13 ms·
A hacker's mom broke into a prison and the warden's computer
- ddtaylor 7y agoAFAIK this talk aas given at DerbyCon in 2018 and there might be video.
- ayakura 7y agoHere's the video: https://www.youtube.com/watch?v=Upa6IEwnTTo https://www.youtube.com/watch?v=Upa6IEwnTTo Here's another one from yesterday - RSA Conference: https://www.youtube.com/watch?v=yqOGuXcLdOA https://www.youtube.com/watch?v=yqOGuXcLdOA
- ddtaylor 7y agoAlso you're right it's from 2017 not 2018.
- nkrisc 7y agoThese stories always make me wonder how many malicious infiltrations occur that are never discovered or reported? It could happen all the time, especially at places much less secure. It's certainly far riskier to infiltrate a prison (where all the guards have guns) than a corporate office.
- smoyer 7y agoI had the same thought ... having a "get-out-of-jail-free" card lowers the risk for authorized pen-testers but how do you calculate the risk-to-reward ratio if you're actually a criminal? You have to figure that it's less than (e.g.) performing an armed robbery at a bank. So which of the service workers that come into our offices are legitimate? No idea.
- Shivetya 7y agoWell in Georgia we have had a few reports from the prison system about what they confiscate from prisoners. [0]. Look at what they are finding just among the prisoners so imagine how much easier it is to smuggle into the staff areas anything you want. Nearly two thousand cell phones, four times that number in make shift weapons, and of course drugs. Cell phones are a particular problem because it has been shown that some in prison continue to engage in criminal activities with those outside including witness intimidation or worse. [0] https://allongeorgia.com/georgia-state-news/ga-dept-of-corrections-seized-9657-contraband-items-from-jan-march-2019/ https://allongeorgia.com/georgia-state-news/ga-dept-of-corre...
- dsfyu404ed 7y agoThere is such a demand for phones in prisons that there are companies that manufacturer "prison phones" that easily fit into a prison wallet.
- swiley 7y agoWhere do you find these?
- opless 7y agoeBay 'smallest mobile phone'
- brohee 7y agoShenzen have you covered : https://www.youtube.com/watch?v=8BlfAMitMf4 https://www.youtube.com/watch?v=8BlfAMitMf4
- jaclaz 7y agoSearch for "beat the boss phone". Reference: https://hackaday.com/2017/05/11/tearing-down-the-boss-phone/ https://hackaday.com/2017/05/11/tearing-down-the-boss-phone/ (it is actually "B.O.S.S.")
- himlion 7y agoDoes prison wallet mean what I think it means?
- DyslexicAtheist 7y agoyou just need one corrupt guard, or somebody who is willing to close their eyes. guards are only people and being on shift talking with and being exposed to those confined will eventually make them empathic, as they realize many of the prisoners (majority but not all) are just people who never had a chance (grew up in orphanages or on the street, or often just homeless looking to escape the cold of the winter by doing a small crime to get there on purpose). There is one common theme among all of them: poverty and/or trauma. Once you see it (and being a guard exposed to them all the time you will see it unless you're a heartless or dumb sh!t) all the binary thinking and indoctrination starts cracking. This is where the bribe comes in since the person bribing also just fulfills a need (addiction, social interaction or whatever). Instead of Prisons: https://www.prisonpolicy.org/scans/instead_of_prisons/chapter1.shtml https://www.prisonpolicy.org/scans/instead_of_prisons/chapte... Anyone looking for some Netflix/Chill which is also edutainment about prisons and that doesn't paint the problem as binary (good vs evil) I highly recommend Oz https://www.imdb.com/title/tt0118421/ https://www.imdb.com/title/tt0118421/ or (a more recent show about the streets and problems in LE) The Wire https://www.imdb.com/title/tt0306414/ https://www.imdb.com/title/tt0306414/ <-- needs at least 2 or 3 times watching because it's incredibly dense! Edit: this is also an incredibly good read https://mises.org/library/defending-undefendable https://mises.org/library/defending-undefendable
- irthomasthomas 7y agoThe Corner https://imdb.com/title/tt0224853/ https://imdb.com/title/tt0224853/
- DyslexicAtheist 7y agothanks, this looks incredible!
- Stevvo 7y agoOz is the most horrific thing I have ever seen on screen. Just thinking about it makes me shudder.
- 7y ago
- ebg13 7y agoIs there an article to this article? I just see a 3 sentence blurb and an unrelated video.
- zenpaul 7y agoJust listened to the Darknet Diaries Courthouse podcast about the pentest gone wrong that was referenced in the article. Highly recommended. https://darknetdiaries.com/episode/59/ https://darknetdiaries.com/episode/59/
- jessaustin 7y agoThat wasn't a good look for their employer, "Coalfire", and not only because no one answered when they got their jail phone call. How did Coalfire not notice that the target was owned by a completely different entity than the organization that signed the contract?
