John Strand breaks into things for a living. As a penetration tester, he gets hired by organizations to attack their defenses, helping reveal weaknesses before actual bad guys find them. Normally, Strand embarks on these missions himself, or deploys one of his experienced colleagues at Black Hills Information Security. But in July 2014, prepping for a pen test of a South Dakota correctional facility, he took a decidedly different tack. He sent his mom.
In fairness, it was Rita Strand’s idea. Then 58, she had signed on as chief financial officer of Black Hills the previous year after three decades in the food service industry. She was confident, given that professional experience, that she could pose as a state health inspector to gain access to the prison. All it would take was a fake badge and the right patter.
“She approached me one day and said, ‘you know, I want to break in somewhere,” says Strand, who is sharing the experience this week at the RSA cybersecurity conference in San Francisco. “And it’s my mom, so what am I supposed to say?”
That’s not as easy a call as it might sound. Penetration testers always say that you can get amazingly far with just a clipboard and some confidence, but a novice run at a state correctional facility is just plain daunting. And while pen testers are contractually permitted to break into a client’s systems, if they’re caught tensions can escalate quickly. Two pen testers who broke into an Iowa courthouse as part of their job recently spent 12 hours in jail after a run-in with local authorities.
Rita Strand’s mission would also be complicated by her lack of technical expertise. A professional pen tester would be able to assess an organization’s digital security in real-time and plant backdoors tailored to what they found on the specific network. Rita had the health inspector guise down cold, but she was no hacker.
To help get her in the door, Black Hills made Rita a fake badge, a business card, and a “manager’s” card with John’s contact info on it. Assuming she got inside, she would then take photos of the facility’s access points and physical security features. Rather than have her try to hack any computers herself, John equipped Rita with so-called Rubber Duckies, malicious USB sticks that she would plug into every device she could. The thumb drives would beacon back to her Black Hills colleagues and give them access to the prison’s systems. Then they could work on the digital side of the pen test remotely, while Rita continued her rampage.
“For most people, the first couple of times they do this they get really uncomfortable,” Strand says. “But she was all ready to go. Prison cybersecurity is crucial for obvious reasons. If someone could break into the prison and take over computer systems it becomes really easy to take someone out of the prison.”
The morning of the pen test, the Strands and some colleagues carpooled to a cafe near the prison. Over a preparatory caramel roll and slice of pecan pie, they set up a war room of laptops, mobile hotspots, and other gear. When everything was set, Rita drove off to the prison on her own.
“She takes off and I’m thinking in the back of my head that this is a really bad idea,” Strand says. “She has no pen testing experience. No IT hacking experience. I had said, ‘Mom if this gets bad you need to pick up the phone and call me immediately.'”
Pen testers usually try to get in and out of a facility as quickly as possible to avoid arousing suspicion. But after 45 minutes of waiting, there was no sign of Rita.
“It gets to be about an hour and I’m panicking,” he says. “And I’m thinking I should have thought it through, because we all went in the same car so I’m out in the middle of nowhere at a pie shop with no way to get to her.”
