CIO Today

CIO Today Network Sites:   Top Tech News  |   CIO Today   |   Mobile Tech Today   |   Data Storage Today
Daily Briefing for Technology's Top Decision-Makers
Vblock™ Systems:
Advanced converged infrastructure
increases productivity & lowers costs.

www.vce.com
Thursday, April 24th 
Real-time info services with Neustar
This ad will display for the next 20 seconds. Please click for more information, or scroll down to pass the ad, or Close Ad.
Trending Topics:   Security Heartbleed Big Data Cloud Computing Windows XP Data Centers OS X Mavericks
Home
Enterprise Software
Enterprise Hardware
Big Data
Network Security
Cloud Computing
CRM Systems
Data Storage
Operating Systems
Communications
CIO Issues
Mobile Tech
Chips & Processors
World Wide Web
Business Briefing
After Hours
Press Releases
 
Free Newsletters
Top CIO News
 
Mobile Tech Today
 

Network Security

'Zombie' Alert Shows Emergency Broadcasts Can Be Hacked


July 9, 2013 1:15PM

Bookmark and Share
Seattle security firm IOActive said it has uncovered vulnerabilities in the digital alerting application servers, or DASDEC, which receive and authenticate Emergency Alerting System messages. When a message has been received and authenticated, DASDEC interrupts a TV or radio broadcast with the well-known alert tone and the message.

Your Next Generation Data Center Is Here! Vblock™ Systems: the world's most advanced converged infrastructure are built on the Cisco Unified Computing System with Intel® Xeon® processors. Vblock™ Systems deliver extraordinary time to market, ROI and TCO, and flexibility to meet your continually changing demands with 5X faster deployment, 96% less downtime, and 1/2 the cost. Click here to learn more.

A recent zombie apocalypse showed the vulnerability of the United States' emergency broadcasting system. In February, hackers interrupted Montana TV with reports of a zombie apocalypse, using the Emergency Alerting System (EAS), and this week a security firm, citing the zombie attack, has recommended that the system be re-engineered.

Seattle-based IOActive has said that the zombie news bulletin showed the system's weaknesses. IOActive principal research scientist Mike Davis told news media that, "although there was no zombie apocalypse, it did highlight just how vulnerable the system is."

The zombie bulletin also played on a Michigan radio station, and it said that civil authorities "have reported that the bodies of the dead are rising from their graves and attacking the living." It added the suggestion that witnesses not "attempt to approach or apprehend these bodies as they are considered extremely dangerous."

10 Minutes to POTUS

IOActive said it has uncovered vulnerabilities in the digital alerting application servers, or DASDEC, which receive and authenticate EAS messages. When a message has been received and authenticated, DASDEC interrupts a broadcast with the well-known alert tone and the message.

Davis said in a statement that DASDEC application servers "are currently shipped with their root privileged SSH key as part of the firmware update package." The key enables a remote logon, and can let the holder manipulate any system function, including disrupting a station's transmission.

Among other functions, the EAS is intended to allow the President of the United States to speak to the country's citizens in as little as 10 minutes from when a disaster or other event occurs. The Federal Emergency Management Agency (FEMA) oversees the EAS.

'Potential Security Vulnerability'

The DASDEC systems are made by Monroe Electronics in New York, which released in April a software update that it said resolved the "potential security vulnerability" and improved several operational features. The changes included removal of default SSH keys and a simplification of the process to load new SSH keys.

The U.S. Department of Homeland Security (DHS) reported last week that, while IOActive has reported "that the administrative web server uses a predictable, monotonically increasing session ID," based on running the web server in a test environment, Monroe Electronics "could not reproduce this finding" in the factory or in the field. It is not currently clear if the vulnerabilities reported by IOActive have been resolved.

The first nationwide test of the EAS was conducted by the Federal Communications Commission and FEMA at 2pm ET on November 9, 2011, when a 30-second test interruption with sample messaging broke into most TV and radio broadcasts in the country. While EAS has been tested and used on previous occasions, this was its first transmission nationwide, and a key goal was to find any glitches. In that sense, it was successful, in that it turned out some stations didn't air the test and some interruptions exceeded 30 seconds.

Editorial note: Please see additional information in the Comments section below, provided by Monroe Electronics about security updates they have provided to resolve potential vulnerability of the system.

Tell Us What You Think
Comment:

Name:

Editor:

Posted: 2013-07-25 @ 9:22am PT
Thank you Ed Czarnecki. We appreciate the additional information and clarifications provided below for our readers about Monroe Electronic's efforts to address the security concerns discussed.

