Feeds

Emergency alert system easily pwnable after epic ZOMBIE attack prank

Private crypto keys found in firmware - where were their BRRAAAIINNNS?

Protecting against web application threats using SSL

Hardware powering the US Emergency Alert System can be easily tricked into broadcasting bogus apocalyptic warnings from afar, say experts.

Researchers at computer security biz IOActive reckon they found private encryption keys within firmware updates for the devices; miscreants armed with this information could successfully remotely log into the hardware, installed at television and radio stations around the US, as an administrator and broadcast panic-inducing messages to the masses.

And the discovery comes just months after shortcomings in the Emergency Alert System (EAS) were exploited to beam news of a zombie apocalypse to American TVs: Montana Television Network’s regular programming was interrupted by warnings of the end of the world back in February.

Viewers of KRTV in Great Falls, Montana, were confronted by an on-air audio warning that "bodies of the dead are rising from their graves and attacking the living". A scrolling text warning at the top of the screen naming various Montana counties as targets for the spoof announcement of doom, which sparked calls to the state's cops. KRTV promptly disavowed the fake alert and the whole incident thankfully died down before local survivalist types got too excited.

The perpetrators behind the epic undead prank remain unknown. Initial investigations suggested that weak default passwords on emergency alert systems accessible over the internet may have been used to pull off the hack. This remains unconfirmed.

Private SSH keys discovered

But now researchers at IOActive have found that systems used to receive and authenticate emergency alert messages are vulnerable to remote attack. The vulnerability is specific to Linux-powered application servers from two manufacturers, according to the US feds: the Digital Alert Systems DASDEC-I and DASDEC-II gear, and the Monroe Electronics R189 One-Net and R189SE products, apparently all shipped with publicly downloadable firmware that contains private root SSH keys, a recent alert by the US Cyber Emergency Response Team (CERT) warns.

“These DASDEC application servers are currently shipped with their root privileged SSH key as part of the firmware update package," explained Mike Davis, principal research scientist for IOActive.

"This key allows an attacker to remotely log on in over the internet and can manipulate any system function. For example, they could disrupt a station’s ability to transmit and could disseminate false emergency information. For any of these issues to be resolved, we believe that re-engineering needs to be done on the digital alerting system side and firmware updates to be pushed to all appliances.”

The EAS is designed to enable to the President of the United States to speak to US citizens within 10 minutes of a major disaster occurring. In the past these alerts were passed from station to station using the Associate Press (AP) or United Press International (UPI) “wire services” which connected to television and radio stations around the US. Whenever the station received an authenticated Emergency Action Notification (EAN), the station would disrupt its current broadcast to deliver the message to the public.

More recently the system has been switched to a more automated and decentralised system. Once a station receives and authenticates the message, the DASDEC hardware interrupts transmission and overlays the message onto the broadcast with the alert tone containing information about the disaster. The DASDEC application server receives and authenticates EAS messages so security shortcomings with the technology are a serious concern.

IOActive has also issued its own IOActive Labs advisory [PDF] outlining the apparently affected products, the impact and how to mitigate the problem. According to the US CERT, a fixed version of the firmware is available that allows users to change their login keys, and should be applied to critical devices. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.