November 09, 2008Security and Self-Service systems in the newsCouple of stories on hacks and security in the last few days. One was some comments regarding the need for lockdown on systems (common knowledge & practice to use those) but this one caught our eye because 1) it was a thin client (easiest to lockdown), 2) it is in prison systems (very fast growing market unfortunately), and #3 inmates simply exploited the legal software they were entitled to use. The system design was probably very secure but flaw exploited in 3rd party software. Common story... http://www.theregister.co.uk/2008/11/08/prison_network_hacked/ Inmate hacked prison network, broke into employee database Posted in Crime, 8th November 2008 00:09 GMT A former prison inmate has been arrested and charged with hacking the facility's computer network, stealing personal details of more than 1,100 prison employees and making them available to fellow inmates. Francis G. Janosko, 42, gained access to the names, addresses, dates of birth, social security numbers and telephone numbers of employees working for the Plymouth County Correctional Facility in Massachusetts, according to an indictment unsealed Wednesday in US District Court in Boston. Using a thin client that was connected to a prison server, the prisoner was able to access an employee database by exploiting a bug in legal research software made available to inmates.
"Although the legal research computer server was connected through the prison's network to the internet solely so that it could obtain updates to its Windows operating system, the legal research server was configured to disallow access to the worldwide web," the indictment stated. Computer use was limited to legal research only; use of the internet was forbidden. Janosko is charged with one count each of aggravated identity theft and intentional damage to a protected computer. If convicted, he faces a maximum sentence of 12 years in prison and a fine of $250,000. He could also be forced to pay unspecified restitution. According to The Boston Globe, Janosko was arrested in 2005 on child pornography charges after investigators discovered nude photos of children on his cellphone. It was the third time he faced such charges, The Globe reported. He was listed as a Level 3, or high-risk, sex offender in Massachusetts in 2005. Posted by staff at November 9, 2008 12:52 PM |