A former prison inmate has been arrested and charged with hacking the facility's computer network, stealing personal details of more than 1,100 prison employees and making them available to fellow inmates.
Francis G. Janosko, 42, gained access to the names, addresses, dates of birth, social security numbers and telephone numbers of employees working for the Plymouth County Correctional Facility in Massachusetts, according to an indictment unsealed Wednesday in US District Court in Boston. Using a thin client that was connected to a prison server, the prisoner was able to access an employee database by exploiting a bug in legal research software made available to inmates.
Once he obtained the personal information of the employees, he made it accessible to other inmates. Janosko also managed to obtain the username and password to a prison management program, and to access the internet to download videos and digital photographs of prison employees, inmates and aerial shots of the prison. The accused hacking took place between October 2006 and February 2007.
There are two types of thin clients in this world: 1) Those with embedded operating systems; and 2) those that are stateless. The prison purchased the wrong type for their inmate's use.
ReplyDeleteEmbedded thin clients are not by nature any more secure than their full PC relatives. They each contain operating systems, file systems, and network addresses. These attributes can be hacked and used inappropriately, as we have read about in this article.
Stateless thin clients are more secure by design. They contain no operating systems (or state), no file systems, and no network addresses. In short, there is nothing on the desktop that can be hacked or in any way used inappropriately. In fact, 100% of the user's experience is controlled by network administrators.
One added feature to using stateless computing technology is that if there is no state, there is nothing to manage. Network complexity is reduced and desk side service and support is eliminated.
While I am sorry that the prison chose the wrong type of desktop device to use, others may learn from their experience. Not all desktop devices are created equally when it comes to security.
To find our more about stateless thin client computing, one can simply google that phrase and check out the references. A quick check will provide useful information that can save time, effort, money, and potentially build much more security into the network.
It should be noted that Mr. Tischler is the CFO and Director of Reseller Activities for Symbio Technologies LLC - the leader in server-centric "stateless" computing.
ReplyDeleteBut that doesn't mean he isn't right. ;) Good stuff and interesting look into the story - thats for sure.