St. Louis, Missouri – March 14, 2013 – Belden Inc. (NYSE: BDC), a global leader in signal transmission solutions for mission-critical applications, announces that its Tofino Security brand has published new research showing that patching is often ineffective in providing protection from the multitude of vulnerability disclosures and malware targeting critical infrastructure systems today. While patching such systems is important as part of an overall Defense in Depth strategy, the difficulties of patching for industrial systems mean that compensating controls such as Tofino Security Profiles are often a better method of providing immediate protection.
Since the discovery of the Stuxnet malware in 2010, industrial infrastructure has become a key target for security researchers, hackers, and government agents. Designed years ago with a focus on reliability and safety, rather than security, Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) products are often easy to exploit. As a result, there has been exponential growth in government security alerts for these systems in the past two years. In addition, they have attracted some of the most sophisticated (Stuxnet, Night Dragon, Flame) and damaging (Shamoon) cyberattacks on record.
Eric Byres, CTO and vice president of engineering at Tofino Security, investigated the effectiveness of patching for protecting control systems from vulnerability exploits and malware. His work revealed that:
• The number of vulnerabilities existing in SCADA/ICS applications is high, with as many as 1,805 yet to be discovered vulnerabilities existing on some control system computers.
• The frequency of patching needed to address future SCADA/ICS vulnerabilities in both controllers and computers likely exceeds the tolerance of most SCADA/ICS operators for system shutdowns. Unlike IT systems, most industrial processes operate 24x7 and demand high uptime. Weekly shutdowns for patching are unacceptable.
• Even when patches can be installed, they can be problematic. There is a 1 in 12 chance that any patch will affect the safety or reliability of a control system, and there is a 60% failure rate in patches fixing the reported vulnerability in control system products. In addition, patches often require staff with special skills to be present. In many cases, such experts are often not certified for access to safety regulated industrial sites.
• Patches are available for less than 50% of publically disclosed vulnerabilities.
• Many critical infrastructure operators are reluctant to patch as it may degrade service and increase downtime.
When patching is not possible, or while waiting for a semi-annual or annual shutdown to install patches, an alternative is to deploy a workaround, also known as a ‘compensating control’. Compensating controls do not correct the underlying vulnerability; instead, they help block known attack vectors. Examples of compensating controls include product reconfigurations, applying suggested firewall rules, or installing signatures that recognize and block malware.
Another compensating control is Tofino Security Profiles, available in Belden’s Tofino Security product line. Tofino Security Profiles are rule and protocol definitions that address newly disclosed vulnerabilities. They provide a simple way for automation system vendors to create and securely distribute malware protection. Operators benefit from a single, easy-to-deploy package of tailored rules that can be installed without impacting operations. The result is that critical industrial infrastructure facilities can quickly and effectively defend themselves against new threats.
“My research highlights the multiple challenges with patching for SCADA and ICS systems,” remarked Eric Byres. “To secure facilities, critical infrastructure operators should pursue a Defense in Depth strategy that includes patching when possible, and use compensating controls for protection when patching is not possible.”
Starting today, Belden is publishing a series of blog articles on its patching research and is accompanying them with useful documents. These documents include:
• “Patching for Control System Security - A Broken Model?”; a presentation that summarizes its patching research,
• “Patching for Control System Security - A Broken Model?“ a peer reviewed published paper,
• and “Solving the SCADA/ICS Security Patch Problem”, a White Paper.
Tofino Security provides practical and effective industrial network security and SCADA security products that are simple to implement and that do not require plant shutdowns. Its products include configurable security appliances with a range of loadable security modules plus fixed function security appliances made for specific automation vendor applications. Tofino Security products protect zones of equipment on the plant floor, and are complementary to Belden’s Hirschmann brand, which leads industrial networking solutions. Both groups service and secure industrial networks in the oil and gas, utilities, transportation and automation industries.
About Belden
St. Louis-based Belden Inc. designs, manufactures, and sells connectivity solutions for markets including industrial, enterprise, and broadcast. It has approximately 6,700 employees, and has manufacturing capabilities in North America, South America, Europe, and Asia, and a market presence in nearly every region of the world. Belden was founded in 1902, and today is a leader with some of the strongest brands in the signal transmission industry. For more information, visit www.belden.com.
###
For more information, contact:
Joann Byres
VP and General Manager
Tofino Security
+1 250 984 4105
joann.byres@belden.comMichelle Foster
Corporate Communications
Belden Inc.
