Attacks/Breaches
2/15/2013
12:42 PM
50%
50%

Zombie Hackers Exploited Emergency Alert System Security Flaws

FCC has known about security gaps in networked alert systems equipment for more than 10 years. What if next hoax is serious?

"It's been known for a while that the Emergency Broadcasting System was set up without security," digital forensics consultant Jonathan Grier said via email. "The threat the U.S. had in mind was WWIII, not stateside hackers."

According to Venable's Barnett, the emergency alert devices "were developed over the last few decades, and while they're part of a network, it was before packet-switched and Internet concepts were even prevalent in our society, so some of the connections to other networks are now, you could say, bolted on."

Security researchers first discovered vulnerabilities in the EAS in 2002. In 2004, meanwhile, the FCC confirmed that "security and encryption were not the primary design criteria when EAS was developed and initially implemented," The Register reported.

"Now, however, emergency managers are becoming more aware of potential vulnerabilities within the system," said the FCC in 2004. "For example, the complete EAS protocol is a matter of public record and potentially subject to malicious activations or interference."

Given that 10 years have elapsed without a proper fix, arguably the FCC doesn't see EAS insecurities as representing a grave threat. "The response from the government was they didn't view this as a major concern: people instinctively cross-validate shocking news, so if one TV station reports, for example, a need for an emergency evacuation, it's unlikely to cause a panic -- people will cross-validate this before taking action," Grier said. "But it does make you think of Orson Welles."

Now, however, a stronger government response will be likely. "You can watch the Federal Communications Commission and FEMA to see what comes out," Barnett said. "I'm willing to bet that they'll have an investigation and report into this." He also recommended that the alerting industry rethink its approach to security. "They need to look at coming together and codifying some best practices to make sure that these types of things don't happen," he said.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MyW0r1d
50%
50%
MyW0r1d,
User Rank: Apprentice
2/19/2013 | 9:34:29 PM
re: Zombie Hackers Exploited Emergency Alert System Security Flaws
Thank goodness they were good hearted, albeit bored hooligans that meant no real harm. Imagine the panic if they had presented a more credible story to be transmitted? Or instead of the SuperBowl, the next power outage may be caused by a hack (or fully functioning "smart" control software) shutting down the circuit of the grid controlling Wall Street or the Chicago Merc ?
kjhiggins
50%
50%
kjhiggins,
User Rank: Strategist
2/15/2013 | 9:33:33 PM
re: Zombie Hackers Exploited Emergency Alert System Security Flaws
It sounds like the pranksters basically provided a handy proof-of-concept that could help pressure some security fixes for the technology. All I could think of when I first heard this story was Orson Welles and the confusion over his "War of the Worlds" reading on the radio.

Kelly Jackson Higgins, Senior Editor, Dark Reading
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.