- throwaway3157 7y ago> How did Coalfire not notice that the target was owned by a completely different entity than the organization that signed the contract? The courthouse was owned by who? The sherriffs? I thought the ownership was okay, but it was the over-eager law enforcement that refused to budge because they weren't informed.
- jessaustin 7y agoThey had a contract with some office in the state government. The courthouse is owned by a county, as most courthouses in USA are. Later the fig-leaf of "they use a state-administrated computer program there" was constructed so as to limit the injustice inflicted on two humans, but county buildings are no more owned by the state than state buildings are owned by the feds. And yes, stipulated, the sheriff is an asshole, but even he would have honored a contract between Coalfire and Dallas County, Iowa.
- throwaway3157 7y agoThanks for the clarification
- bilekas 7y agoThis is a great article, and one of the obvious but brilliant advice from the write up is : > Don’t blindly assume. I know I would be way more willing to allow a pleasant lady of mature mothering age and demeanor than a middle aged guy. Its the stereotypes we subconsciously build up unfortunately.
- prostheticvamp 7y agoIn the same vein: It’s not young thugs that come in to medical centers trying to score painkillers; it’s middle-aged suburban moms. The former know where to buy on the street. It’s the latter that think of trying to lie to their doc. But in practice we tend to be more suspicious of the former.
- C1sc0cat 7y agoThat reminds me of Allison (a super uptight soccer mom) in Orphan Black - But Alison had worked out how to find a supplier.
- ralusek 7y agoYoung adults (age 18 to 25) are the worst offenders of prescription abuse, the largest increase in opioid abuse has been in rural America, and men are 140% as likely to die from opioid abuse. So you have classified the greatest threat as female, suburban, and adult, but the statistics seem to indicate male, rural, and young adult. You are in danger of being pen tested.
- jefftk 7y agoYour parent was talking about people who try to convince their doctor to prescribe them painkillers, while you're talking about all people who abuse opioids.
- arkades 7y agoInitial opioid overdose numbers favored men over women a long time ago, but that hasn't been the case for a while: in the period of 1999 to 2010, male opioid ODs climbed in men by about 240%, in women by 400% (CDC 2013 Prescription Painkiller Overdoses). It's also worth noting that "who dies from opioid overdose" and "who is more likely to use a doctor to get their fix" are two different discussions, not least of all because "who dies from opiate overdose" is unrelated to "source of opioid." In the period 2005 to 2015, the likelihood of a prescription drug being the initiating drug dropped in half, while the likelihood of it being heroin went up about four-fold (Cicero, Ellis, Kasper 2017). As to women being the ones who walk into the medical center, note that the CDC's Drug Abuse Warning Network shows that the leading age groups to walk into an ED are women 25-34, 45-54, and 35-44 in that order (though the downward bump for 35-44 isn't really that big - it really is the center of the bell curve). The big increase in "rural" areas is messy. The actual data shows "non-major urban", and lumps together "small urban" and "rural". Given how medically underserved rural areas are in the US, however, I'd say the anecdata that it's suburban is more consistent with "non-urban growth favoring the non-urban areas that actually have prescription-writers in them." (Cicero et al 2014) The shift went from very-young inner city males getting heroin as their first drug to white middle-aged currently-as-many-women-as-men (but the velocity of growth is much higher in women) using scripts to, now, going back to heroin as scripts are harder to come by. Lastly, the previous comment compared "young thugs" (15 yo inner-city males were the predominant opioid abusers in the 80s and 90s, and are traditionally the stereotype for opioid abuse) to the unsuspected-but-common addict that walks in the door today, analogous to the Mom PenTester in the original article. And, indeed, the opioid abuser of yester-year was not prescription-based: they weren't hitting up their physician. It seems like they were saying "the old stereotype that we suspect leads us to ignore this common and inconspicuous thing that is actually the risk." Which you've taken to mean "this common thing we don't adequately suspect is the defining description of what opioid abusers look like."
- vsareto 7y agoArticles like these are a great anecdote of the ease of getting people into security. Despite the need for people, you'll still encounter a lot of barriers to getting a job. It doesn't make sense to have a bunch of hoops to jump through when the demand is there, you can train people easily, and there are people willing to learn. You can disregard 99% of calls-to-action regarding security hiring and talent demand.