Ed Czarnecki:

Posted: 2013-07-25 @ 9:17am PT
A very critical omission in the article and the researcher's report is that **several months ago**, Monroe Electronics issued a software release with a cumulative security update that addressed these reported concerns. The software update was actually issued in a soft release in March 2013, and then in a general release in April 2013. Our understanding is that most users had already implemented this update.

To excerpt from the actual ICS-CERT report from the US goverment:

"On April 24, 2013, Monroe Electronics and Digital Alert Systems released firmware version 2.0-2 that disables the compromised SSH key, provides a simplified user option to install new unique keys, and enforces a new password policy. Monroe Electronics has taken considerable effort to provide update information to DASDEC and One-NetSE users."

Also, please see our April 24th statement on the matter here: http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf

I also would note a recent statement from Dan Watson, a spokesman for the Federal Emergency Management Agency (FEMA), which handles oversight of the EAS, who confirmed that the issue was fixed via a software update.

We undertook great efforts to provide a cumulative security update that removed all SSH keys, addressed password policy, and made other security enhancements. We also made a committed effort to contact our users directly with information about the nature of the concern, and the software mitigation, and the need to adhere to accepted network security practices.

I hope you appreciate the importance of clarifying this omission in the article.

Yours very respectfully,
Ed Czarnecki
Senior Director - Strategy and Regulatory Affairs
Monroe Electronics/Digital Alert Systems

Richard Roberts III:

Posted: 2013-07-15 @ 1:35pm PT
Who's to say the zombie's aren't real. that it didn't happen. and now they are just covering it up.



 Network Security
1. Fund Seeks To Head Off Heartbleeds
2. Lessons from Verizon's Threat Report
3. Verizon Report Exposes Cyberthreats
4. How Are Web Sites Post-Heartbleed?
5. White House Updating Privacy Policy




 Most Popular Articles
1. BlackBerry Drops T-Mobile After Nasty Spat
2. Cisco, IBM Launch Internet of Things Consortium
3. Salesforce CRM Gets Industry Specific for Internet of Customers
4. Intel Bets on Cloudera for Big Data Analytics
5. SAP HANA Data Warehouse App Gets Faster Analytics

Have an informed opinion on this story?
Send a Letter to the Editor.
We want to know what you think.
Send us your Feedback.

 Related Topics  Latest News & Special Reports

  IBM Targets Big Data with Power8 Line
  Opera Coast Offers Safari Alternative
  FCC Defends Internet Traffic Proposal
  Fund Seeks To Head Off Heartbleeds
  Salesforce Developing App SOS Button

 Technology Marketplace
Business Intelligence
Get real-time, cloud-based information services with Neustar.
 
Cloud Computing
Next Generation Data Center Is Here! Vblock™ Systems from VCE
 
Contact Centers
HP delivers the future of the contact center with HP Qfiniti 10.
 
Data Storage
Next Generation Data Center Is Here! Vblock™ Systems from VCE
Barium Ferrite (BaFe) is the future of tape.
2.5" Enterprise-class SATA & SAS SSDs for server & storage applications
 
Enterprise Hardware
Barium Ferrite (BaFe) is the future of tape.
2.5" Enterprise-class SATA & SAS SSDs for server & storage applications
 
Hardware
Protect your network with APC Smart-UPS battery backup
 
Network Security
Protect your network with APC Smart-UPS battery backup
 

Network Security Spotlight
Tech Giants Fund Initiative To Prevent Future Heartbleeds
Can more funding prevent Heartbleed vulnerabilities in future open-source software? A new Core Infrastructure Initiative at the Linux Foundation is attempting to find out.
 
What Verizon's Data Breach Report Can Teach Enterprises
It’s probably not a jaw-dropper, but cyberespionage is officially on the rise. And the use of stolen or misused credentials is still the leading way the bad guys gain access to corporate information.
 
Top Cyberthreats Exposed by Verizon Report
Beyond Heartbleed, there are cyberthreats vying to take down enterprise networks, corrupt smartphones, and wreak havoc on businesses. Verizon is exposing these threats in a new report.
 
Navigation
CIO Today
Home/Top News | Enterprise Software | Enterprise Hardware | Big Data | Network Security | Cloud Computing | CRM Systems
Data Storage | Operating Systems | Communications | CIO Issues | Mobile Tech | Chips & Processors | World Wide Web
Business Briefing | After Hours | Press Releases
Also visit these Enterprise Technology Sites
Top Tech News | CIO Today | Mobile Tech Today | Data Storage Today

Services:
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About CIO Today Network | How To Contact Us | Article Reprints | Services for PR Pros (In partnership with NewsFactor) | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 CIO Today. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.