Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A hacker's mom broke into a prison and the warden's computer

wired.com

Post reply on HN
Print view View original

61–70 of 99 posts

Re: A hacker's mom broke into a prison and the warden's computer

#61

Post by Thriptic »

maerF0x0 wrote: post #24

This also demonstrates an uncomfortable situation. There are certain types of bias in favor of women that help out with these kinds of situations. His mom likely was benefitting from a positive bias that she was harmless and fulfilled the presumption about what an inspector may look like... Something like this "Women are wonderful effect"[1]. [1]: https://en.wikipedia.org/wiki/Women_are_wonderful_effect

That's exactly why social engineering works: biases and assumptions. People are absolutely generally more willing to help a woman than a man for a variety of reasons (perception of harmlessness as you point out; people assuming women are incompetent; guys wanting to help to increase sex appeal; etc). Men can exploit different social vectors (eg large, imposing men being demanding or aggressive will get obeyed more than other people because we automatically associate size with authority).

It's not the pentester's job to fix social policy, merely to point out that threats can come from a variety of vectors that people don't expect.

Re: A hacker's mom broke into a prison and the warden's computer

#62

Post by larrywright »

nkrisc wrote: post #26
himlion wrote: post #18

Earlier quoted context omitted.

Does prison wallet mean what I think it means?

Ugh, I hadn't thought about that, but I'm sure it probably does.

I took one for the team and looked it up to confirm. I can report that yes, it’s exactly what you think it is.

Re: A hacker's mom broke into a prison and the warden's computer

#63

Post by vsareto »

jcims wrote: post #55
vsareto wrote: post #11

Articles like these are a great anecdote of the ease of getting people into security. Despite the need for people, you'll still encounter a lot of barriers to getting a job. It doesn't make sense to have a bunch of hoops to jump through when the demand is there, you can train people easily, and there are people willing to learn. You can disregard 99% of calls-to-action regarding security hiring and talent demand.

I think you're disregarding the fact that Rita was almost certainly better than anyone in that company at playing the role of state health inspector specifically and getting into that prison without stink eye from anyone. She brought the interest (she asked for the job) and a deep domain expertise that the company was able to directly leverage into an engagement. This is something the industry is begging for and will…

Many physical pentesters have gotten into places where they didn't have requisite deep domain knowledge because they can research particulars or just rely on regular social engineering. If someone is able to breach a prison without the deep domain knowledge, then it's not actually that important. It's good for demonstrating the damage an insider threat could pose. This article doesn't have a comparison engagement with someone lacking domain knowledge though.

I don't think the industry is tripping over themselves to get talent in any aspect. It just isn't what I've encountered. None of my prior domain knowledge counted (what little there is). Only certs and recent activity.

Re: A hacker's mom broke into a prison and the warden's computer

#64

Post by westmeal »

milesvp wrote: post #28
aaomidi wrote: post #13

Earlier quoted context omitted.

Is it wrong that I find it a terrible thing that people aren't allowed computers with internet or cellphones in prison? How do we expect people to join back to society when they can't use literally the number one most important thing? Maybe give them phones with no cameras and monitoring of use, but just nothing seems very inhumane.

I saw a youtube video recently about the extensive use of cell phones to play old school runescape. Like it’s everywhere in every prison in the last couple of years. People not only play it but also use it’s currency for real world trading. Apparently violent behavior is down wherever people are playing. I’d love to find corroborating evidence for this, because I find it completely facinating.

If I were in jail I'd love to play Runescape. It's pretty much the only time I'd actually enjoy Runescape.

Re: A hacker's mom broke into a prison and the warden's computer

#65

Post by proc0 »

throwaway55554 wrote: post #52
proc0 wrote: post #46

Earlier quoted context omitted.

Sounds like society is so biased in favor of women that they can get away with breaking shit (whether accident or intentional).

> breaking shit You mean fixing.

No i mean breaking. I didn't say ALL women, but clearly my point is proven because you want to defend ALL women. That is the problem. Had I mentioned men break shit, I would have received upvotes.

Re: A hacker's mom broke into a prison and the warden's computer

#66

Post by saber6 »

aaomidi wrote: post #13
Shivetya wrote: post #6

Earlier quoted context omitted.

Well in Georgia we have had a few reports from the prison system about what they confiscate from prisoners. [0]. Look at what they are finding just among the prisoners so imagine how much easier it is to smuggle into the staff areas anything you want. Nearly two thousand cell phones, four times that number in make shift weapons, and of course drugs. Cell phones are a particular problem because it has been shown that…

Is it wrong that I find it a terrible thing that people aren't allowed computers with internet or cellphones in prison? How do we expect people to join back to society when they can't use literally the number one most important thing? Maybe give them phones with no cameras and monitoring of use, but just nothing seems very inhumane.

