How a Hacker's Mom Broke Into a Prison—and the Warden's Computer

guest · Feb 27, 2020

How a Hacker's Mom Broke Into a Prison—and the Warden's Computer
Security analyst John Strand had a contract to test a correctional facility’s defenses. He sent the best person for the job: his mother
February 26, 2020
https://www.wired.com/story/hackers-mom-broke-into-prison-wardens-computer/

John Strand breaks into things for a living. As a penetration tester, he gets hired by organizations to attack their defenses, helping reveal weaknesses before actual bad guys find them.
But in July 2014, prepping for a pen test of a South Dakota correctional facility, he took a decidedly different tack. He sent his mom.

"She approached me one day, and said 'You know, I want to break in somewhere," says Strand, who is sharing the experience this week at the RSA cybersecurity conference in San Francisco. "And it's my mom, so what am I supposed to say?"
To help get her in the door, Black Hills made Rita a fake badge, a business card, and a "manager's" card with John's contact info on it. Assuming she got inside, she would then take photos of the facility's access points and physical security features.
Click to expand...

But Rita also asked to see employee work areas and break areas, the prison's network operations center, and even the server room—all allegedly to check for insect infestations, humidity levels, and mold. No one said no.

At the end of the "inspection," the prison director asked Rita to visit his office and suggest how the facility might improve its food service practices. [...] Then she handed him a specially prepared USB drive.
[...] When the prison boss clicked, he inadvertently gave Black Hills access to his computer.

"We were just dumbfounded," Strand says. "It was an overwhelming success. And there's a lot to take from it for the security community about fundamental weaknesses and the importance in institutional security of politely challenging authority.
Even if someone says they're an elevator inspector or a health inspector or whatever, we need to do better about asking people questions. Don’t blindly assume."
Click to expand...

Log in or Sign up

How a Hacker's Mom Broke Into a Prison—and the Warden's Computer

guest Guest

Log in or Sign up

How a Hacker's Mom Broke Into a Prison—and the Warden's Computer

guest Guest

Useful Searches