Feds confirm prisons vulnerable to Stuxnet-like attack

Federal authorities have confirmed an assertion by security researchers earlier this year that Stuxnet-like malware poses a potential threat to controls at prisons and penitentiaries across the country.

The researchers made their claim in a white paper published July 31, in which they say that the programmable logic controllers used to control doors, video systems, alarms and intercoms at prisons could be compromised and controlled remotely. They presented the paper at the recent Hacker Halted conference in Miami.

Sean McGurk, who headed DHS’ efforts on industrial control systems security until leaving in September, told the Washington Times’ Shaun Waterman that DHS had examined the research at Idaho National Laboratory’s ICS test bed and “validated” the claims.


Related story:

Stuxnet-style attack could wreak havoc at prisons, researchers say

Son of Stuxnet could usher in a new chapter in cyber warfare


A spokesman for the Federal Bureau of Prisons also told Waterman that the bureau is “aware of this research and taking it very seriously.”

The research team — security engineer and former CIA operations officer John Strauchs; his daughter Tiffany Rad, president of ELCnetworks; and information security consultant Teague Newman — began their work after a prison warden asked Strauchs to look into why all the cell doors on the prisons’ death row popped open one Christmas Eve.

Prisons and jails use Supervisory Control and Data Acquisition (SCADA) systems with programmable logic controllers (PLCs) to open and close doors, and manage video systems and internal communications, the research team wrote. And because PLCs — which also are used in a variety of industrial systems — use simple programming to execute basic functions, they proved to be easy to exploit.

Working out of Newman’s basement, and spending about $2,500 on equipment, each member of the team was able to write a PLC exploit in a matter of hours, they wrote.

Gaining control of the doors in a prison obviously could create a lot of chaos, potentially leading to such results as escapes and prisoner assassinations, they wrote. And because PLCs are so widely used, the vulnerabilities exist for many other secure locations, as well as pipelines for gas or oil.

Threats to SCADA systems have gained notoriety since the first reports in 2010 on the Stuxnet worm, which disrupted uranium enrichment facilities in Iran. Stuxnet was a targeted attack aimed at disrupting Siemens PLCs used for centrifuges at the Iran facilities.

But the researchers said exploits for PLCs such as those in prisons need not be so precisely written and that, once they have compromised a device, they could gain control over “anything connected to the PLC,” such as locks, and suppress alarms or other notifications that would come from the PLC.

Stuxnet was spread via removable media such as USB key drives, and that’s one way an exploit could enter a prison or other industrial system. But the researchers said that, although industrial control systems typically are not connected to the Internet, they found many instances where they were connected to other systems that were connected to the Internet.

If a guard, for instance, used a computer controlling PLCs to check e-mail or otherwise connect to the Internet, “then the usual client-side attack vectors are in scope,” they write.

Because of its ability to inflict physical damage, Stuxnet has been seen as a new style of weapon in cyber warfare, leading to speculation of where a similar type of malware might strike next. Although nothing on the order of the attack on Iran’s uranium facilities has been reported, a somewhat similar piece of malware, called Duqu, has turned up in systems in Europe.

Duqu appears to share some of Stuxnet’s code but has a different purpose, according to researchers from Symantec — rather than doing damage, it has been gathering information for what could be a future attack.

Reader Comments

Mon, Nov 14, 2011

The last post may be of the private sector, but you don't know how to spell!! Perhaps a spell checker or government job will help!

Mon, Nov 14, 2011 Dave K

It does seem pretty damned stupid to connect your internal prison control network to the Internet.

Mon, Nov 14, 2011

Not to disagree with most of what you're saying but the recent hacks of a number of contractors and other breaches suggests the private sector doesn't know what they are doing either.

Fri, Nov 11, 2011

When are you idiots in the government going to learn that Prisioners do NOT belong on the Internet and neither do the prisons. Hire real experienced System Administrators instead of paper tigers for CIO's Admins etc. The private sector doesn't have nearly the problems our government does for ONE reason, we know what we are doing!

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above