> Is it wrong that I find it a terrible thing that people aren't allowed computers with internet or cellphones in prison?

Yes, you are wrong. These communication devices are taken away because the nature of the reason you are typically holding folks (violent crimes, gang activity, etc).

> How do we expect people to join back to society when they can't use literally the number one most important thing?

A lot of these people will not being rejoining society. They will spend the rest of their days in their cage. Let's not be rose-colored about this.

> Maybe give them phones with no cameras and monitoring of use, but just nothing seems very inhumane.

No thanks. They can use the monitored computer center.

Re: A hacker's mom broke into a prison and the warden's computer

#67

Post by jcims »

vsareto wrote: post #63
jcims wrote: post #55

Earlier quoted context omitted.

I think you're disregarding the fact that Rita was almost certainly better than anyone in that company at playing the role of state health inspector specifically and getting into that prison without stink eye from anyone. She brought the interest (she asked for the job) and a deep domain expertise that the company was able to directly leverage into an engagement. This is something the industry is begging for and will…

Many physical pentesters have gotten into places where they didn't have requisite deep domain knowledge because they can research particulars or just rely on regular social engineering. If someone is able to breach a prison without the deep domain knowledge, then it's not actually that important. It's good for demonstrating the damage an insider threat could pose. This article doesn't have a comparison engagement wit…

Depends on where you’re looking. Companies like the one in the article are not going to be in a position to do a lot of staff development unless they have no other choice..you need to be able to hit the ground running in many cases.

Depending on what experience you do have you might find good luck in hiring on at larger firms like insurance, financial, healthcare where they are going to need in-house staff and can make use of other skills that you might bring while they train you up on the security side.

Re: A hacker's mom broke into a prison and the warden's computer

#68

Post by jessaustin »

zenpaul wrote: post #8

Just listened to the Darknet Diaries Courthouse podcast about the pentest gone wrong that was referenced in the article. Highly recommended. https://darknetdiaries.com/episode/59/

That wasn't a good look for their employer, "Coalfire", and not only because no one answered when they got their jail phone call. How did Coalfire not notice that the target was owned by a completely different entity than the organization that signed the contract?

Re: A hacker's mom broke into a prison and the warden's computer

#69

Post by nefitty »

somesortofsystm wrote: post #59
aaomidi wrote: post #13

Earlier quoted context omitted.

Is it wrong that I find it a terrible thing that people aren't allowed computers with internet or cellphones in prison? How do we expect people to join back to society when they can't use literally the number one most important thing? Maybe give them phones with no cameras and monitoring of use, but just nothing seems very inhumane.

> Is it wrong that I find it a terrible thing that people aren't allowed computers with internet or cellphones in prison? I also think they should be allowed to grow their own weed.

Are you being facetious? If so, letting people access information which could help them establish some grounding in the outside world is not exactly a ridiculous idea.

Re: A hacker's mom broke into a prison and the warden's computer

#70

Post by wahern »

robocat wrote: post #57
zoonosis wrote: post #45

Earlier quoted context omitted.

While I agree that the US prison system has many issues, recidivism rates can't really be compared between countries because of differences in time frames and rearrest vs re-conviction. https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4472929/

The issue is not about comparing recidivism rates. It is whether the US is looking at the results achieved by other countries and whether the US is trying to emulate successful strategies. As a sweeping generalisation, I see that the US says "that doesn't apply to us", always finding some weird excuse. Your invalid response is kind of an example.

How do you "[look] at the results achieved by other countries" if those results aren't reported?

It's a fairly common sentiment that the U.S. penal system is heavily skewed toward retribution than reformation.[1] But identifying a problem on the one hand, and quantifying and addressing it on the other, are two entirely separate tasks. The latter is typically much more difficult.[2]

[1] Justice Anton Scalia admitted as much in court, "Well, I thought that modern penology has abandoned that rehabilitation thing, and they--they no longer call prisons reformatories or--or whatever, and punishment is the--is the criterion now. Deserved punishment for crime." Oral argument, Miller v. Alabama, 2012.

[2] Thus the quip, "Everybody complains about the weather, but nobody does anything about it." A reformulation of a Charles Dudley Warner quote, who, interestingly, also seems to have been an advocate for prison reform in his time, among many other civic and political reforms. See https://en.wikipedia.org/wiki/Charles_Dudley_Warner and https://books.google.com/books?id=ktwRAAAAYAAJ&q=+%22little+....

Post reply on HN