Feeds

PLCs a prison vulnerability: researchers

Now there’s a jailbreak

  • alert
  • submit to reddit

Top three mobile application threats

Hard on the heels of warnings that critical systems in America are vulnerable to Stuxnet-style attacks, a group of security researchers says SCADA systems and PLCs make prisons vulnerable to computer-based attacks.

In a white paper published here, Teague Newman, Tiffany Rad and John Strauchs say the use of PLCs (programmable logic controllers) to control systems such as cell doors means that prisons inherit the vulnerabilities of PLC-based systems.

There isn’t actually much that’s new in their document: if SCADA and PLC systems are vulnerable to attacks, then so are the systems they control. The main point of the discussion is that most people, includingepl perhaps the authorities operating prisons, are only dimly aware of the extent to which physical security is a function of IT security.

PLCs are deployed in jails because of the complex controls needed: there are rules (for example) dictating which doors may be open at the same time, what times different doors may be open, which alarms or alerts (if any) should be sounded for different doors or combinations of doors being open, and so on.

If an attacker were able to infiltrate a Stuxnet-like worm into the prison environment, the paper’s authors say, they might be in a position to suppress alarms, open doors, or even damage systems by overriding the systems that limit how many door mechanisms can operate at once.

Of course, if prisons using PLCs are vulnerable to computer-based attacks, so are any facilities that use SCADA systems in access control, to the extent that such control systems are either accessible to the Internet, or vulnerable to a “poisoned USB key” attack.

Strauchs plans to demonstrate a proof-of-concept at Defcon next week. ®

Combat fraud and increase customer satisfaction

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.