This Is Not a Test: Emergency Broadcast Systems Proved Hackable

As was written in a book ahead of it’s time (1987), “Spetsnaz. The Story Behind the Soviet SAS”, has now come to fruition.

The following is a sample from the book:

I do not know how or when World War Three will start. I do not know exactly how the Soviet high command plans to make use of spetsnaz in that war: the first world war in which spetsnaz will be a major contributor. I do not wish to predict the future. In this chapter I shall describe how spetsnaz will be used at the beginning of that war as I imagine it. It is not my task to describe what will happen. But I can describe what might happen.

The last month of peace, as in other wars, has an almost palpable air of crisis about it. Incidents, accidents, small disasters add to the tension. Two trains collide on a railway bridge in Cologne because the signalling system is out of order. The bridge is seriously damaged and there can be no traffic over it for the next two months.

On 12 August, at 0558 local time, a van comes to a halt on the vast empty parking lot in front of a supermarket in Washington. Three men open the doors of the van, roll out the fuselage of a light aircraft and attach its wings. A minute later its motor bursts into life. The plane takes off and disappears into the sky. It has no pilot. It is controlled by radio with the aid of very simple instruments, only slightly more complicated than those used by model aircraft enthusiasts. The plane climbs to about 200 metres and immediately begins to descend in the direction of the White House. A minute later a mighty explosion shakes the capital of the United States. The screaming of sirens on police cars, fire engines and ambulances fills the city.

Three minutes later a second plane sweeps across the centre of the city and there is a second explosion in the place where the White House once stood. The second plane has taken off from a section of highway under construction, and has a quite different control system. Two cars with radio beacons in them have been left earlier in the middle of the city. The beacons have switched on automatically a few seconds before the plane’s take-off. The automatic pilot is guided by the two beacons and starts to descend according to a previously worked-out trajectory. The second plane has been sent off by a second group operating independently of the first one.

It was a simple plan: if the first plane did not destroy the White House the second would. If the first plane did destroy the White House then a few minutes later all the heads of the Washington police would be near where the explosion had taken place. The second plane would kill many of them.

At 0606 all radio and television channels interrupt their normal programmes and report the destruction of the White House and the possible death of the President of the United States.

At 0613 the programme known as Good Morning America is interrupted and the Vice-President of the USA appears. He announces a staggering piece of news: there has been an attempt to seize power in the country on the part of the leaders of the armed forces. The President of the United States has been killed. The Vice-President appeals to everyone in the armed forces to remain where they are and not to carry out any orders from senior officers for the next twenty-four hours, because the orders would be issued by traitors shortly to be removed from their posts and arrested.

Soon afterwards many television channels across the country cease transmitting….

Article:

Several models of Emergency Alert System decoders, used to break into TV and radio broadcasts to announce public safety warnings, have vulnerabilities that would allow hackers to hijack them and deliver fake messages to the public, according to an announcement by a security firm on Monday.

The vulnerabilities included a private root SSH key that was distributed in publicly available firmware images that would have allowed an attacker with SSH access to a device to log in with root privileges and issue fake alerts or disable the system.

IOActive principal research scientist Mike Davis uncovered the vulnerabilities in the application servers of two digital alerting systems known as DASDEC-I and DASDEC-II. The servers are responsible for receiving and authenticating emergency alert messages.

“These DASDEC application servers are currently shipped with their root privileged SSH key as part of the firmware update package,” Davis said in a statement. “This key allows an attacker to remotely log on in over the Internet and can manipulate any system function.”

Davis indicated that to resolve the issue would require “re-engineering” of the digital alerting system side as well as firmware updates pushed out to appliances in the field.

Earlier this year hackers used default credentials to break into the Emergency Alert System at local TV station KRTV in Montana to interrupt programming with an alert about a zombie apocalypse.

During an afternoon broadcast of the Steve Wilkos talk show, a loud buzzer sounded and a banner ran across the top of the screen as an announcer’s voice warned viewers that the zombie apocalypse was upon them.

“Civil authorities in your area have reported that the bodies of the dead are rising from their graves and attacking the living,” the announcer said. “Follow the messages on-screen that will be updated as information becomes available. Do not attempt to approach or apprehend these bodies, as they are extremely dangerous.”

Similar attacks also reportedly hit stations in Michigan, New Mexico, Utah and California. The hackers targeted local systems, however, not the national EAS network.

“We were hacked and we’re not proud of it,” Duane Ryan, director of programming at KENW, PBS station in Portales, New Mexico said after the attack, acknowledging that the station had never changed the manufacturer’s default user name and password on its EAS computers. “We’ve changed them now,” he said.

EAS is a descendant of the Emergency Broadcast System established in the 1960s during President John F. Kennedy’s administration. It’s used to alert the public about weather emergencies, disasters and Amber alerts and is also available to the President of the United States to break into programming to announce a national crisis. Initially, the system was designed so that alerts passed from station to station via the wire services of the Associated Press and United Press International, but it now transmits through analog and digital systems.

Full article: This Is Not a Test: Emergency Broadcast Systems Proved Hackable (Wired)

Comments are closed.