Eleven years ago, we posted The Risks Of WiFi Deployment In Prisons outlining the security risks and operational challenges of deploying WiFi in prisons to support the connectivity needs of inmate devices. It was written in response to Global Tel*Link (now ViaPath) first announcing it would be offering inmate tablets.

After laying out detailed security and operational hurdles of inmate WiFi access, we concluded, “It is clear that achieving adequate WiFi signal coverage and application data throughput at a reasonable cost of installation is a challenge in this unique environment. Ongoing equipment maintenance expense as well as repair cost due to vandalism must also be considered when looking at the total cost of this approach.

In contrast, as evidenced by the high number of contraband devices and continued use of smuggled cell phones in jails and prisons globally, cellular signal strength and coverage is typically more than adequate, with no onsite equipment required.

Additionally, 4G LTE (and soon 5G) cellular may be much faster than a WiFi network with an undersized or overburdened connection to the Internet (designed for coverage versus designed for capacity).”

With the recent launch of Securus Technologies’ new inmate tablets utilizing a nationwide cellular network, their press release confirms our 11 year old analysis and assertions regarding the operational inadequacy and security risks of deploying WiFi in prisons.

From the press release:

“Because of the complex implementation requirements in corrections settings, deploying tablet technology can take months, quarters, even years to fully implement, but the infrastructure with our new tablet technology allows for quicker and cost-effective deployment”

“Currently, tablets rely on a complex, on-site setup to connect to cloud-based services, which is costly and time-consuming. EVOTAB and Officer T80 tablets directly connect to a cloud platform using a secure cellular network, which is faster, more secure, and less hardware intensive.”

Better late than never I suppose…

The post Securus Gets the Signal, Eleven Years Later appeared first on meshDETECT® Blog.

With Global Tel*Link all but announcing at the recent Corrections Technology Association Annual Meeting its intention to offer mobile services in prisons, now may be the time to consider the best technology architecture for such deployments for those prison administrators who see the potential benefits of a secure prison cell phone solution.

There are essentially two ways to provision wireless personal communication devices, such as prisoner tablets, in a prison environment. In its presentation, Global Tel*Link stated that it has chosen to deploy service using WiFi to provide wireless connectivity. We think there are some significant operational challenges and, more importantly, serious security risks in this approach.

Security Risks

There are two main security risks, as highlighted by the recent news articles below. The first is the potential for intentional hacking of the system, either internally by tech savvy prisoners, or externally by those determined to defeat the WiFi security controls in order to gain or grant unfettered access to Global Tel*Link services, connected prison systems (commissary and trust accounts, etc.) or the unfiltered internet. A very real challenge with the decision to deploy a prison WiFi network is external hackers “wardriving” the system from outside the prison facility in order to accomplish this.

The second risk is the unintentional granting of access to the internet due to incompetence, human error and service misconfiguration.

In either case, the deployment of a local access wireless network via WiFi means that a single security breach, password hack or incompetent admin may result in unsecured and unmonitored access to internal prison systems and the outside world for all devices on the network.

In contrast, meshDETECT uses the traditional telco mobile network to provide secure voice and media services. Any breach, should it occur, is limited to a single device. If a device is hacked, a risk Global Tel*Link will also have to manage, one detainee may benefit; but no one can hack AT&T, Verizon, etc. in such a way to give all the meshDETECT mobile devices deployed in a prison unfettered access to the internet, or unmonitored calls to harass outside parties and plan crimes.

Technology choices in the deployment of a secure prison mobile access network service must focus on security, not profitability.

Operational Challenges

Now lets look at the operational challenges associated with deploying WiFi within a prison facility:

• Low powered – hand held devices maximum output is normally 0.4 Watt.

• Signal can suffer interference from other devices such as two way radios used by staff.

• Best when there is line of sight between transponders.

• Does not penetrate solid mass – concrete, brick, metal – the less porous the material the shorter the range and the slower the speed. Prison construction is high density blocks and cell doors are often clad in metal with metal surrounds.

• Tinted / reflective glass contains metal fragments resulting in drop in signal strength.

