Feds confirm prisons vulnerable to Stuxnet-like attack
Connecting state and local government leaders
DHS examines researchers' exploits of programmable logic controllers used for prison doors and other systems, and validates their results.
Federal authorities have confirmed an assertion by security researchers earlier this year that Stuxnet-like malware poses a potential threat to controls at prisons and penitentiaries across the country.
The researchers made their claim in a white paper published July 31, in which they say that the programmable logic controllers used to control doors, video systems, alarms and intercoms at prisons could be compromised and controlled remotely. They presented the paper at the recent Hacker Halted conference in Miami.
Sean McGurk, who headed DHS’ efforts on industrial control systems security until leaving in September, told the Washington Times’ Shaun Waterman that DHS had examined the research at Idaho National Laboratory’s ICS test bed and “validated” the claims.
Related story:
Stuxnet-style attack could wreak havoc at prisons, researchers say
Son of Stuxnet could usher in a new chapter in cyber warfare
A spokesman for the Federal Bureau of Prisons also told Waterman that the bureau is “aware of this research and taking it very seriously.”
The research team — security engineer and former CIA operations officer John Strauchs; his daughter Tiffany Rad, president of ELCnetworks; and information security consultant Teague Newman — began their work after a prison warden asked Strauchs to look into why all the cell doors on the prisons’ death row popped open one Christmas Eve.
Prisons and jails use Supervisory Control and Data Acquisition (SCADA) systems with programmable logic controllers (PLCs) to open and close doors, and manage video systems and internal communications, the research team wrote. And because PLCs — which also are used in a variety of industrial systems — use simple programming to execute basic functions, they proved to be easy to exploit.
Working out of Newman’s basement, and spending about $2,500 on equipment, each member of the team was able to write a PLC exploit in a matter of hours, they wrote.
Gaining control of the doors in a prison obviously could create a lot of chaos, potentially leading to such results as escapes and prisoner assassinations, they wrote. And because PLCs are so widely used, the vulnerabilities exist for many other secure locations, as well as pipelines for gas or oil.
Threats to SCADA systems have gained notoriety since the first reports in 2010 on the Stuxnet worm, which disrupted uranium enrichment facilities in Iran. Stuxnet was a targeted attack aimed at disrupting Siemens PLCs used for centrifuges at the Iran facilities.
But the researchers said exploits for PLCs such as those in prisons need not be so precisely written and that, once they have compromised a device, they could gain control over “anything connected to the PLC,” such as locks, and suppress alarms or other notifications that would come from the PLC.
Stuxnet was spread via removable media such as USB key drives, and that’s one way an exploit could enter a prison or other industrial system. But the researchers said that, although industrial control systems typically are not connected to the Internet, they found many instances where they were connected to other systems that were connected to the Internet.
If a guard, for instance, used a computer controlling PLCs to check e-mail or otherwise connect to the Internet, “then the usual client-side attack vectors are in scope,” they write.
Because of its ability to inflict physical damage, Stuxnet has been seen as a new style of weapon in cyber warfare, leading to speculation of where a similar type of malware might strike next. Although nothing on the order of the attack on Iran’s uranium facilities has been reported, a somewhat similar piece of malware, called Duqu, has turned up in systems in Europe.
Duqu appears to share some of Stuxnet’s code but has a different purpose, according to researchers from Symantec — rather than doing damage, it has been gathering information for what could be a future attack.
NEXT STORY: DARPA's new cyber tack: Think, act like a hacker