Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
FAA's New Flight Control System Has Security Holes: Researcher
Newest First  |  Oldest First  |  Threaded View
Embedded SW Dev
50%
50%
Embedded SW Dev,
User Rank: Apprentice
7/27/2012 | 6:56:52 PM
re: FAA's New Flight Control System Has Security Holes: Researcher
Tracking airplanes from city to city is something which is relatively easy to do now, as private airplanes use their registration numbers with air traffic control, and there are internet sites continuously recording/monitoring air traffic control conversations in real time. Tracking them in-flight can be made more difficult by requesting the FAA block flight tracking because of a security concern, which prevents operations like flightaware from displaying those tail numbers in real-time. The most effective way of preventing traffic is to fly VFR from airports without towers. This hole just prevents the FAA flight tracking block from being effective.

I agree that the other problems need to be addressed, as I really don't want to be flying when the FAA experiences a Denial of Service attack.
PJS880
50%
50%
PJS880,
User Rank: Ninja
7/26/2012 | 7:43:18 PM
re: FAA's New Flight Control System Has Security Holes: Researcher
IGm so very thankful that there is demonstration where they show what exactly the vulnerabilities are in particular systems. FAAGs new flight system, very important system that should have no vulnerabilities what so ever! Being able to simulate planes that are not there and non-encrypted messages regarding flight information, are not vulnerabilities that make me feel safe at all! It doesnGt matter that there is no recorded attacks on this new system, if there is vulnerabilities then there will eventually be an attack if these are not taken care of and eliminated. In addition to all this, these threats are not new, and refused to identify other risks? Does anybody else feel like splitting gas money with me on the next tripGǪroad trip!

Paul Sprague
InformationWeek Contributor


COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Exploiting Google Cloud Platform With Ease
Dark Reading Staff 8/6/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8720
PUBLISHED: 2020-08-13
Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable denial of service via local access.
CVE-2020-12300
PUBLISHED: 2020-08-13
Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-12301
PUBLISHED: 2020-08-13
Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-7307
PUBLISHED: 2020-08-13
Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log files containing plain text credentials.
CVE-2020-8679
PUBLISHED: 2020-08-13
Out-of-bounds write in Kernel Mode Driver for some Intel(R) Graphics Drivers before version 26.20.100.7755 may allow an authenticated user to potentially enable denial of service via local access.