• Security fencing can act as a Faraday cage and ground the signal.

It is clear that achieving adequate WiFi signal coverage and application data throughput at a reasonable cost of installation is a challenge in this unique environment. Ongoing equipment maintenance expense as well as repair cost due to vandalism must also be considered when looking at the total cost of this approach.

In contrast, as evidenced by the high number of contraband devices and continued use of smuggled cell phones in jails and prisons globally, cellular signal strength and coverage is typically more than adequate, with no onsite equipment required. Additionally, 4G LTE (and soon 5G) cellular may be much faster than a WiFi network with an undersized or overburdened connection to the Internet (designed for coverage versus designed for capacity).

Real World Examples

Securus Finally Admits The Risks Of WiFi Deployment In Prisons

With the recent launch of Securus Technologies’ new inmate tablets utilizing a nationwide cellular network, their press release confirms our analysis and assertions regarding the operational inadequacy and security risks  of deploying WiFi in prisons detailed above. This blog post was written eleven years ago on June 6, 2013.

From the press release:

“Because of the complex implementation requirements in corrections settings, deploying tablet technology can take months, quarters, even years to fully implement, but the infrastructure with our new tablet technology allows for quicker and cost-effective deployment”

“Currently, tablets rely on a complex, on-site setup to connect to cloud-based services, which is costly and time-consuming. EVOTAB and Officer T80 tablets directly connect to a cloud platform using a secure cellular network, which is faster, more secure, and less hardware intensive.”

Source

Mich. DOC updates policy after inmates rig tablets to conduct ‘criminal’ activity

Overall, since October 2024, the Department of Corrections has found that about 5% of the 24,000 JPay tablets, or about 1,200, were compromised after inmates enabled Wi-Fi on the devices, had them in an unauthorized unit or had unauthorized apps.

“(Inmates are) watching movies. They’re watching pornography. They’re communicating with family and or gang members outside the prison system,” Osborn told The Detroit News. “With these tablets in this jailbroke status, they can do whatever the hell they want.”

The Department of Corrections works to find and remove compromised tablets and identify contraband, such as Wi-Fi sticks, used to rig them for internet access.

Source

New Wi-Fi Takeover Attack—All Windows Users Warned To Update Now

Microsoft has confirmed a new and quite alarming Wi-Fi vulnerability in Windows, which has been rated 8.8 out of 10 in terms of severity using the Common Vulnerability Scoring System. The vulnerability, assigned as CVE-2024-30078, does not require an attacker to have physical access to the targeted computer, although physical proximity is needed. Exploiting this vulnerability can allow an unauthenticated attacker to gain remote code execution on the impacted device. What’s perhaps most concerning, though, is that this Wi-Fi driver security flaw affects all supported versions of the Windows operating system.

Source

WiFi vulnerability may leave millions of devices open to ‘frag attacks’

A security researcher known for pointing out faults in WiFi security has discovered another vulnerability. The newly unearthed flaws, known as “frag attacks,” are believed to be widespread as they stem from the WiFi standard, with some bugs dating back to 1997. While several additional vulnerabilities are caused by programming mistakes in WiFi products and affect every WiFi device, Belgian security researcher Mathy Vanhoef wrote on his blog.

Theoretically, if exploited, the vulnerabilities would allow an attacker within radio range to steal user information or attack devices. But, the chances of the flaws being abused should be low as the attacks require user interaction or uncommon network settings.

Breaking down how they work, Vanhoef explained that several of the flaws can be abused to “easily inject” plaintext frames into a protected Wi-Fi network,” along with certain devices accepting “plaintext aggregated frames that look like handshake messages.” This can be used to intercept traffic by tricking the victim into using a malicious DNS server, the researcher noted. In experiments, Vanhoef found that two out of four tested home routers were affected by this vulnerability, along with several IoT devices and some smartphones.

Other vulnerabilities are linked to the process by which the WiFi standard breaks and then reassembles network packets, allowing an attacker to siphon data by injecting their own malicious code during this operation.

