Risk

5/7/2009
05:09 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Air Traffic Control System Repeatedly Hacked

A security audit finds a total of 763 high-risk, 504 medium-risk, and 2,590 low-risk vulnerabilities, such as weak passwords and unprotected folders.

In the past four years, hackers have hobbled air traffic control systems in Alaska, seized control of Federal Aviation Administration network servers, and pilfered personal information from 48,000 current and former FAA employees, according to a newly released government report.

The report, "Review of Web Applications Security and Intrusion Detection in Air Traffic Control Systems," was published Wednesday by the Department of Transportation Office of the Inspector General.

It comes on the heels of a report last month in the Wall Street Journal that the Air Force's air traffic control system had been breached by hackers and amid congressional hearings featuring military and civilian officials testifying about the sorry state of U.S. cybersecurity.

The Transportation Department report states that auditors from KPMG and the Office of the Inspector General tested 70 Web applications, 35 used by the FAA to disseminate information over the Internet and 35 used internally to support air traffic control systems. The security audit found a total of 763 high-risk, 504 medium-risk, and 2,590 low-risk vulnerabilities, such as weak passwords and unprotected folders.

Beyond the issue of poorly configured, buggy Web applications, the report also found that the air traffic control systems are woefully unprotected by intrusion-detection systems. Only 11% of air traffic control facilities have IDS sensors, the report states, and none of those IDS sensors monitors air traffic control operational systems; instead, they monitor mission-support systems, such as e-mail servers.

In 2008, more than 800 cyberincident alerts were issued to the Air Traffic Organization, which oversees air traffic control operations. At the end of that year, 17% of those incidents (150), some designated critical, had not been addressed.

"Without fully deploying IDS monitoring capability at [air traffic control] facilities and timely remediation against cyberincidents, FAA cannot take effective action to stop or prevent these cyberattacks, thus increasing the risk of further attacks on ATC systems," the report said.

The report states that most of the attacks have disrupted FAA air traffic control support operations rather than the operational network that keeps planes separated from one another. However, it also states that unless swift action is taken, dangerous operational problems are only a matter of time.

It's also a matter of money, which could be easier to obtain under a cloud of imminent danger: The FAA has been pushing its Next Generation Air Transportation System, a project to update the nation's air transit infrastructure that's expected to cost at least $20 billion.

With any luck, that amount of funding will also buy a few scarecrows. There were almost 10 times as many wildlife strikes against airplanes in 2007 (7,666) as air traffic control cyberincidents in 2008. Such collisions -- recall the bird strike that sent US Airways Flight 1549 into the Hudson River in January -- cost an estimated $628 million in monetary losses annually, to say nothing of the potential loss of life. Hackers just don't have that kind of impact, unless they wander onto a runway.


InformationWeek Analytics has published an independent analysis on government IT priorities. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Mozilla, Internet Society and Others Pressure Retailers to Demand Secure IoT Products
Curtis Franklin Jr., Senior Editor at Dark Reading,  2/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3812
PUBLISHED: 2019-02-19
QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.
CVE-2019-8933
PUBLISHED: 2019-02-19
In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on ...
CVE-2019-7629
PUBLISHED: 2019-02-18
Stack-based buffer overflow in the strip_vt102_codes function in TinTin++ 2.01.6 and WinTin++ 2.01.6 allows remote attackers to execute arbitrary code by sending a long message to the client.
CVE-2019-8919
PUBLISHED: 2019-02-18
The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2019-8917
PUBLISHED: 2019-02-18
SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may b...