Show Hide image

This woman can hack prisons... and that’s a good thing

She can, in theory, open the doors in any prison in the US from her computer. Thankfully, Tiffany Rad is a “white hat”, an expert who uses the tools of the hacking trade to find cyber-security weaknesses before the bad guys do

In the state of Virginia, possessing lock-picking tools is a criminal offence. Why else, Virginian law asks, would you have lock-picking tools if you don’t intend to pick a lock? And why would you pick a lock if you don’t have criminal intent?

For many in the hacking community, this train of thought falls short of rationality. Tiffany Rad, a practising lawyer who is also a “white hat” hacker and penetration tester, tells me that her father taught her to pick locks as a child, and that she will be teaching her own children the same skill. “It teaches problem-solving,” she says, “but also understanding how something works, how it can be broken and what would make this lock harder to pick.”

Helpfully, she has a lock to hand. “In this example we’re doing, it would be more pins within the lock, picking the pins at different angles, using different tools that would make it harder.”

She points out that, in the UK, an organisation called Toool teaches people how to pick locks – “and then many go on to become locksmiths”.

White hat hackers could perhaps be considered the locksmiths of the cybersecurity world. They search for weaknesses and vulnerabilities within a company’s system and bring it to the attention of the organisation, for the good of their security. “Hacking” may be a term that gets a bad press, but the key difference between “good” and “bad” hacking, Rad argues, is intent. White hats intend to cause good, helping companies to improve their security from the perspective of a potential “black hat” hacker. Just as a locksmith may carry his lock-picking equipment on his person with no harmful intent, a white hat may use their hacking capabilities to make gateways stronger. Ability doesn’t equate to criminality.

In 2013, the Turner Guilford Knight Correctional Center in Miami, Florida experienced a potentially catastrophic security breach when the cell doors in the maximum security wing of the prison simultaneously opened, allowing prisoners to leave their cells unguarded. Although the incident was never proven to have been the work of a third party, or black hats, concerns were raised that it might have been an attack orchestrated from the outside. Video footage seemed to suggest that one of the inmates had anticipated the opening of the doors, proceeding to carry out an attack on another inmate. In the years since, the spectre of a hack on a maximum security prison has overshadowed discussions about the future of cyber security.

The Miami prison episode inspired Tiffany, and her father, the security consultant and engineer John Strauchs, to see if it was possible to hack an industrial control system in such a way, and to shed some light on whether what had happened at the prison could have been the work of sinister forces.

“I had the idea for this project initially because I was studying the mechanics of the Stuxnet worm,” Rad explains. Stuxnet was a computer worm that collected information and compromised the centrifuges in the Iranian nuclear programme, causing them to selfdestruct. Although speculation remains about who was actually behind it, there is little doubt about the severity of the hacking: a fifth of the centrifuges were destroyed and huge damage caused to Iran’s nuclear programme.

Stuxnet specifically targeted the programmable logic controllers (PLCs) within the system. PLCs are commonly used in prisons and other industrial facilities such as power plants. “The programmable controller acts as a simple junction,” says Rad. “One wire can go back to the control centre instead of having tons of copper wire going through these facilities. So that type of controller is used in a lot of places.

She continues: “We wrote an exploit [the software] in just two weeks. We had purchased a programmable logic controller on eBay. The fact that we were able to create a project like this in two weeks [made it] evident to us that the bad guys already know how to do this – and they have a lot more funding and time han we have.”

The discovery was vital security information, because although the system was known to be hackable, the fact that it had been so easily infiltrated by outsiders raised considerable concern.

“I think there had been other people talking about industrial control-system vulnerabilities before,” says Rad. “This wasn’t a surprise. What was a surprise is that we could do it in two weeks and hire equipment off eBay, and if we didn’t want to pay for the appropriate legal licence it would have a cost $500 plus the cost of an export writer.

“Where do we hear that these facilities are not connected to the internet but there would be a huge national security risk if something actually happened? We found so many places. It wasn’t just correctional facilities – it was public transit, heating and air conditioning. In the middle of summer when it’s very hot, you can do significant destruction to the computer if you turn up the heat and turn down the AC.”

