A panel of experts presented some startling findings at the Hacker Halted conference, prompting the Department of Homeland Security and Federal Bureau of Prisons to re-evaluate their digital security systems. A study conducted by a former CIA officer has shown that for less than $2,500, hackers could overload the circuits in prison doors, springing them permanently open.
Federal Bureau of Prisons spokesman Chris Burke told The Washington Times that the government is “aware of this research and [is] taking it very seriously.”
John Strauchs, Teague Newman and Tiffany Rad developed attacks in the basement of a Washington, D.C. home that could bring a prison’s programmable logic controllers and industrial control systems offline.
“You could open every cell door, and the system would be telling the control room they are all closed,” Strauchs told The Washington Times.
Industrial control systems, as the software is known, are used in everything from the power grid to civic plumbing systems to prison doors, and have come under official scrutiny recently because of their vulnerability to cyber attacks. In 2010, an Israeli cyber attack on the Iran’s nuclear program brought a fifth of Iran’s centrifuges offline.
The researchers found that while the computers controlling the prison systems were not supposed to be connected to the Internet, at every prison system out of the more than 400 surveyed, they were. Guards were frequently using the prison computers to check their personal emails, exposing the system to attack. In other cases, technical support maintained Internet connections to update the prison security systems.
“In no case did we ever not find connections,” McGurk said. “They were always there.”
But even in the absence of an Internet connection, the industrial control system could still be compromised by bribing a security guard to upload a virus via a USB drive.
The team took their findings directly to federal agencies, briefing them at the CIA headquarters at Langley, so they could have time to evaluate and respond to the threat.
Sean McGurk led the Department of Homeland Security’s efforts to secure ICS before his departure in September, and confirmed to the Washington Times that “we validated the researchers’ initial assertion … that they could remotely reprogram and manipulate [the industrial control system software and controllers].”
A warden contacted Strauchs about the project after an incident in which all the doors on one prison’s death row were suddenly opened.
