0 dollars"
boss: "fuck it. oh, and i didnt say that"
Re: (Score:2)
Yep, pretty much how it works in every corporation. Not gonna increase profit this quarter? Don't do it.
It's Deja Vu all over again Yogi (Score:1)
By any chance are these SCADA units connected to the Internet, if so then the morons who implimented such a system should be locked up in prison, except they most probably would escape by utilizing some Windows virus. It is taken as given that these systems are running on Microsoft Windows? Give the history of these SCADA systems, who
lost in translation (Score:2)
Re: (Score:2)
it's still a huge problem if any node in the prison can be used to control the whole network of scada devices. so the network design would play a huge part. really, home automation parts would be easier to build separate networks for control systems with than scada, networks for observation and for control should be separate and of course the wiring shouldn't even go outside from the prison unit they're used to control. problem is they've just in just about all cases it seems built a prison/factory wide net
open all doors maybe part of some fire plan / code (Score:2)
open all doors maybe part of some fire plan / code in the software that is in place to do a fast open all and maybe based on code in other door locking systems (out side of prison) that unlocks all door in a fire.
Now some link that will be a easy target.
Re: (Score:1)
Remove that capability. There is no reason to evacuate prisoners and risk their escape.
Michael Scofield's plan (Score:2)
Fox river is the next prison to be hit.
remote maintenance / outside companies. nuke plant (Score:2)
remote maintenance / outside companies. nuke plants don't take short cuts like that. Now maybe prisons should be at the same level or at least be more safe then any old system.
They're not supposed to. (Score:2)
But...they do. Viruses do infect nuke plants from time to time due to sloppy practices.
Re: (Score:3)
Re: (Score:1)
"Not every prison is maximum security, just like not every prisoner is convicted of violent crimes."
They are still worthless. I wouldn't bother.
Re: (Score:2)
human factor (Score:1)
Re: (Score:2)
The two prisoners and I could see cars freaking driving on the road next door.
SCADA - Several Criminals Are Driving Away
Yes and no (Score:2)
You're probably correct on that, but . . . (Score:2)
. . . the point, from a security perspective, is that if such things can happen because of machine or user error, then they can also be made to happen intentionally by an attacker. And, if it was machine error, that suggests than a would be attacker will be able to duplicate the error condition entirely computationally with no need for human interaction.
Control code is . . . (Score:2)
Like we didn't know this would happen.
Will you shut up and listen to me! (Score:1)
Shut down all the garbage smashers on the detention level!
Too much internet access! (Score:2)
All of these problems could be reduced if you maintain physical separation between critical equipment and the outside Internet. Yes, it might require prison personnel to use a physically different computer to access the Internet but sometimes the inconvenience is justified. As far as court documents, the document handling parts of a prison would be on the Internet side of the separation. Of course, this could equally apply to nuclear power plants, chemical plants or any place where it is imperative to k
Interesting.... (Score:2)
Too bad they did not have another faulty system at the same time that forced all the main water lines to blow, and drown all the inmates that are supposed to be dead in a few anyways....would save this country an enormous amount of money, me thinks.