Despite the benefits gained from their expertise, attitudes towards white hats are still somewhat hostile. The Wassenaar Arrangement, a multilateral agreement intended to strengthen international security, has disadvantages for the cyber-security industry, Rad argues. Amended in 2013, it now includes the control of intrusion software, which she says makes the job of white hats harder: “When you’re hired as a penetration tester, you need to have a good set of tools. And when there is legislation that affects your ability to collect these tools, create them, buy them, sell them, trade them with other people that do this kind of work, that’s not good.”

Some organisations are more grateful to white hats than others, Rad says. “As an attorney I get calls frequently from those doing security research that want to tell the company about their vulnerability. They want to disclose it to them but they’re afraid they’re going to turn around and get sued.

“So, I help facilitate that information trade-off while protecting that person’s identity. As an attorney, I get a special privilege where I don’t have to tell anyone who my client is. I can just say, ‘You need to know this information. I’m protecting them. They are a client of mine. I’m going to give you the information, but please let’s not turn it around.’ Most of them [her clients] are white-hat security researchers who have stumbled on something and want them to fix it.”

The situation for these people is improving, she adds. “I’m glad to say that it’s changed over the years. When I first started ten years ago it used to be very confrontational. I’d call [and say], ‘I’d like to speak to a security engineer.’ Sometimes that didn’t exist – I’d be put through to IT, and IT is not the same. Then they would say, ‘We’re going to have you talk to our attorneys.’ It’s not a good way [to respond] because the researcher gets very nervous and the other side makes you tell them who did this, and it’s just not right.

“It’s a trade-off, and nowadays you need to welcome this type of information. You want to hear it from someone who is a white hat before you read it in the paper that someone else with malicious intent just took all your data and put it in the bin.”

Indeed, it is in the company’s best interests to respond with gratitude to any security breach by a white hat, as Rad makes clear: “Because if I know about it, chances are a lot of people do too.” These people may not necessarily be the locksmiths.

It’s not just companies and industries that need the help of white-hat hackers. White hats can also identify threats to their country’s national security. In 2015, a man claimed that he had hacked into the entertainment system while on a United Airlines passenger jet, and had subsequently turned the aircraft on its side by putting its omputer system into “climb mode”.

 “If what he did was true, that’s pretty irresponsible,” Rad says. “But if he was able to do this, then the aviation service has some vulnerabilities.”

Whether someone could hack a plane is undoubtedly a question for national security. “It’s hard to say, because the newer ones have different networks but, saying that, the older ones will be up in the air for a while.”

Ultimately, Rad argues, the key to preventing attacks is not trying to speculate whether they could happen, but using penetrative and offensive testing to actively simulate security breaches. If we are to do that, we need to listen to and encourage the white hats. “I want to believe that the aviation industry looks at things from a hacker’s perspective.”

She adds: “I’m also a dual [US-Latvian] citizen. Latvia and the Baltic States are very nervous about Russia’s capabilities – it’s the future, I think. Every government is going to need to have these [cyber-security] capabilities and if you make it illegal for your citizens to create or design these, you are going to be stifling your own defence.”

The Pentagon this year launched its first “bug bounty” programme, in which it challenged the white hacker community to penetrate its systems to try to find vulnerabilities within them. It received 138 legitimate reports of vulnerabilities, which were then patched up.

If the Pentagon has come to understand the benefits of white hats, why do we continue to legislate against them? It comes back to the Wassenaar Arrangement, Rad says. “I don’t think it was intended to be written that way, but that was the consequence of that.”

However, she remains optimistic: “There are some people I know who cannot work for the military or US federal government. They don’t want to but they’re very good at writing these exploits. They just don’t want 9-5 jobs. The way that they work and their personality is not the same as everyone else in the army or the navy. But the [armed services] would like these people to share some of the information they have with them.”

In fact, the Pentagon has in recent years recruited software writers, she says. “They need people with these skills, and you don’t have to wear a suit every day.”

Overall, as with many things, the key lies in education and greater public awareness, so that hacking is more widely seen as a beneficial tool.

Rad concludes: “Hopefully the next generation will be telling employers: ‘We need to design this with security in mind because here’s an example of when this didn’t go right. Let’s not do this again.’ ”

Will Dunn is the New Statesman's Special Projects Editor. 

Show Hide image

Investing in a secure future

Increased training and investment in cyber security infrastructure are essential in the digital age.

