![\"\"](\"https:\/\/cdn4.fotosearch.com\/bthumb\/UNX\/UNX025\/u19332265.jpg\")
MIAMI \u2014 Federal authorities are concerned about new research showing U.S. prisons are vulnerable to computer hackers, who could remotely open cell doors to aid jailbreaks.<\/p>\nBy Shaun Waterman-The Washington Times<\/p>\n
MIAMI \u2014 Federal authorities are concerned about new research showing U.S. prisons are vulnerable to computer hackers, who could remotely open cell doors to aid jailbreaks.<\/p>\n
The Federal Bureau of Prisons is \u201caware of this research and taking it very seriously,\u201d spokesman Chris Burke told The Washington Times.<\/p>\n
Mr. Burke was reacting to research by private experts who found that the security systems in most American prisons are run by computer software vulnerable to hackers.<\/p>\n
\u201cYou could open every cell door, and the system would be telling the control room they are all closed,\u201d said John J. Strauchs, a former CIA operations officer who helped develop a cyber-attack on a simulated prison computer system and described it at a hackers\u2019 convention in Miami last week.<\/p>\n
The security systems in most American prisons are run by special computer equipment called industrial control systems, or ICS. They are also used to control power plants, water treatment facilities and other critical national infrastructure. ICS has increasingly been targeted by hackers because an attack on one such system successfully sabotaged Iran\u2019s nuclear program in 2009.<\/p>\n
![\"\"](\"https:\/\/comps.fotosearch.com\/comp\/CSP\/CSP255\/methods-cyber-attack_~k2552677.jpg\")
A malicious cyber-intruder could \u201cdestroy the doors,\u201d by overloading the electrical system that controls them, locking them permanently open, said Mr. Strauchs, now a consultant who has designed security systems for dozens of state and federal prisons..<\/p>\n
Hackers could \u201cshut down secure communications\u201d through the prison intercom system and crash the facility\u2019s closed-circuit television system, blanking out all the monitors, he added.<\/p>\n
Mr. Strauchs, 67, and his daughter \u2014 attorney, professor and computer security researcher Tiffany Strauchs Rad , 37 \u2014 told an audience at the Hacker Halted conference about the attack they developed in the basement of a Washington area home for less than $2,500.<\/p>\n
\u201cPersonally, I think the greatest danger is assassination,\u201d Mr. Strauchs told The Washington Times afterward. \u201cYou create chaos as a way to [implement a plan to] kill someone.\u201d<\/p>\n
![\"\"](\"https:\/\/upload.wikimedia.org\/wikipedia\/commons\/thumb\/2\/23\/CIA.svg\/200px-CIA.svg.png\")
Mr. Strauchs said he and his daughter had been careful to work with U.S. authorities to alert them to the risk before publicly disclosing their attack. They organized a briefing for federal agencies over the summer at CIA headquarters in Northern Virginia.<\/p>\n
Sean P. McGurk, who led the Department of Homeland Security\u2019s efforts to secure ICS until leaving in September, said the department had looked into the researchers\u2019 claims using the special ICS computer test bed at the Idaho National Laboratory.<\/p>\n
\u201cWe validated the researchers\u2019 initial assertion \u2026 that they could remotely reprogram and manipulate\u201d the special software controllers that run the systems, Mr. McGurk said.<\/p>\n
Teague Newman, another member of their team, said ICS systems are not supposed to be connected to the Internet.<\/p>\n
\u201cBut in our experience, there were often connections\u201d to other networks or devices, which were in turn connected to the Internet, making them potentially accessible to hackers, he said.<\/p>\n
![\"\"](\"https:\/\/cdn5.fotosearch.com\/bthumb\/FSD\/FSD100\/x14484470.jpg\")
In some of the facilities the team visited for their research, guards had used the same computer that controls the prison\u2019s security systems to check their personal email, exposing it directly to potential hackers, Mr. Teague said.<\/p>\n
In many prisons, technical support staff would add connections to enable them to update the system\u2019s software remotely after the ICS systems were installed by security specialists.<\/p>\n
\u201cWe saw that a lot, a lot,\u201d said Mr. Teague.<\/p>\n
Mr. McGurk said he found Internet connections in every one of the 400-plus onsite inspections of control systems in the government and private sector he had overseen in three years at the Homeland Security Department.<\/p>\n
\u201cIn no case did we ever not find connections,\u201d he said. \u201cThey were always there.\u201d<\/p>\n
Even systems that were successfully cut off from the Internet could be attacked by malicious insiders or anyone with enough access to insert a thumb drive into a computer work station, Mr. Strauchs said.<\/p>\n
![\"\"](\"https:\/\/cdn4.fotosearch.com\/bthumb\/UNX\/UNX030\/u13766167.jpg\")
\u201cThe mostly likely vector would be to bribe a prison guard to insert a USB drive with malicious programming. Hard to stop and hard to find out who did it,\u201d he said.<\/p>\n
Mr. Teague said the team\u2019s attack was \u201cpretty easy\u201d to develop.<\/p>\n
\u201cI had no prior experience with programming ICS\u201d Mr. Newman said, \u201cWe did not spend a lot of time, it was cheap, and we did it in my basement.\u201d<\/p>\n
<\/p>\n
<\/p>\n