314-854-8006
Belden, Belden Sending All The Right Signals, Tofino, Plug-n-Protect and the Belden logo are trademarks or registered trademarks of Belden Inc. or its affiliated companies in the United States and other jurisdictions. Belden and other parties may also have trademark rights in other terms used herein.
Related Links
ELyssa D. Durant © 2007-2020
Tuesday, April 2, 2013
Belden Research Shows that Patching for Industrial Cyber Security is a Broken Model | Tofino Industrial Security Solution
SCADA honeypots attract swarm of international hackers
Vulnerable internet-facing industrial systems controlling crucial equipment used by power plants, airports, factories and other critical systems are subjected to sustained attacks within hours of appearing online, according to new honeypot-based research by Trend Micro.
The security weaknesses of SCADA (supervisory control and data acquisition) industrial control systems have been a major focus of interest in information security circles for the last three years or so thanks to Stuxnet, Duqu, and other similar noteworthy attacks.
Trend Micro threat researcher and SCADA security expert Kyle Wilhoit set out to look into this phenomenon in greater depth by setting up a internet-facing honeypot and record attempted attacks [1]. The honeypot architecture developed by Wilhoit directly mimics those of real industrial control systems and SCADA devices.
The researcher, who was once the lead incident handler and reverse engineer at a large energy company, focusing on ICS/SCADA security and persistent threats, created a total of three honeypots.
All three were internet-facing and used three different static IP addresses in different subnets scattered across the US. One honeypot featured a programmable logic controller (PLC) system running on a virtual instance of Ubuntu hosted on Amazon EC2, and configured as a web page that mimics that of a water pressure station. Another honeypot featured a web server that mimicked a control interface connected to a PLC production system. The final honeypot was an actual PLC device set up to mimic temperature controller systems in a factory.
All three honeypots included traditional vulnerabilities found across the same or similar systems. Steps were taken to make sure the honeypots were easily discovered. The sites were optimised for searches and published on Google.
The researchers also made sure that that honeypot settings would be seeded on devices that were part of HD Moore’s Shodan Project, which indexes vulnerable routers, printers, servers and internet-accessible industrial control systems. Once a search latches onto a vulnerable embedded device, then Metasploit provides a library of possible attacks, which - as security strategist Josh Corman points out [2] - can be run without any detailed knowledge or skill.
The Trend Micro security researchers excluded simple port scans and focused on recording anything that might pose a threat to internet-facing ICS/SCADA systems. This includes unauthorised access to secure areas of sites, attempted modifications of controllers, or any attack against a protocol specific to SCADA devices, such as Modbus/TCP.
They also logged any targeted attempt to gain access or take out servers running the system. Various tools including popular open-source intrusion detection package Snort, honeyd (modified to mimic common SCADA protocols), tcpdump and analysis of server log files were used to monitor and record the attacks the honeypots attracted.
Less than 24 hours later...
The researchers waited less than a day before the attacks began, as Wilhoit explains in a research paper Who’s Really Attacking Your ICS Equipment? (PDF [3]).
It took only 18 hours to find the first signs of attack on one of the honeypots. While the honeypots ran and continued to collect attack statistics, the findings concerning the deployments proved disturbing. The statistics of this report contain data for 28 days with a total of 39 attacks from 14 different countries. Out of these 39 attacks, 12 were unique and could be classified as “targeted” while 13 were repeated by several of the same actors over a period of several days and could be considered “targeted” and/or “automated.” All of these attacks were prefaced by port scans performed by the same IP address or an IP address in the same netback.The attacks included attempts to spear-phish a site administrator, bids to exploit fundamental ICS protocols and malware exploitation attempts on the servers running the honeypot environment. Other hacks included bids to change the CPU fan speed on systems supposedly controlling a water pump and attempts to harvest systems information.
Four samples were collected over the four-week testing period, two of which have not been seen in the wild. Trend Micro is currently analysing these pieces of malware to determine their functionality. As well as looking at the type of attack getting thrown against the honeypot system, researchers at Trend Micro also looked at the origin of attempted attacks.
A third of attacks against the industrial control system honeypot (35 per cent) originated in China but one in five (19 per cent) originated in the US. Security researchers also found that a surprisingly high 12 per cent of attacks against a honeypot control system they had established came from the southeast Asian nation of Laos.
