Idaho Prisoners Hack Prison Issue Tablets And Give Themselves $225,000 In Credits 

One inmate transferred almost $10,000 to their JPay account. 

News has emerged that hundreds of Idaho inmates across five prisons in the US state of Idaho managed to easily exploit a vulnerability in their personal prison issue tablets and then credit themselves with themselves thousands of dollars of prison currency.  

If only it was as simple to exploit Amazon

The prisoners then used the extra credits to which they were not entitled under prison regulations to download music, games and gain use of email, prison officials said last week. 

According to the Idaho Department of Corrections, 364 prisoners were able to use their JPay tablets to boost their account balances and steal almost $225,000 worth of credits. 

According to The Associated Press, the department unearthed the issue earlier this month, and have also said that the taxpayer was not affected. 

Like the Google Play Store but not quite  

JPay is a service provided to inmates that gives them mini I-pad like devices that have a limited number of regulated and pre-approved apps that can be accessed by a credit system. Inmates themselves cannot buy the devices and they must be bought (legally) from someone on the outside. As well as games and emails, JPay lets inmates talk to their loved ones on the outside through a Skype style video chat visitation. All communication on the devices is monitored and talk-time is limited, just like a real one-to-one visitation is. 

Jeffrey Ray, a spokesman with the Idaho Department of Corrections, said in a statement that the “conduct was intentional, not accidental. It required a knowledge of the JPay system and multiple actions by every inmate who exploited the system’s vulnerability to improperly credit their account.”   

The technique for the hack was apparently spread by word of mouth through the Idaho prison system.  

Were Russian or North Korean hackers involved? 

No. There was no need for them. 

The process for exploiting the JPay system was remarkably simple. Inmates were able to raise their JPay credits by adding items to their digital shopping carts and then remove them following a certain number of steps. No actual hacking was involved. 

Fifty of the inmates who took part in the JPay scheme allocate themselves $1000 in credits, and one inmate was caught with nearly $10,000 on his account.  

Crime & Punishment 

Unsurprisingly, the inmates who were allegedly involved have been disciplined, may lose privileges, and their actions may affect parole hearings, and ultimately the length of their sentence.   

The company that runs the JPay service had at the time of writing reclaimed more than $65,000 of the hacked credits and also blocked involved inmates from downloading any new music or games.