It is easy to underestimate how crucial the internet is to our everyday lives. It has become an essential tool in the way we communicate with others and conduct business both at home and abroad. More than 1.6m people work in the digital sector or in digital tech roles in the United Kingdom and the internet continues to provide individuals and businesses with huge opportunities.

However, we know that criminals seek to exploit the many benefits of the internet for their own personal gain, often at great expense to others. The WannaCry ransomware attack, which hit the NHS as well as other organisations, highlights the seriousness of the threat and reinforces the need to properly protect ourselves online.

In the recent Cyber Security Breaches Survey 2017, just under half (46 per cent) of all businesses identified at least one breach or attack in the last year. Although it is difficult to put an exact figure on how much this cost the UK economy, it is likely to be in the billions.

We are also all too aware of attacks by hostile state actors who look to exploit the UK through intellectual property theft, in order to further their own interests and prosperity. We take these attempts to disrupt our national security very seriously.

That is why this the government set up the National Cyber Security Centre (NCSC), which provides cyber security at a national level. In its first year of being operational, the NCSC responded to 590 significant cyber incidents, more than 30 of which were sufficiently serious to require a cross-government response.

It is not just large organisations and our national infrastructure that are targeted by online criminals; individuals also face the daily threat of being scammed in their own homes. It is now the case that British citizens are 20 times more likely to be defrauded at their computer than mugged in the street.

It is a threat we all face. I strongly believe that we – individuals, businesses and the government – must play our own part to mitigate the risk and ensure that the internet is a safe and secure space for everyone. The government has legislated within the Serious Crime Act 2015 to create a new offence that applies where an unauthorised act in relation to a computer results in serious damage to the economy, the environment, national security or human welfare, or a risk of such damage occurring.

Legislating against online criminality goes some way to tackling the problem; however, close collaboration between the government, business and international partners is essential in combating the increasingly sophisticated attacks that the UK faces.

We work closely with the NCSC, which acts as a bridge between industry and government, providing a unified source of advice and the management of cyber-related incidents. It is at the heart of the government’s 2016 National Cyber Security Strategy, which is supported by £1.9bn of transformational investment to 2021.

Our law enforcement agencies across England and Wales also play a vital role in disrupting the activities of cyber criminals and bringing them to justice. They now operate as a single networked resource with the National Crime Agency (NCA) and Regional Cyber Crime Units using shared intelligence and capabilities. The NCA also has a dedicated Dark Web Intelligence Unit which targets those criminals who exploit hidden areas of the internet.

But we also want people to take their own preventative measures, so that they don’t become a target by criminals operating in the cyber space. We are running a series of campaigns and programmes which aim to encourage individuals and businesses to adopt more secure online behaviours.

Cyber Aware works with over 320 public and private sector partner organisations to encourage us all to take simple steps to protect ourselves online including using a strong, separate password for our email accounts and installing the latest software and app updates on our electronic devices.

The NCSC has also recently launched expert guidance on how small businesses can easily avoid common online breaches and attacks. Should organisations seek to improve their cyber security further, they can get certification through the Cyber Essentials Scheme.

To further support the efforts of SMEs in improving their cyber security, regional cyber crime prevention coordinators engage with businesses and members of the public to provide customised cyber security advice based on the latest technical guidance from the NCSC.

We must also look to the future – we now have a whole generation that have grown up immersed in tech. It is hugely important that we harness their talents and put them to good use rather than letting them wander down a path towards criminal online activities.

We must train and engage with the next generation of cyber security experts and is why the NCSC is taking a leading role in promoting a culture where science and technology subjects can flourish within the education system. Their CyberFirst programme identifies and nurtures young talent through a series of summer workshops and competitions. In addition, their CyberUK 2018 programme focuses on encouraging more women to enter into the technology industry, a sector that is largely seen as male-dominated.

There is a great effort across government and law enforcement to pursue online criminals, prevent
those that are headed on a path towards criminal activity, protect the public and prepare for the many threats we face online. We will continue to invest in law enforcement capabilities at a national, regional and local level to ensure agencies have the capacity to deal with the increasing threat from cyber crime.

However, this is not a threat that we can tackle alone. It is everybody’s responsibility, from top to bottom, to follow the guidance provided and increase their awareness of cyber security in order to create a safe space to communicate and conduct business online.