Source

A Flaw in Billions of Wi-Fi Chips Let Attackers Decrypt Data

Billions of devices—many of them already patched—are affected by a Wi-Fi vulnerability that allows nearby attackers to decrypt sensitive data sent over the air, researchers said on Wednesday at the RSA security conference. Affected devices include iPhones, iPads, Macs, Amazon Echos and Kindles, Android devices, and various Wi-Fi routers.

The vulnerability exists in Wi-Fi chips made by Cypress Semiconductor and Broadcom, the latter a chipmaker Cypress acquired in 2016. The affected devices include iPhones, iPads, Macs, Amazon Echos and Kindles, Android devices, and Wi-Fi routers from Asus and Huawei, as well as the Raspberry Pi 3. Eset, the security company that discovered the vulnerability, said the flaw primarily affects Cypress’ and Broadcom’s FullMAC WLAN chips, which are used in billions of devices. Eset has named the vulnerability Kr00k, and it is tracked as CVE-2019-15126.

Manufacturers have made patches available for most or all of the affected devices, but it’s not clear how many devices have installed the patches. Of greatest concern are vulnerable wireless routers, which often go unpatched indefinitely.

Source

Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords

The next-generation Wi-Fi Protected Access protocol released 15 months ago was once hailed by key architects as resistant to most types of password-theft attacks that threatened its predecessors. On Wednesday, researchers disclosed several serious design flaws in WPA3 that shattered that myth and raised troubling new questions about the future of wireless security, particularly among low-cost Internet-of-things devices.

Every Wi-Fi network at risk of unprecedented ‘Krack’ hacking attack

Every Wi-Fi connection is potentially vulnerable to an unprecedented security flaw that allows hackers to snoop on internet traffic, researchers have revealed.

The vulnerability is the first to be found in the modern encryption techniques that have been used to secure Wi-Fi networks for the last 14 years.

In theory, it allows an attacker within range of a Wi-Fi network to inject computer viruses into internet networks, and read communications like passwords, credit card numbers and photos sent over the internet.

The so-called “Krack” attack has been described as a “fundamental flaw” in wireless security techniques by experts. Apple, Android and Windows software are all susceptible to some version of the vulnerability, which is not fixed by changing Wi-Fi passwords.

“It seems to affect all Wi-Fi networks, it’s a fundamental flaw in the underlying protocol, even if you’ve done everything right [your security] is broken,” said Alan Woodward of the University of Surrey’s Centre for Cyber Security.

Source

Wi-Fi software security bug could leave Android, Windows, Linux open to attack

In an e-mail today to the Open Source Software Security (oss-security) mailing list, the maintainer of wireless network client code used by Android, the Linux and BSD Unix operating systems, and Windows Wi-Fi device drivers sent an urgent fix to a flaw that could allow attackers to crash devices or even potentially inject malicious software into their memory. The flaw could allow these sorts of attacks via a malicious wireless peer-to-peer network name.

The end result is that an attacker could corrupt information in memory, causing wpa_supplicant and Wi-Fi service to crash; a crafted SSID could essentially be used as a denial-of-service attack on affected devices simply by sending out responses to Wi-Fi probe requests or P2P network Public Action messages. But it could also expose memory contents during the three-way handshake of a peer-to-peer network negotiation (the GO negotiation) or potentially allow for the attacker to execute code on the target.

Source

Military Cuts Guantanamo Bay WiFi After Alleged Threat by Anonymous

The Guantanamo Bay detention camp is losing all access to wireless internet and social networks due to hacking threats.

U.S. military officials have blocked access to wireless internet and social networks like Facebook and Twitter at Guantanamo Bay because it fears that international hacking group Anonymous will launch an attack to disrupt services at the naval base.

Anonymous launched a global online protest to mark the 100th day of the hunger strike by Guantanamo Bay prisoners. The detainees have been protesting their living conditions and indefinite detention at the base.

The U.S. military said it has been receiving online hacking threats amid the hunger strike, which were allegedly from Anonymous.