- jcims 7y agoI think you're disregarding the fact that Rita was almost certainly better than anyone in that company at playing the role of state health inspector specifically and getting into that prison without stink eye from anyone. She brought the interest (she asked for the job) and a deep domain expertise that the company was able to directly leverage into an engagement. This is something the industry is begging for and will trip over themselves to invest in. It's not clear that you're describing that kind of situation. Taking someone with essentially zero relevant experience and training them up to be someone that can deliver a skilled service to a client is a much different ask. There are companies that are willing to make that bet, I work for one now that is hiring pure developers in a security role, but they have the resources to play the long game. Little infosec consulting firms can't do that. This comes across as me disagreeing with you. I'm not, I agree security is easy to get into and there is way too much black box bullshit surrounding it. I just have been involved with companies along the full spectrum of services and capabilities and feel that not everyone is in the position to make the bet you're laying out as a sure thing.
- vsareto 7y agoMany physical pentesters have gotten into places where they didn't have requisite deep domain knowledge because they can research particulars or just rely on regular social engineering. If someone is able to breach a prison without the deep domain knowledge, then it's not actually that important. It's good for demonstrating the damage an insider threat could pose. This article doesn't have a comparison engagement with someone lacking domain knowledge though. I don't think the industry is tripping over themselves to get talent in any aspect. It just isn't what I've encountered. None of my prior domain knowledge counted (what little there is). Only certs and recent activity.
- timwis 7y agoAnyone interested in this stuff should check out the Darknet Diaries podcast for similar stories. They’re great!!
- maerF0x0 7y agoThis also demonstrates an uncomfortable situation. There are certain types of bias in favor of women that help out with these kinds of situations. His mom likely was benefitting from a positive bias that she was harmless and fulfilled the presumption about what an inspector may look like... Something like this "Women are wonderful effect"[1]. [1]: https://en.wikipedia.org/wiki/Women_are_wonderful_effect https://en.wikipedia.org/wiki/Women_are_wonderful_effect
- oceanghost 7y agoThis is absolutely a thing. I worked at a fortune small-cap where the IT department was absolutely insidious. They would undermine anyone who they didn't like, or who opposed their nonsense. I wrote a lot of backend stuff, and they would spend far more effort and money denying us servers and resources than it would have taken to simply get those things for us. They'd tell us developers we couldn't use the OS's our products targeted, and yet they'd be using them. They undermined their own CIO time after time; most lasted about 18 months. Then, the company hired a sociable, intelligent, woman as CIO. Within six months, she'd (rightly) fired the ENTIRE department. They just didn't see it coming.
- krilly 7y agoWait, what was your point here? That women actually are wonderful?
- thrwaway69 7y agoAre they not?
- soneca 7y agoI assumed the point is that the combative developers saw the new CIO as harmless and didn't fight her as with the others CIOs.
- oceanghost 7y ago
- throwaway55554 7y ago> In 2016, Rita died of pancreatic cancer; she never had a chance to do another pen test. Strand declined to say which prison his mother infiltrated, only that it has since shut down. After reading the rest of the story, that was a gut punch!
- lastres0rt 7y agoWell, you've heard of burner phones -- welcome to 'the burner hacker'.
- dang 7y agoCould you please stop posting unsubstantive comments to Hacker News? You've been doing it repeatedly, and we're trying for a bit better than that here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- mttjj 7y agoOff-topic but can someone please fix the lazy title? I detest misused (or omitted) apostrophes. Even better would to just change the title to match the linked article: "How a Hacker's Mom Broke Into a Prison—and the Warden's Computer"
- dang 7y agoYes, fixed now. Submitters: please don't rewrite titles unless they are misleading or linkbait. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. (Submitted title was "Pen testers mom breaks into a state prison and infects wardens computer")
- Wowfunhappy 7y agoDang, if I may use this opportunity to ask a question about titles, is it okay to change a title because the original isn't descriptive enough within the context of Hacker News? Just to choose an example: There's a program called Retroactive which patches Aperture, iPhoto, and iTunes to work again on macOS Catalina. The project's github links to a medium article the author wrote, which is titled: > Technical Deep Dive: How does Retroactive work? If you arrive at this article from RetroActive's github, it's a fine title. But if you just see it on Hacker News and don't know what Retroactive does, the title is 100% useless noise. So when I submitted the article to HN[0], I tried to make the title more descriptive while also changing as little as possible. All I did was replace "work" with what Retroactive actually does: > Technical Deep Dive: How Does Retroactive Patch Aperture for macOS Catalina? Even though I did my best to change as little as possible, I felt quite guilty about the title change. But in hindsight, by trying to "compromise", I ended up with a title that's still really bad! The first 6 words of my 11-word title give the reader absolutely zero information. This article didn't get much attention, and I can't help wondering if the title is why (not to imply that this or any article somehow deserves attention). The title really should have been: > How Retroactive makes Aperture, iPhoto, and iTunes work again on macOS Catalina 0: https://news.ycombinator.com/item?id=22229101 https://news.ycombinator.com/item?id=22229101
- 7y ago
- haberdasher 7y agoMr. Robot, S1.