Feeds

Emergency alert system easily pwnable after epic ZOMBIE attack prank

Private crypto keys found in firmware - where were their BRRAAAIINNNS?

Top three mobile application threats

Hardware powering the US Emergency Alert System can be easily tricked into broadcasting bogus apocalyptic warnings from afar, say experts.

Researchers at computer security biz IOActive reckon they found private encryption keys within firmware updates for the devices; miscreants armed with this information could successfully remotely log into the hardware, installed at television and radio stations around the US, as an administrator and broadcast panic-inducing messages to the masses.

And the discovery comes just months after shortcomings in the Emergency Alert System (EAS) were exploited to beam news of a zombie apocalypse to American TVs: Montana Television Network’s regular programming was interrupted by warnings of the end of the world back in February.

Viewers of KRTV in Great Falls, Montana, were confronted by an on-air audio warning that "bodies of the dead are rising from their graves and attacking the living". A scrolling text warning at the top of the screen naming various Montana counties as targets for the spoof announcement of doom, which sparked calls to the state's cops. KRTV promptly disavowed the fake alert and the whole incident thankfully died down before local survivalist types got too excited.

The perpetrators behind the epic undead prank remain unknown. Initial investigations suggested that weak default passwords on emergency alert systems accessible over the internet may have been used to pull off the hack. This remains unconfirmed.

Private SSH keys discovered

But now researchers at IOActive have found that systems used to receive and authenticate emergency alert messages are vulnerable to remote attack. The vulnerability is specific to Linux-powered application servers from two manufacturers, according to the US feds: the Digital Alert Systems DASDEC-I and DASDEC-II gear, and the Monroe Electronics R189 One-Net and R189SE products, apparently all shipped with publicly downloadable firmware that contains private root SSH keys, a recent alert by the US Cyber Emergency Response Team (CERT) warns.

“These DASDEC application servers are currently shipped with their root privileged SSH key as part of the firmware update package," explained Mike Davis, principal research scientist for IOActive.

"This key allows an attacker to remotely log on in over the internet and can manipulate any system function. For example, they could disrupt a station’s ability to transmit and could disseminate false emergency information. For any of these issues to be resolved, we believe that re-engineering needs to be done on the digital alerting system side and firmware updates to be pushed to all appliances.”

The EAS is designed to enable to the President of the United States to speak to US citizens within 10 minutes of a major disaster occurring. In the past these alerts were passed from station to station using the Associate Press (AP) or United Press International (UPI) “wire services” which connected to television and radio stations around the US. Whenever the station received an authenticated Emergency Action Notification (EAN), the station would disrupt its current broadcast to deliver the message to the public.

More recently the system has been switched to a more automated and decentralised system. Once a station receives and authenticates the message, the DASDEC hardware interrupts transmission and overlays the message onto the broadcast with the alert tone containing information about the disaster. The DASDEC application server receives and authenticates EAS messages so security shortcomings with the technology are a serious concern.

IOActive has also issued its own IOActive Labs advisory [PDF] outlining the apparently affected products, the impact and how to mitigate the problem. According to the US CERT, a fixed version of the firmware is available that allows users to change their login keys, and should be applied to critical devices. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.