These systems used to be run from a single computer next to a conveyor belt
Wilhoit, presented his research at the BlackHat Europe conference in Amsterdam, the Netherlands last Friday.
“This Trend Micro research shows that attackers have enough knowledge to analyse and affect industrial control devices' infrastructures,” said Raimund Genes, CTO at Trend Micro. “This is a wake-up call for operators of these infrastructures to check the security of these systems and ensure they are properly separated from the internet/open networks. The research also shows that it is not only usual suspects attacking, but that these attacks also happen in your own backyard.”
SCADA systems control everything from escalators in metro stations in Madrid to milk-processing factories in Mali and uranium enrichment centrifuges in Iran.
"Security in an ICS/SCADA network is often considered 'bolt-on' or thought of 'after the fact'. When these systems were first brought into service more than 20 or so years ago, security was typically not a concern," Wilhoit explains.
"However, as things changed over time, most of these systems’ purposes have been reestablished, along with the way they were configured. A system that used to only be accessible to a single computer next to a conveyor belt became accessible via the internet, with very little hindrance."
Wilhoit called for further research into motives, sources and delivery techniques of the increasingly sophisticated attackers who target industrial control systems. "Internet-facing ICS are readily targeted," Wilhoit warns. "Until proper ICS security is implemented, these types of attack will likely become more prevalent and advanced or destructive in the coming years."
A recent study [4] by InfraCritical discovered that 500,000 SCADA (supervisory control and data acquisition) networks were susceptible to attack, highlighting the wide-scale vulnerability of systems that control the operations of power and water plants, among other critical facilities. According to recent research conducted by ICS-CERT, 171 unique vulnerabilities affecting 55 different ICS vendors were found last year alone (PDF [5]).
And patching of industrial control systems creates its own problems, according to a study [6] by Tofino Security published last week.
Eric Byres, CTO and vice president of engineering at Tofino Security, reckons there are as many as 1,805 as-yet-undiscovered vulnerabilities existing on control system computers.
IC systems need FREQUENT patches... but if they're buggy, it ALL falls apart
The frequency of patching needed to address future SCADA/ICS vulnerabilities in both controllers and computers likely exceeds the tolerance of most SCADA operators for system shutdowns. Unlike IT systems, most industrial processes operate around the clock and demand high uptime. Weekly shutdowns for patching are unacceptable.
But even when patches can be installed, they can be problematic. According to Tofino Security, there is a one in 12 chance that any patch will affect the safety or reliability of a control system, and there is a 60 per cent failure rate in patches fixing the reported vulnerability in control system products. In addition, patches often require staff with special skills to be present. In many cases, such experts are often not certified for access to safety regulated industrial sites.
Tofino Security markets industrial network security and SCADA security products that protect industrial control systems from potential attack, even if they aren't patched, so it has a vested interest in talking up the problems of patching. However the overall picture of exposed and vulnerable industrial control systems is constant with findings from experts at Trend Micro and elsewhere.
A SCADA network ought to be segregated from a corporate intranet and air-gapped from the internet - or at least firewalled - but even rudimentary protections are often absent.
Sean McGurk, former head of cybersecurity for the US Department of Homeland Security turned managing principal for investigative response on Verizon’s RISK Team, told El Reg that attacks against the enterprise systems behind utilities are a bigger risk than Stuxnet-style attacks. The networks of both Saudi Aramco and Rasgas in Qatar were both hobbled by conventional malware attacks last year, for example. Both attacks were later linked [7] to the Shamoon data wiper.
Part of the problem is that industrial control systems have a far longer timeline than enterprise servers, computers and routers - typically up to 20 years instead of three to five years. And industrial control kit works with different ports and protocols than conventional enterprise networks, so simply adding a firewall or network segmentation is adequate as a defensive strategy. In addition, industrial control systems often have to work in real time, with low latency and high availability.
"Patching of legacy system is ongoing," McGurk said. "But patching is difficult for five-9s high-availability systems. Secure connectivity can be enhanced with layers of security but you can't gold-plate everything."
Despite the difficulties, McGurk suggested many in the sector are being slow to react to the security threat. The UK energy sector has been particularly slow to adopt security measures that match new technological developments, such as smart grids - potentially leaving them exposed to large-scale cyber-attacks as a result.
