A recent zombie apocalypse showed the vulnerability of the United States' emergency broadcasting system. In February, hackers interrupted Montana TV with reports of a zombie apocalypse, using the Emergency Alerting System (EAS), and this week a security Relevant Products/Services firm, citing the zombie attack Relevant Products/Services, has recommended that the system be re-engineered.

Seattle-based IOActive has said that the zombie news bulletin showed the system's weaknesses. IOActive principal research scientist Mike Davis told news media that, "although there was no zombie apocalypse, it did highlight just how vulnerable the system is."

The zombie bulletin also played on a Michigan radio station, and it said that civil authorities "have reported that the bodies of the dead are rising from their graves and attacking the living." It added the suggestion that witnesses not "attempt to approach or apprehend these bodies as they are considered extremely dangerous."

10 Minutes to POTUS

IOActive said it has uncovered vulnerabilities in the digital alerting application servers, or DASDEC, which receive and authenticate EAS messages. When a message has been received and authenticated, DASDEC interrupts a broadcast with the well-known alert tone and the message.

Davis said in a statement that DASDEC application servers "are currently shipped with their root privileged SSH key as part of the firmware update package." The key enables a remote logon, and can let the holder manipulate any system function, including disrupting a station's transmission.

Among other functions, the EAS is intended to allow the President of the United States to speak to the country's citizens in as little as 10 minutes from when a disaster or other event occurs. The Federal Emergency Management Agency (FEMA) oversees the EAS.

'Potential Security Vulnerability'

The DASDEC systems are made by Monroe Electronics in New York, which released in April a software update that it said resolved the "potential security vulnerability" and improved several operational features. The changes included removal of default SSH keys and a simplification of the process to load new SSH keys.

The U.S. Department of Homeland Security (DHS) reported last week that, while IOActive has reported "that the administrative web server Relevant Products/Services uses a predictable, monotonically increasing session ID," based on running the web server in a test environment, Monroe Electronics "could not reproduce this finding" in the factory or in the field. It is not currently clear if the vulnerabilities reported by IOActive have been resolved.

The first nationwide test of the EAS was conducted by the Federal Communications Commission and FEMA at 2pm ET on November 9, 2011, when a 30-second test interruption with sample messaging broke into most TV and radio broadcasts in the country. While EAS has been tested and used on previous occasions, this was its first transmission nationwide, and a key goal was to find any glitches. In that sense, it was successful, in that it turned out some stations didn't air the test and some interruptions exceeded 30 seconds.

Editorial note: Please see additional information in the Comments section below, provided by Monroe Electronics about security updates they have provided to resolve potential vulnerability of the system.