Forgot your password?
typodupeerror
Communications Bug Government Security

Exposed SSH Key Means US Emergency Alert System Can Be Hacked 86

Posted by timothy
from the what's-with-all-the-tsunami-alerts-lately? dept.
wiredmikey writes "Recently discovered security flaws in the Emergency Alerting System (EAS) which is widely used by TV and radio stations across the United States, has made the systems vulnerable to remote attack. The vulnerability stems from an SSH key that is hard-coded into DASDEC-I and DASDEC-II devices made by Monroe Electronics. Unless the default settings were altered during deployment, impacted systems are using a known key that could enable an attacker with full access if the systems are publicly faced or if they've already compromised the network. By exploiting the vulnerability, an attacker could disrupt a station's ability to transmit and/or could send out false emergency information. 'Earlier this year we were shown an example of an intrusion on the EAS when the Montana Television Network's regular programming was interrupted by news of a zombie apocalypse. Although there was no zombie apocalypse, it did highlight just how vulnerable the system is,' said Mike Davis, a principal research scientist at IOActive. The DHS issued an alert on the vulnerability, and IOActive, the firm that discovered the flaw, has published additional technical details (PDF) on the security issue."
This discussion has been archived. No new comments can be posted.

Exposed SSH Key Means US Emergency Alert System Can Be Hacked

Comments Filter:
  • by intermodal (534361) on Tuesday July 09, 2013 @11:49AM (#44227049) Homepage Journal

    when I saw the first part of the blurb, I thought, "the least they could do is publicize the security hole by announcing the zombie apocalypse." Guess they beat me to the punch.

    • by Anonymous Coward

      The real story is that this is a cover-up for a real zombie outbreak. The feds think they can keep it contained and hide the evidence, but we'll all know better in a month.

    • Re: (Score:3, Funny)

      by Anonymous Coward

      When I saw the second part of the blurb, I thought, "They *say* there wasn't a zombie apocalypse and that it was just a security flaw, but maybe that's only because they managed to contain the outbreak in Montana." :-)

      • by egamma (572162) <egamma.gmail@com> on Tuesday July 09, 2013 @01:09PM (#44228131)

        When I saw the second part of the blurb, I thought, "They *say* there wasn't a zombie apocalypse and that it was just a security flaw, but maybe that's only because they managed to contain the outbreak in Montana." :-)

        I grew up in Montana. I've been to Great Falls. If there were zombies in February, the zombies arose from the grave and them promptly iced over, and were then disassembled using chainsaws.

      • Goddamnit, getting my YubiKey today was the safest I've felt in a while. But, 2 ACs posting the same idea within 2 minutes of each other can't be wrong. Makes me wonder...by the time I get a shotgun, what will the next threat be?
    • It has already happened [wikipedia.org]

      Check out the last incident on the list, from February of this year.

    • by folderol (1965326)
      Anyone else notice you just can't get the same class of zombie apocalypse that you used to see years ago?
    • Everyone is obsessed with zombies right now it's the zombie craze it's only fitting they break threw with a zombie apocalypse story.
  • Hard-Coded? (Score:3, Insightful)

    by drummerboybac (1003077) on Tuesday July 09, 2013 @11:49AM (#44227051)
    If the implications are that it can be changed by modifying the default settings, its not really hard-coded, is it ?
    • Re:Hard-Coded? (Score:4, Insightful)

      by CastrTroy (595695) on Tuesday July 09, 2013 @12:04PM (#44227263) Homepage
      There's a hard coded default, and that's bad enough. In order to do stuff like this correctly, the system should not have a default code, and it should not start until a new securely generated key has been created.
      • What, and add two more steps to the install??

        Insanity!

        • by Anonymous Coward

          These pieces of equipment are run by people who can't us the terms "hacker" correctly and who waive their hands in the air about "cyber attacks."

          For morons, in other words.

          • These pieces of equipment are run by people who can't us the terms "hacker" correctly and who waive their hands in the air about "cyber attacks."

            For morons, in other words.

            I agree... anyone who waives their hands is a moron. You can waive my hands from my cold dead (animated) body.

            • by 1s44c (552956)

              I agree... anyone who waives their hands is a moron. You can waive my hands from my cold dead (animated) body.