However he acknowledged that the technology was certainly not without its issues, such as potentially making it easier to disconnect the vulnerable or elderly, and no panacea.
"Introduce smart-grid technology is a double edged sword," McGurk explained. "Although you enhance interoperability, you can't just throw it in there.
"There's a greater security focus and it's not just about interoperability anymore," he concluded. McGurk said that government and industry need to work together to improve both the security and interoperability of the industrial control systems that monitor and manage power generation and distribution systems.
McGurk, who has more than 30 years of experience in ICS cybersecurity and critical infrastructure protection, traveled to London last week to speak at the European Smart Grid Cyber and SCADA Security Conference [8], a closed event restricted to industry participants and vendors. ®
Links
- http://blog.trendmicro.com/trendlabs-security-intelligence/whos-really-attacking-your-ics-devices
Folks: FREE & Easy mix of MetaSploit & Shodan search can do immense damage in anyone's hands.Panel largely misses this #CD13
— Joshua Corman (@joshcorman) March 18, 2013- http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-whos-really-attacking-your-ics-equipment.pdf
- http://www.bbc.co.uk/news/technology-20984827
- http://ics-cert.us-cert.gov/pdf/ICS-CERT_Monthly_Monitor_Oct-Dec2012.pdf
- http://www.tofinosecurity.com/article/belden-research-shows-patching-industrial-cyber-security-broken-model
- http://www.theregister.co.uk/2012/12/10/saudi_aramco_shamoon_inquest
- http://www.smi-online.co.uk/utility/uk/european-smart-grid-cyber-security
Related stories
- Cyberwar playbook says Stuxnet may have been 'armed attack' (27 March 2013)
- Finland a haven for vulnerable SCADA systems (22 March 2013)
- Ubuntu tapped by China for national operating system (22 March 2013)
- Viruses infect vital control systems at TWO US power stations (16 January 2013)
- Saudi Aramco: Foreign hackers tried to cork our gas output (10 December 2012)
- Power station, airport SCADA defences 'dead as a dodo' (27 November 2012)
- Exploit broker releases EXPLICIT VIDS of holes in industrial control kit (23 November 2012)
- World's power-grid cyber breach traced to notorious Chinese crew (28 September 2012)
- Insecure SCADA kit has hidden factory account, password (5 September 2012)
- Kaspersky claims ‘smoking code’ linking Stuxnet and Duqu (30 December 2011)
- SCADA vuln imperils critical infrastructure, feds warn (14 December 2011)
- Water utility hackers destroy pump, expert says (17 November 2011)
- Stuxnet clones may target critical US systems, DHS warns (27 July 2011)
YOUR Cisco VoIP phone is easily TAPPED, warns CompSci prof • The Register
Computer scientists claim security vulnerabilities in Cisco VoIP phones allowed them to eavesdrop on calls and turn devices into bugging equipment.
Ang Cui has demonstrated how malicious code injected into 14 of the networking vendor's Unified IP Phone models could be used to record private conversations - and not just those held over the compromised telephone itself: the malware can also pick up any sound within the vicinity when the handset is not in use. The discovered flaws effectively turn the network-connected phones into bugging devices.
Cisco VoIP phones are widely used in offices - small and large - across the world, creating a massive opportunity for potential mischief especially if the equipment is accessible from the public internet.
"It's not just Cisco phones that are at risk. All VoIP phones are particularly problematic since they are everywhere and reveal our private communications," said Professor Salvatore Stolfo of Columbia University who is supervising Cui's computer science PhD research.
"It's relatively easy to penetrate any corporate phone system, any government phone system, any home with Cisco VoIP phones — they are not secure."
The New York university pair found that the operating system kernel in the vulnerable phones was not correctly validating data supplied by applications, meaning it trusted software to act responsibly. An attack could be launched by logging into the device over SSH, although this requires a suitable username and password, or by plugging into the Aux port of the phone to gain local access. Once inside the phone, miscreants could abuse kernel system calls to run their own code or crash the gadget.
But Cisco played down the academics' work, and said an attacker would need to be able to physically plug a line into the phone to download the malware to the device. And SSH logins are typically disabled in office environments.
Cui and Prof Stolfo dedicated several months to probing the security of internet-protocol phones, and this is far from their first advisory on problems with the widely used technology. The boffins argue that Cisco has only addressed the reported bugs rather than tackle fundamental design flaws of the hardware giant's Unix-like phone operating system.
