The Internet of Things’ “security through obscurity” has been proven once again to not be terribly secure thanks to an angry and possibly inebriated ex-employee. Adam Flanagan, a former radio frequency engineer for a company that manufactures remote meter reading equipment for utilities, was convicted on June 15 in Philadelphia after pleading guilty to two counts of “unauthorized access to a protected computer and thereby recklessly causing damage.” Flanagan admitted that after being fired by his employer, he used information about systems he had worked on to disable meter reading equipment at several water utilities. In at least one case, Flanagan also changed the default password to an obscenity.
Flanagan’s employer was not named in court documents. According to a plea agreement filing, Flanagan worked on a team that installed tower gateway base stations (TGBs)—communications hubs mounted on poles distributed across a utility’s service area to communicate with smart meters. His work was apparently not up to his former employer’s standards, however.
Over the next few months, TGBs that Flanagan’s employer had installed for a number of municipal water departments “developed problems,” the Justice Department’s sentencing memo stated. In December of 2013, employees of the water authority in Kennebec, Maine, found they couldn’t connect to the utility’s TGBs. This was a system Flanagan had installed, but the problems could not be directly attributed to him because the logs for the system weren’t checked until February of 2014. By then, data from December had already been purged.
But the TGBs in Kennebec were hit again on March 1 when “an entry was made to the Kennebec TGB by entering the default root password.” The intruder changed the radio frequencies on the TGB so that it couldn’t communicate with the utility’s Remote Network Interface (RNI). And, as it so happens, the login came from an Internet Protocol (IP) address on the Clearwire wireless broadband network (now part of Sprint)—an address that resolved to a cell tower “about 1 mile from Flanagan’s residence,” the FBI determined. Another login from the same IP address occurred on April 30, once again disabling the TGB’s radio communications. In another intrusion on May 24, 2014—gaining access to a system Flanagan had worked on in Spotswood, New Jersey—the intruder again, from the same IP address, used the default root password to log in. “The intruder changed the password to ‘fuckyou,'” the Justice Department stated in the plea agreement memo.
The original indictment of Flanagan totaled nine counts, including incidents with three other water authorities in Aliquippa and New Kensington, Pennsylvania; and Egg Harbor City, New Jersey. All but the two counts of unauthorized access for the Kennebec and Spotswood intrusions were dropped as part of the plea agreement, but Flanagan was linked to them by his IP address. Some intrusions were evidently more unusual than others:
On April 3, 22, 24, and 28, 2014, there were multiple intrusions into one of the Aliquippa WaterAuthority’s TGBs. All the intrusions were made from [the IP address linked to Flanagan’s Clearwire cellular modem]. On one of the intrusions on April 22, the intruder changed the radio frequency for communications. He also changed the code for a computer script to the lyrics of a Pink Floyd song.
Flanagan admitted to FBI agents that he had used a “proprietary program” (which was actually Telnet) to log in to the TGBs from home. He was angry with his former supervisor and, after “coming home drinking, after a few beers,” he decided it was a good idea to begin “loggin’ in saying these mother fuckers.” The software for all this access was still on Flanagan’s home computer after he was terminated. “It was always there…so I had…It was on my computer so when they let me go,” he told the agents. “It was still there.” As court documents show:
FBI Agent 1: That’s very different than you being this master hacker who is trying to take down…
Flanagan: I am not at all a master hacker.
FBI Agent 1: But that’s why we are here because you look on paper and here’s somebody who’s…
FBI Agent 2: You have skills…
FBI Agent 1: Methodically logging in…
Flanagan: Not really. No I don’t…
FBI Agent 2: On paper you do.
Flanagan: That’s not. That’s absolutely not true.
FBI Agent 2: So. Alright.
Flanagan: I’m an RF guy, I know rudimentary ah logon. A couple of VI scripts. I knew the entrance screen was to do a VI. You know you can do a VI and it gave you a welcome message. So a couple of times I changed the root welcome message to say, “Ha. Ha.”
FBI Agent 2: Like obscenities or something.
Flanagan: I don’t know. I don’t think so. I don’t know…maybe. Um. ASCII pictures. Just a couple of ASCII pictures. Um.
FBI Agent 2: Okay. Just, like to deface it. Fuck with them.
Flanagan: Pretty much. Yeah.
FBI Agent 2: Alright, Um.
Flanagan: Like I say. I am honestly at fault but yeah it was nothing to be, I don’t want to say it wasn’t being malicious but it wasn’t anything to, you know, take down a network like that.
Flanagan was sentenced to 12 months plus one day of imprisonment (minus time already served), three years of supervised release, and a fine of $40,000. He could have faced a sentence of up to 90 years.