              Anyone that waves their hands about, in an enclosed space such as a train or a bus, whilst talking on a phone, is beyond moron.

              • *whoosh*

                But yeah; that's due to the talking on a phone part. People need to waive their phone use prior to waving so they don't make waves.

    • Re:Hard-Coded? (Score:4, Interesting)

      by bughunter (10093) <.ten.knilhtrae. .ta. .retnuhgub.> on Tuesday July 09, 2013 @12:11PM (#44227363) Journal

      If the implications are that it can be changed by modifying the default settings, its not really hard-coded, is it ?

      FTFS:
      Unless the default settings were altered during deployment, impacted systems are using a known key

      You missed an important bit there. It's very probably stored on an EPROM or SD Card, requiring physical access to the DASDECs. Some of my employer's products are used in the same market (local TV stations) and that's a pretty common method of configuring equipment for a particular customer.

      Hard-coded, as in: Yes it's code, but there's no external interface protocol which permits changing the keys. In order to alter it, you have to remove the unit from the rack, take the cover off, and then you can upload a new config file. More recent products use external USB ports, but I bet these DASDECs are older than that...

      • by h4rr4r (612664)

        What moron decided to use the same key on all of them is my question. If it is really on EPROM then you really need to avoid stupidity like this since it is harder to change later.

        • Pre-internet when this was built that wasn't stupid thinking. It was called redundancy. Yes it should have been updated.

          • by cdrudge (68377)

            Pre-internet when this was built that wasn't stupid thinking.

            SSH came about sometime in 1995 or later. The Internet, regardless of when you want to consider it "invented", predates that considerably. DASDEC products didn't come about until 2004.

            There is ZERO reason to key them all the same.

          • It was updated. FTA:

            According to an advisory from the company, most (but not all) of their customers have installed the updated firmware.

            The problem is getting customers to do the update. In typical egocentric Slashdot fashion, many posters will sanctimoniously say that they do daily checks for security updates or whatever. The problem is that they forget that broadcasters, and many other folks, have a lot of things to worry about in addition to Internet security. Maybe the answer is just to take stuff like this off the Internet. They had ways of handling this before it was popular to connect everything including your toa

            • by penix1 (722987)

              There is also another reason...

              You haven't worked for a state agency before if you think the "customer" is the emergency management team. It is the IT departments that have control of all the equipment as well as have the responsibility for its maintenance and upkeep.

              Having said all that, is it really the job of even the IT department to fix a flaw in equipment supplied by a vendor? Or is it the job of the vendor (who usually has a maintenance contract for it) to do that fixing?

        • by 1s44c (552956)

          What moron decided to use the same key on all of them is my question. If it is really on EPROM then you really need to avoid stupidity like this since it is harder to change later.

          Vendor: "But it's perfectly secure because we promise to keep the key safe!"
          PHB of whatever government department: "I see no problem with that"

    • Those defaults are hardcoded...The blurb is only kind of misleading.
  • Yep, I'll suddenly get more emergency alerts over my satellite radio, for whatever reason they do them now.

    Warning purple fuzzy minions attacking everyone on Earth!

    Ok... that one would make sense as it isn't location specific.

    • And don't forget your cellphone. The problem is the weather service sends out stupid alerts I don't care about and I have no way to filter them. I have a weather radio at home and I never turn it on because it goes off at least once a week at 3am with "Thunderstorm warning!!!!" Ok, yea, as if the thunder and my panicking dog didn't already alert me to that. Then there's the flash flood warnings. I live on high ground, and work on the 6th floor of a highrise and even if I didn't what the hell am I supposed t

    • by dgatwood (11270)

      At least they chose an obviously fake alert. Imagine if they had announced a terrorist threat to a major sporting event. They could have easily caused a mass panic with thousands of casualties. This is why we must take cyber-security seriously. Specifically:

      • The community needs to continue beefing up vulnerability databases to make it easier for people to get alerts about software and hardware that they own and use, rather than generic warnings that contain dozens of products, 99% of which they don't ca
      • by dbIII (701233)

        They could have easily caused a mass panic with thousands of casualties

        Reality is not a disaster movie. In real disasters people are surprisingly sensible.

        • That's why provoking a mass panic by faking a deasaster could be even more evil that the deasaster itself....