Cisco issued an advisory on the uncovered security issues last year. It followed this up with a further advisory on Wednesday, and another document providing more comprehensive and detailed mitigation advice.
"We issued a release note to customers at the end of last year (also crediting Mr Cui), but Wednesday's release of the advisory and mitigation bulletin provides more public information and the consolidated mitigation options," a Cisco spokesman explained.
Cui's makeshift tool to inject malware into Cisco phones
Credit: Columbia UniversityThe pair of academics reckon either a complete rewrite of the firmware or a new type of security defence technology is needed.
"Cisco’s recent advisory does not solve the problem unless and until they succeed in rewriting and releasing the rewritten kernel (promised in a few months) without harbouring any vulnerabilities," Prof Stolfo told El Reg.
"We really wish them luck. However, they can fix the immediate holes, but that does not protect the phone against other bugs the software might have. What they really need is independent security software running on the phone, just like what is available and provided by a mature security software industry for general-purpose computers."
In a separate statement, Cisco said it was continuing to investigate the reported flaws and working towards developing a more comprehensive fix. The networking giant said it has no evidence that the security shortcomings have actually been exploited. Cisco said the flaw would be hard to abuse and limited to Cisco 7900 series IP office phones:
Our engineering teams are actively working on a permanent fix, and we have released very detailed, step-by-step customer guides on identifying and preventing this vulnerability from being exploited. We are not aware of this vulnerability being used against any of our customers. We encourage customers with related questions to contact the Cisco TAC, or read the Security Advisory and Applied Mitigation Bulletin posted at www.cisco.com/go/psirt.Cisco works closely with the IT security community and we view this as vital to helping protect our customers' networks. We thank Cui and Salvatore Stolfo for reporting this vulnerability to Cisco.
The vulnerability affects some of Cisco 7900 series IP office phones. In addition to specialist technical skills, a successful exploitation requires physical access to the phone's serial port or the combination of authenticated remote access and non-default network settings. No default account exists for remote authentication and devices configured for remote access must use administrator-configured credentials.
Killing the spy who bugged me
Cui and Prof Stolfo found the exploitable security weaknesses after analysing the firmware binaries of VoIP phones. The research was part of an attempt to develop security technologies for embedded systems, such as network-connected phones, routers and printers. They christened this prototype technology Software Symbiotes.
"This is a host-based defence mechanism that's a code structure inspired by a natural phenomenon known as symbiotic defensive mutualism," explained Cui. "The Symbiote is especially suitable for retrofitting legacy embedded systems with sophisticated host-based defences."
The Symbiote runs on the embedded hardware and monitors its host's behaviour to ensure the device behaves itself and operates as expected. If not, the Symbiote stops the host from doing any harm. Removal, or attempted removal, of the Symbiote renders the device inoperable - a factor that could create a means for launching denial-of-service attacks against equipment but this has not blunted the enthusiasm of the computer scientists.
Cui said the Symbiote system could be used to protect all kinds of embedded systems, from phones and printers to ATM machines and even cars. The Symbiote design reads a bit like a science-fiction plot element* so it's no surprise that the computer scientists' research was partially funded by war tech boffins at DARPA - the US military's Defense Advanced Research Projects Agency. IARPA (Intelligence Advanced Research Projects Activity) and the Department of Homeland Security also bankrolled the research.
Cui and Prof Stolfo plan to demonstrate a Symbiote-protected Cisco IP Phone at the RSA conference in San Francisco in February. ®
* Hopefully unrelated to the character Venom from the Spiderman universe.
Federal judge in Boston sentences hacker to three years in prison - Boston.com
An Oregon man who helped people steal Internet access was sentenced on Wednesday to three years in prison by a federal judge in Boston, as authorities step up a crackdown nationwide on computer fraud.
“I think you committed a very serious crime,” US District Judge Mark L. Wolf told Ryan Harris, 28, in federal court in Boston. Wolf said he hopes other hackers get the message that cybercrime has consequences, after the prosecution by the US attorney’s office in Boston.
Harris earned between $400,000 and $1 million over several years from the sale of products that allowed users to pirate Internet access from cable companies by cloning modem addresses, authorities said. He also wrote a how-to book on the topic.
“Mr. Harris acted with absolute, knowing malice,” said prosecutor Mona Sedky during the hearing. “He had a desire to punish the cable companies ... and he was motivated by greed.”
