7 ms·
Engineer bought prison laptop and 1,200 incarcerated folks lost their devices
- duffyjp 3y agoOff topic, but other than the goofy green touchpad I gotta say I love the aesthetics. I'd totally rock a transparent laptop.
- avery17 3y agoProbably so they couldnt take it apart and hide stuff in it lol
- bombcar 3y agoExactly. There’s a whole industry making these clear items that look like rejects from the 90s.
- aaron695 3y agoI think it's totally on topic. I'm surprised more electronics doesn't do it. Maybe it costs to much to manufacture clear casing to consumer spec. Maybe there's no demand among the NPCs You can get a prison TV, radio, remote - https://www.ebay.com/sch/i.html?_nkw=%22Clear+Tunes%22 https://www.ebay.com/sch/i.html?_nkw=%22Clear+Tunes%22 Typewriter - https://www.ebay.com/sch/i.html?_nkw=Swintec+2410 https://www.ebay.com/sch/i.html?_nkw=Swintec+2410
- bhaney 3y agoI hope Zhang doesn't feel too bad for accidentally setting this in motion. The fault lies entirely with the manufacture's poor security practices and the overreaction of the corrections officials, but I bet there are still going to be people pointing fingers at him saying "you shouldn't have hacked that laptop and published your findings! Now all these students lost their laptops because of you!"
- lima 3y agoThere aren't even any poor security practices. It's just security theatre and the DOC is overreacting.
- demondemidi 3y agoThe article said the default admin password wasn’t changed. Thats not security theater that’s a legit goof. Why so cynical?
- zogrodea 3y agoIt does sound very much like an overreaction, from the manufacturer of these devices. "The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet. "
- oofbey 3y agoWhen a critical part of a security system is defeated, saying “that’s okay we have other layers of security so they probably can’t do much” would be IMHO pretty horrible security practice. Taking the laptops away is horrible, but from a security perspective it’s not over reacting.
- SargeDebian 3y agoAssessing the balance between risk and the cost of mitigation sounds like it should be part of the basics.
- demondemidi 3y agoEh, true. But then both sides of the political spectrum would have been up their asses had they just said, "relax, its no big deal." Not something you want to hear from a prison (even a not-for-profit prison).
- h2odragon 3y agoSo many official idiocies get justified as "an abundance of caution." One might almost hope the phrase itself would become a warning sign of impending mistake; allowing officials to avoid the predictable disasters that follow.
- sandspar 3y ago[flagged]
- unsupp0rted 3y ago"People" is neutral. "Folks" is meant to elicit closeness or empathy. Both have their uses. Choice of usage predates Obama by a wide margin.
- demondemidi 3y ago[flagged]
- lebean 3y agoI didn't read it as an attack on him, just that he used the word folk often. But it's so out of the left field that maybe you're onto something.
- deleted 3y ago[deleted]
- cornstalks 3y agoOriginal title uses “students.” I haven’t counted the characters but I wouldn’t be surprised if the original title exceeded HN’s length limits, and “folks” was used to shave a few letters off to shorten it to <= HN’s limits. Someone more dedicated than I can count the characters. I personally think this isn’t even worth the time I’m taking to write this comment.
- pavel_lishin 3y agoCurrent title is 77 characters long. Replacing "folks" with "students" makes it 80. I'd wager the title was changed to ensure that people didn't imagine that the students were children.
- yawpitch 3y ago> Can we please stop using "folks" as a direct synonym for "people"? That is, quite literally, one of its common definitions… as in most English dictionaries side against you here. Also that “Obama-era” connotation preceded Obama by at least a full Obama.
- twerkmonsta 3y agoThey took them away to give them security updates. Non-story.
- yawpitch 3y ago> Students said they were given little information about when and if the devices would be returned, and many wondered if they’d lose access to the work saved on the laptops, which need to be placed into a dock to upload or download information. Students enrolled in community colleges also expressed concern that they lost access to their devices immediately before winter quarter finals. Not exactly a non-story… one women’s prison was put on lockdown so the laptops could be seized. I get that a lot of Americans like their carceral state really carceral, but the article makes it pretty clear that just having the default password doesn’t get you a lot with a device that has no usable ports.
- deleted 3y ago[deleted]
- eviks 3y agoWhich they didn't need to do in such a disrupting manner. Story
- tyingq 3y agoIf you follow the Twitter thread, the secure boot password was stored as a SHA-1 hash. So someone eventually brute forced it, and it's "N%(dU32p'". But, the prisons can't just change the default, because the design is that it writes the bios setup, including the default password, back to the device at power down. So, there didn't really appear to be any other option for the prisons other than collecting them all and sending them back for a fairly big update.
- lolinder 3y agoThe article quotes the manufacturer as saying that even with the password there's basically no risk of the devices being misused: > The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet. It sounds like one very valid option they had was to just change the password as part of the regular maintenance and replacement schedule on the very reasonable assumption that no one would be able to attach a USB port to their laptop within the confines of the prison.
- teekert 3y agoSo the (over dramatic) decision was made by someone with little knowledge but with power and probably responsibility. That happens too often in this world.
- tyingq 3y agoThe author didn't attempt it, but it seems pretty clear 4 of the pins on the exposed docking port would be a USB bus. So all you need really is a usb stick, some wires, and some patience. The particular connector used even looks like you could directly insert/wedge thin gauge wires, no soldering required on that end: https://imgur.com/a/7T3agdg https://imgur.com/a/7T3agdg
- rvnx 3y agoWhich could have been handled gracefully over time without disturbance if the person would have responsibly just contacted the IT of the prisons, instead of publishing the method and password in the wild.
- btbuildem 3y agoMy question is -- why was a prison laptop on sale on Ebay in the first place? If they're soooooo concerned about security, maybe don't have these out in the wild? I'm betting a prison employee stole that from work and sold it on the sly to make an extra few hundred bucks. Probably breaks some rules, no?
- thejsa 3y agoThe article covers this: > So how does a prison laptop end up on eBay? > The laptop that Zhang bought came from a state whose corrections department contracts with a Milwaukee-based nonprofit to dispose of its old laptops. But instead of recycling the devices, the organization resold them, selling out of 100 Securebooks after Zhang’s post went viral.
- btbuildem 3y agoAh thanks, missed it!
- didntcheck 3y ago> incarcerated folks AKA "prisoners". If only we could find a way to harness all these euphemism treadmills for electricity generation, then that might provide an actual social benefit
- deleted 3y ago[deleted]
- soneil 3y agoAside, "published on a hacker website" referring to hackaday tickled me pink.