November 09, 2008

Security and Self-Service systems in the news

Couple of stories on hacks and security in the last few days. One was some comments regarding the need for lockdown on systems (common knowledge & practice to use those) but this one caught our eye because 1) it was a thin client (easiest to lockdown), 2) it is in prison systems (very fast growing market unfortunately), and #3 inmates simply exploited the legal software they were entitled to use. The system design was probably very secure but flaw exploited in 3rd party software. Common story...

Inmate hacked prison network, broke into employee database
Plymouth County's not-so-protected computer
By Dan Goodin in San Francisco

Posted in Crime, 8th November 2008 00:09 GMT

A former prison inmate has been arrested and charged with hacking the facility's computer network, stealing personal details of more than 1,100 prison employees and making them available to fellow inmates.

Francis G. Janosko, 42, gained access to the names, addresses, dates of birth, social security numbers and telephone numbers of employees working for the Plymouth County Correctional Facility in Massachusetts, according to an indictment unsealed Wednesday in US District Court in Boston. Using a thin client that was connected to a prison server, the prisoner was able to access an employee database by exploiting a bug in legal research software made available to inmates.

Once he obtained the personal information of the employees, he made it accessible to other inmates. Janosko also managed to obtain the username and password to a prison management program, and to access the internet to download videos and digital photographs of prison employees, inmates and aerial shots of the prison. The accused hacking took place between October 2006 and February 2007.

"Although the legal research computer server was connected through the prison's network to the internet solely so that it could obtain updates to its Windows operating system, the legal research server was configured to disallow access to the worldwide web," the indictment stated. Computer use was limited to legal research only; use of the internet was forbidden.

Janosko is charged with one count each of aggravated identity theft and intentional damage to a protected computer. If convicted, he faces a maximum sentence of 12 years in prison and a fine of $250,000. He could also be forced to pay unspecified restitution.

According to The Boston Globe, Janosko was arrested in 2005 on child pornography charges after investigators discovered nude photos of children on his cellphone. It was the third time he faced such charges, The Globe reported. He was listed as a Level 3, or high-risk, sex offender in Massachusetts in 2005.

Posted by staff at November 9, 2008 12:52 PM