Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
APC Free White Paper
Optimize your network investment &
Enter to win a Samsung Galaxy Note

www.apc.com
Cybercrime
Tame your scariest paperwork. Find Out How
Average Rating:
Rate this article:  
'Zombie' Alert Shows Emergency Broadcasts Can Be Hacked

By Barry Levine
July 9, 2013 1:15PM

    Bookmark and Share
Seattle security firm IOActive said it has uncovered vulnerabilities in the digital alerting application servers, or DASDEC, which receive and authenticate Emergency Alerting System messages. When a message has been received and authenticated, DASDEC interrupts a TV or radio broadcast with the well-known alert tone and the message.
 



A recent zombie apocalypse showed the vulnerability of the United States' emergency broadcasting system. In February, hackers interrupted Montana TV with reports of a zombie apocalypse, using the Emergency Alerting System (EAS), and this week a security firm, citing the zombie attack, has recommended that the system be re-engineered.

Seattle-based IOActive has said that the zombie news bulletin showed the system's weaknesses. IOActive principal research scientist Mike Davis told news media that, "although there was no zombie apocalypse, it did highlight just how vulnerable the system is."

The zombie bulletin also played on a Michigan radio station, and it said that civil authorities "have reported that the bodies of the dead are rising from their graves and attacking the living." It added the suggestion that witnesses not "attempt to approach or apprehend these bodies as they are considered extremely dangerous."

10 Minutes to POTUS

IOActive said it has uncovered vulnerabilities in the digital alerting application servers, or DASDEC, which receive and authenticate EAS messages. When a message has been received and authenticated, DASDEC interrupts a broadcast with the well-known alert tone and the message.

Davis said in a statement that DASDEC application servers "are currently shipped with their root privileged SSH key as part of the firmware update package." The key enables a remote logon, and can let the holder manipulate any system function, including disrupting a station's transmission.

Among other functions, the EAS is intended to allow the President of the United States to speak to the country's citizens in as little as 10 minutes from when a disaster or other event occurs. The Federal Emergency Management Agency (FEMA) oversees the EAS.

'Potential Security Vulnerability'

The DASDEC systems are made by Monroe Electronics in New York, which released in April a software update that it said resolved the "potential security vulnerability" and improved several operational features. The changes included removal of default SSH keys and a simplification of the process to load new SSH keys.

The U.S. Department of Homeland Security (DHS) reported last week that, while IOActive has reported "that the administrative web server uses a predictable, monotonically increasing session ID," based on running the web server in a test environment, Monroe Electronics "could not reproduce this finding" in the factory or in the field. It is not currently clear if the vulnerabilities reported by IOActive have been resolved.

The first nationwide test of the EAS was conducted by the Federal Communications Commission and FEMA at 2pm ET on November 9, 2011, when a 30-second test interruption with sample messaging broke into most TV and radio broadcasts in the country. While EAS has been tested and used on previous occasions, this was its first transmission nationwide, and a key goal was to find any glitches. In that sense, it was successful, in that it turned out some stations didn't air the test and some interruptions exceeded 30 seconds.

Editorial note: Please see additional information in the Comments section below, provided by Monroe Electronics about security updates they have provided to resolve potential vulnerability of the system.
 

Tell Us What You Think
Comment:

Name:

Editor:

Posted: 2013-07-25 @ 9:22am PT
Thank you Ed Czarnecki. We appreciate the additional information and clarifications provided below for our readers about Monroe Electronic's efforts to address the security concerns discussed.

Ed Czarnecki:

Posted: 2013-07-25 @ 9:17am PT
A very critical omission in the article and the researcher's report is that **several months ago**, Monroe Electronics issued a software release with a cumulative security update that addressed these reported concerns. The software update was actually issued in a soft release in March 2013, and then in a general release in April 2013. Our understanding is that most users had already implemented this update.

To excerpt from the actual ICS-CERT report from the US goverment:

"On April 24, 2013, Monroe Electronics and Digital Alert Systems released firmware version 2.0-2 that disables the compromised SSH key, provides a simplified user option to install new unique keys, and enforces a new password policy. Monroe Electronics has taken considerable effort to provide update information to DASDEC and One-NetSE users."

Also, please see our April 24th statement on the matter here: http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf

I also would note a recent statement from Dan Watson, a spokesman for the Federal Emergency Management Agency (FEMA), which handles oversight of the EAS, who confirmed that the issue was fixed via a software update.

We undertook great efforts to provide a cumulative security update that removed all SSH keys, addressed password policy, and made other security enhancements. We also made a committed effort to contact our users directly with information about the nature of the concern, and the software mitigation, and the need to adhere to accepted network security practices.

I hope you appreciate the importance of clarifying this omission in the article.

Yours very respectfully,
Ed Czarnecki
Senior Director - Strategy and Regulatory Affairs
Monroe Electronics/Digital Alert Systems

Richard Roberts III:

Posted: 2013-07-15 @ 1:35pm PT
Who's to say the zombie's aren't real. that it didn't happen. and now they are just covering it up.



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Cybercrime
1.   Canada Says China Hacked Gov't
2.   Android 'Fake ID' Puts Millions at Risk
3.   Wall Street Journal Hacked Again
4.   Protect Yourself from Identity Theft
5.   Hackers Breached StubHub Accounts


advertisement
Android 'Fake ID' Puts Millions at Risk
Users: stick to apps from Google Play.
Average Rating:
Protect Yourself from Identity Theft
Even if your data was compromised.
Average Rating:
Banks Hit by Android-Skirting Malware
34 institutions, four European countries
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Canadian Government Charges China With Cyberattack
The government of Canada is not happy with China. Canadian officials have accused "a highly sophisticated Chinese state-sponsored actor" of launching a cyberattack on its National Research Council.
 
Researchers Working To Fix Tor Security Exploit
Developers for the Tor privacy browser are scrambling to fix a bug revealed Monday that researchers say could allow hackers, or government surveillance agencies, to track users online.
 
Wall Street Journal Hacked Again
Hacked again. That’s the story at the Wall Street Journal this week as the newspaper reports that the computer systems housing some of its news graphics were breached. Customers not affected -- yet.
 

Enterprise Hardware Spotlight
Apple Updates MacBook Pros, Cuts Prices Up to $100
The popular MacBook Pro laptop line just got an update and a price cut of as much as $100. The MacBook Pro with Retina display now includes faster processors and double the memory.
 
Watson Gets His First Customer Service Gig
Since appearing on Jeopardy, IBM's Watson supercomputer has been making a living using his super-intelligent knowledge base for business verticals. Now, Watson's been hired for his first customer service job.
 
Tablet Giants Apple and Samsung Feel the Heat
When a company saturates its home market with a once-hot product, expect it to pump up efforts elsewhere. Apple, for its part, is now pushing iPads to big corporations and the enterprise market.
 

Mobile Technology Spotlight
Android 'Fake ID' Puts Millions of Users at Risk
Having this fake ID is nothing to brag about, even if you are a minor. The “Fake ID” Android flaw drops malware into smartphone apps. It can steal credit card data and even take over your device.
 
FTC Wants Fix for 'Perfect Scam' of Mobile Cramming
The U.S. Federal Trade Commission has issued new guidelines to curb “mobile cramming,” a troublesome practice that adds unauthorized third-party charges to mobile phone bills.
 
Facebook: You Will Use Messenger, and You Will Like It
Starting this week, Facebook users with Android and iOS phones will be forced to use the separate Messenger app to send Facebook messages. Pending messages will still be visible in the main app.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.