05:09 PM
Connect Directly

Air Traffic Control System Repeatedly Hacked

A security audit finds a total of 763 high-risk, 504 medium-risk, and 2,590 low-risk vulnerabilities, such as weak passwords and unprotected folders.

In the past four years, hackers have hobbled air traffic control systems in Alaska, seized control of Federal Aviation Administration network servers, and pilfered personal information from 48,000 current and former FAA employees, according to a newly released government report.

The report, "Review of Web Applications Security and Intrusion Detection in Air Traffic Control Systems," was published Wednesday by the Department of Transportation Office of the Inspector General.

It comes on the heels of a report last month in the Wall Street Journal that the Air Force's air traffic control system had been breached by hackers and amid congressional hearings featuring military and civilian officials testifying about the sorry state of U.S. cybersecurity.

The Transportation Department report states that auditors from KPMG and the Office of the Inspector General tested 70 Web applications, 35 used by the FAA to disseminate information over the Internet and 35 used internally to support air traffic control systems. The security audit found a total of 763 high-risk, 504 medium-risk, and 2,590 low-risk vulnerabilities, such as weak passwords and unprotected folders.

Beyond the issue of poorly configured, buggy Web applications, the report also found that the air traffic control systems are woefully unprotected by intrusion-detection systems. Only 11% of air traffic control facilities have IDS sensors, the report states, and none of those IDS sensors monitors air traffic control operational systems; instead, they monitor mission-support systems, such as e-mail servers.

In 2008, more than 800 cyberincident alerts were issued to the Air Traffic Organization, which oversees air traffic control operations. At the end of that year, 17% of those incidents (150), some designated critical, had not been addressed.

"Without fully deploying IDS monitoring capability at [air traffic control] facilities and timely remediation against cyberincidents, FAA cannot take effective action to stop or prevent these cyberattacks, thus increasing the risk of further attacks on ATC systems," the report said.

The report states that most of the attacks have disrupted FAA air traffic control support operations rather than the operational network that keeps planes separated from one another. However, it also states that unless swift action is taken, dangerous operational problems are only a matter of time.

It's also a matter of money, which could be easier to obtain under a cloud of imminent danger: The FAA has been pushing its Next Generation Air Transportation System, a project to update the nation's air transit infrastructure that's expected to cost at least $20 billion.

With any luck, that amount of funding will also buy a few scarecrows. There were almost 10 times as many wildlife strikes against airplanes in 2007 (7,666) as air traffic control cyberincidents in 2008. Such collisions -- recall the bird strike that sent US Airways Flight 1549 into the Hudson River in January -- cost an estimated $628 million in monetary losses annually, to say nothing of the potential loss of life. Hackers just don't have that kind of impact, unless they wander onto a runway.

InformationWeek Analytics has published an independent analysis on government IT priorities. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.