Prison Doors Vulnerable to Hacking, Researchers Say

Posted on Aug 1, 2011

Flickr / Auntie P

The same devices that enabled hackers to sabotage centrifuges at an Iranian nuclear plant last year are being used to control access to jail cells in some of the United States’ most important high-security prisons.

John Strauchs, who serves as a security consultant and engineer for at least 100 such prisons, and his partners report that the equipment and know-how required to manipulate some of the “programmable lock controllers” used to control cell doors are obtainable for as little as $2,500 and can be exploited remotely if connected to the Internet, which many systems are. Strauchs is expected to demonstrate a comparable attack at a hacking conference in Las Vegas next week. —ARK

Wired:

Some of the same vulnerabilities that the Stuxnet superworm used to sabotage centrifuges at a nuclear plant in Iran exist in the country’s top high-security prisons, according to security consultant and engineer John Strauchs, who plans to discuss the issue and demonstrate an exploit against the systems at the DefCon hacker conference next week in Las Vegas.

Strauchs, who says he engineered or consulted on electronic security systems in more than 100 prisons, courthouses and police stations throughout the U.S. — including eight maximum-security prisons — says the prisons use programmable logic controllers to control locks on cells and other facility doors and gates. PLCs are the same devices that Stuxnet exploited to attack centrifuges in Iran.

... PLCs are small computers that can be programmed to control any number of things, such as the spinning of rotors, the dispensing of food into packaging on an assembly line or the opening of doors.

Read more

More Below the Ad

New and Improved Comments

We are launching a major overhaul of our comments section.

In addition to more robust spam filtering and moderation, new features include the ability to rate other comments, sort how they are displayed and respond directly via e-mail or in a thread.

Unfortunately, commenters will lose their existing Truthdig identities. It's a pain, we know, but on the plus side you will now be able to log in with a plethora of options, including Google, Twitter, Facebook and Disqus accounts.

Before launching this system we spent months in discussion with our top commenters. We listened to the feedback and we hope you like what we've come up with.

Please direct any problems or concerns to us via our contact page.