Source

Prisoners Accessed Internet Through Faulty Computer Kiosks

Prisoners in privately run Mt Eden Corrections Facility were able to access the internet through faulty computer kiosks a security review of public sector computer systems has found.

The security breach was one of 12 “weak points” identified in Government Chief Information Officer Colin McDonald’s review of the security of 215 publicly accessible state sector agency IT systems released this morning.

Serco, the company which operates Mt Eden said that on November 26 last year, “an administrative error made it possible to open a web browser session” on kiosks provided to prisoners to allow them to “take responsibility for organizing their day-to-day lives and helps to develop literacy and numeracy skills”.

Serco’s Director of Operations Scott McNairn said the error “allowed for limited access to the internet, policed by a web filter which blocked access to inappropriate sites”.

“No email, social media or adult sites were accessed.”

The internet access was “limited” and “at no time was it possible to access any other systems or information”.

Serco has not said how long prisoners were able to access the internet for.

Mr McNairn said the company had improved security for the kiosks and was “confident” that the likelihood of further problems was “extremely low”.

Source

Jailed Hacker Hacks Prison Network

It’s almost comical, but an incarcerated hacker has hacked into his prison’s computer network.

According to Naked Security (Sophos), Nicholas Webber, who operated the GhostMarket.Net cybercrime website, signed-up for the prison’s IT class. Webber, who was 18 at the time of his arrest for bank frauds and identity theft scams, apparently go onto the network but was unable to access personal information files.

The prison issued a statement to the Register: “At the time of this incident in 2011 the educational computer system at HMP Isis was a closed network. No access to personal information or wider access to the internet or other prison systems would have been possible.”

The incident, which occurred in 2011, only came to light because of a wrongful termination suit by the instructor leading the class.

Source

The post The Risks Of WiFi Deployment In Prisons appeared first on meshDETECT® Blog.

Another article highlighting the reality that the problem of contraband cell phones smuggled into prisons is a global one. In this case, Kenya’s largest cellular network service provider, Safaricom, will be installing cell phone jammers in the nation’s prisons. According the article, 70 per cent of phone-related fraud originates from prisons there.

Major prisons in Kenya will be cut off the Safaricom mobile phone network in a bid to curb M-Pesa and SMS fraud.

The Prisons Service and Safaricom have struck a deal to join hands in fighting the crimes that are thought out and executed behind prison walls.

“A high percentage of these (fraudsters) have been from prisons. We must not allow the activities of a small number of people to have an impact on our customers,” Mr Bob Collymore, the Safaricom chief executive, said at the Prisons Service headquarters where the deal was signed.

Lion’s share of market

Mr Collymore said subscribers had lost more than Sh10 million over the last four months to the fraudsters.

He said Safaricom will be investing Sh10 million in the installation of equipment to jam mobile phone networks in the prisons, starting with the Kamiti Maximum Security Prison.

Statistics by the company, which has 17.3 million subscribers — the lion’s share of the market — show that 70 per cent of phone-related fraud originates from prisons.

According to the Prisons Service, 65 per cent of the phone-related fraud cases over the last four months have originated from Kamiti prison.

It is followed by Nakuru GK Prison with 15 per cent, Meru with 12 per cent, Shimo la Tewa at the Coast with six per cent and Kibos one per cent.

“We have sort of found a solution that will work for the time being,” said Commissioner of Prisons Isaiah Osugo, who lamented that the crimes persist despite frequent searches to rid inmates of mobile phones.

He said the prisoners often get the phones when they are taken to the courts, hospitals and out of the prisons for community work. He said that some inmates even hide them in their private parts.

Mr Osugo said the prisoners are also often assisted by warders, who defy rules forbidding them from having mobile phones within prison cells.

The fraudsters impersonate Safaricom staff and ask their targets to send money to redeem phony prizes, send fake M-Pesa messages and ask for refunds or pretend to offer jobs in the military and police for a bribe.

There are also those who call or send messages alleging they have been sent to kill the target and demand payment to call off their alleged missions.

Source

The post Wireless Carrier to Cut Off Jails appeared first on meshDETECT® Blog.