Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT

'SirenJack' Vulnerability Lets Hackers Hijack Emergency Warning System

Unencrypted radio protocol that controls sirens left alert system at risk.

The sound of an emergency alert siren can be a nightmare soundtrack to the millions who live in areas subject to hurricanes, tornados, earthquakes, or other natural disasters. A recently disclosed vulnerability in the emergency warning system used by San Francisco and other municipalities could allow a threat actor to take control of the system, sound false alarms, or block legitimate warnings.

While the vendor - ATI - says it has now patched the so-called SirenJack vulnerability, an unencrypted protocol, the process of its discovery could have implications for other locations.

Balint Seeber, a researcher with Bastille, began researching San Francisco's warning siren system shortly after moving to the city in 2016. Noticing poles with sirens attached scattered throughout the city, and noting that the hardware for the sirens included radio antennae, Seeber was curious about the system's security.

After realizing that there was a system test every Tuesday, Seeber first began looking for the system's radio frequency. "I started every week, capturing and analyzing large chunks of the radio spectrum with a view to trying to find this one unknown signal amongst hundreds, maybe thousands, of signals across the spectrum and that took some time," he says.

Seeber was surprised to find that the frequency used by the system is not one normally associated with public service or public infrastructure control. It is, instead, one that is close to those used by radio amateurs.

"I've demonstrated that even a $30 to $35 handheld radio you can buy from Amazon that is used by radio hobbyists — like a more enhanced walkie-talkie — is perfectly capable of perpetuating an attack when combined with a laptop," he says.

Once the frequency was known he began looking at the transmission itself and he soon found that the control signals were being sent with no encryption at all. That meant that anyone willing to put in the sort of effort he had made could analyze and hijack control of the system. Seeber then traveled to Sedgwick County, Kansas, where a similar system was in use, to see if the vulnerability also existed there. "The findings were consistent there and I did see the same pattern. And so I was able to confirm that their system was also vulnerable," he says.

While each system is customized to a great extent, Seeber says that an attacker could use their knowledge of the protocol to turn pre-programmed alerts on or off. In addition, he says that the system has a direct public-address mode, so it is possible that an attacker could use the infrastructure to broadcast an illicit message to the public over these public speakers.

At that point, Seeber and Bastille notified ATI, the system's vendor, of the SirenJack vuln. Seeber is eager to point out that the notification was in line with ethical analyst behavior. "We conducted this process with responsible disclosure," he says, adding, "That means that we write our findings up and and disclose it privately to the vendor, which we did in early January. Then we provide 90 days during which they're able to take those findings and prepare any remediation steps."

In a statement, ATI's CEO, Dr. Ray Bassiouni, said, "ATI is fully supportive of all of our clients and will be on standby if anyone is concerned about hacking or vulnerabilities in their system."

Seeber says that while Bastille was not asked to test the patch ATI provided to San Francisco, he has seen work on the pole-based components and has noticed random traffic within the signals, traffic that indicates at least some level of encryption is now in place.

"We don't want the public to lose confidence in the system and the government's ability to handle emergencies," Seeber says. He encourages more government agencies to test their emergency notification systems to avoid surprises in the future.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for an intensive Security Pro Summit at Interop IT X and learn from the industry’s most knowledgeable IT security experts. Check out the agenda here.Register with Promo Code DR200 and save $200.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8818
PUBLISHED: 2020-02-25
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore...
CVE-2020-8819
PUBLISHED: 2020-02-25
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass ...
CVE-2020-9385
PUBLISHED: 2020-02-25
A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upcean.c, when called from eanx in upcean.c during EAN barcode generation.
CVE-2020-9382
PUBLISHED: 2020-02-24
An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget (as defined by this extension) via MediaWiki's } parser function.
CVE-2020-1938
PUBLISHED: 2020-02-24
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that ...