Harris’s lawyer, federal public defender Charles P. McGinty, countered that while his client was misguided, he was primarily motivated by anger that corporations could control the speed and quality of consumers’ Internet access.
“He acted on a grievance, as a lot of young people do,” McGinty said.
Martin Weinberg, a prominent Boston attorney who represents another man charged in a hacking case pending in the same court, said the US Department of Justice’s push to prosecute such cases has come in conflict with the growth of emerging digital technology.
He said lawyers are seeing “the application of the criminal justice system to technology and computer and Internet issues that either were not existent or primitive at the time the fraud statutes were enacted.”
“There’s been an explosion of cases nationwide under the computer theft statute,” Weinberg said.
Wolf said Wednesday that the wire fraud statute used to convict Harris has been utilized for decades to prosecute similar crimes related to telephone service and cable television.
According to an indictment, Harris lived in California and Hong Kong while operating his scheme and was the founder and president of TCNISO Inc., a San Diego-based company whose primary business was to sell cable modem hacking software and hardware products.
Some of Harris’s customers, who were not charged, lived in Worcester, Everett, Revere, and Mattapan, authorities said.
Harris and others developed hacking products that had names including Sigma, Blackcat, and DreamOS, which allowed computer users to gain access to the Internet without paying for it, according to prosecutors.
To access Internet service, Harris, who went by the moniker DerEngel, would modify, or uncap, a modem to remove the filters set up by the Internet service provider, allowing the modem to have a quicker Internet connection without the Internet service provider being able to throttle it.
Harris would also clone other people’s modem addresses, or identification codes that Internet providers use to confirm that a user is a paid subscriber. He was convicted of several counts related to the scheme in March.
Weinberg said Wednesday that courts have recently been divided over whether federal fraud laws should be so broadly applied to improper use of technology of the Internet.
Just months ago, he said, the Ninth US Circuit Court of Appeals in California ordered the reduction of a sentence of a man convicted of breaching his employe’s computer access, after finding there was no criminal intent.
On Wednesday, Laurie Jill Wood, director of security for the St. Louis-based Charter Communications, one of the companies affected by Harris’s scheme, said engineers spent years trying to combat the software sold by Harris, and at times kicked legitimate subscribers off the network as a result.
She said the company also at times was unable to identify for law enforcement the subscribers who were suspected of unrelated computer crimes, because so many of the modems were cloned.
“This happened many, many times and it made me sick,” Wood said.
McGinty argued on Wednesday and in a prior court filing that representatives of the targeted companies did not appear to be overly concerned about Harris’s conduct in emails.
Harris, who wore a gray suit and glasses, told Wolf in brief, halting remarks that he is currently working at a legitimate job in the computer industry in Oregon and that he wants to continue his career.
“I was scared [after conviction],” Harris said. “I’m still scared now.”
Wolf ordered Harris to report to prison on Sept. 4, unless the First US Circuit Court of Appeals orders a stay of the sentence pending appeal. He also ordered Harris to pay about $200,000 in fines and restitution, and to serve three years of supervised release.
Weinberg said Wednesday that federal courts will continue to wrestle with questions of cyber law.
“You’re at the dawn of a technology age,” he said. “The federal courts are at the epicenter of trying to apply crime to technology they didn’t foresee, but which is crying out for legal decisions.”
Travis Andersen can be reached at tandersen@globe.com. Follow him on Twitter @TAGlobe. Milton J. Valencia can be reached at mvalencia@globe.com. Follow him on Twitter @Follow him on Twitter @MiltonValencia.
Cable Modem Hacker Gets 3 Years in Prison - Ryan Harris, AKA DerEngel Heads to Jail | DSLReports.com, ISP Information
Cable Modem Hacker Gets 3 Years in PrisonRyan Harris, AKA DerEngel Heads to JailAccording to the Boston Globe, an Oregon man this week was sentenced by a Boston Judge to three years in prison for selling hacking tips and tools that allowed users to pirate cable broadband services. According to the lawsuit, twenty-eight-year-old Ryan Harris (aka DerEngel) made between $400,000 and $1 million over several years via a website dedicated to broadband cable modem hacking, where he sold tools like Sigma, Blackcat, and DreamOS. Harris also wrote a book dedicated to exploring how to hack cable modems which we sort of reviewed many years back. Harris has been facing criminal charges since around 2009.