          • Watch out kids. If you take illegal drugs you might end up looking just as stupid as the poster above who managed to get the thing he read turned around backwards in his brain.
  • by belthize (990217) on Tuesday July 09, 2013 @11:54AM (#44227125)

    I think this is just misdirection and cover up.

    'Earlier this year we were shown an example of an intrusion on the EAS when the Montana Television Network's regular programming was interrupted by news of a zombie apocalypse. Although there was no zombie apocalypse, it did highlight just how vulnerable the system is,

    How do we know there was no zombie apocalypse. Maybe they're just claiming a vulnerability to pretend the apocalypse was a fake. When was the last time you talked to somebody in Montana, would you even know if it'd been overrun ?
     

    • by Picass0 (147474) on Tuesday July 09, 2013 @12:00PM (#44227219) Homepage Journal

      Plausible.

      Most people when meeting somebody from Montana wouldn't be able to tell if they are "living" or "living dead".

    • by Hillgiant (916436)

      Everyone knows that so-called "Montana" is just a ridiculous liberal myth.

    • by 1s44c (552956)

      If Montana was overrun by Zombies would anyone care?

      Now if Hannah Montana was fighting off a zombie invasion, maybe with a chainsaw, that would be a great film.

    • More to the point...what is the criticality in your life that Montana has been over-run. As In: Montana has been over-run by a Zombie Apocalypse. This affects your life exactly...HOW?

  • So this is the cover story they are using this time?
    I guess they need some way to explain it away. Just like the Chinese did with SARS to keep people from finding out the truth.

  • "bad form"? it's just security-through-obscurity. it's tempting to try to enumerate some ground rules for security (like "never hardcode a secret"), but if someone is violating these sorts of commonsense rules, would they ever read such a list?

    • by Anonymous Coward

      FAST
      GOOD
      CHEAP

      choose two

  • They found the freaking phone number that these units still use to make brain dead Government officials able to use it. IT probably had a easy to guess 4 digit password.

  • normally, any system on the internet will receive lots of bruteforce ssh scans, using password authentication. I wonder if this botch means that Bad Guys will be scanning with publickey as well. (obviously, the set of known and interesting private keys is much less effective than the usual catalog of common passwords...)

  • id_nsa.pub

  • by smash (1351) on Tuesday July 09, 2013 @12:17PM (#44227423) Homepage Journal

    It's really not that hard.

    1. Password protect your private keys!
    2. don't listen to port 22 on the internet from anywhere. require VPN, ipsec tunnel, at the bare minimum, hosts.allow from a specific management network, or some other method to secure the connection first. security is layered, don't rely on a single authentication to give people to keys to the castle, or someone will fuck you
    3. use multiple service accounts with least privilege access so compromise of one doesn't impact another

    The fact that an emergency services network has been left in a state like this is bordering on.... no, IS criminal negligence.

    • by Loughla (2531696)
      The sad fact is the people who actually make calls about infrastructure like emergency alert, power and water have absolutely no idea what most of the words in your post actually mean.
      • It's unlikely those decision makers are the same people who hard-coded an ssh key into the device. They don't even know what ssh is.

    • by Chuck Milam (1998)

      All things being relative, this is a government contract/project, so I guess we should feel lucky it wasn't open port 23 telnet with a null password. Therefore, they'll probably get a reward for using that newfangled SSH encryption stuff (circa 1995, but who's keeping score?)

    • by gl4ss (559668)

      well.. they could spend the money either on tapping your daughters video chats OR for training people responsible for these systems, they didn't have money for both and tapping the skype feeds was easier so they went with it.

    • by 1s44c (552956)

      There is no security reason to move SSH to a different port. It's dead easy to work out what port it's on as it has a clear banner. VPN and ipsec are not more secure than SSH and often cause more problems as they can bridge trusted to untrusted networks.

      If you want to setup SSH right:

      Turn off all password authentication.

      Turn off everything else in the config you are not using, like host based and kerberos authentication.

      Use big key lengths.

      Check you only have current and correct keys in authorized_keys

      Limit

      • If someone follows their advice they are wide open in situations like the one we are discussing! A stolen key would let someone in if you don't have a passphrase on the key.

        Thus I see your "Turn off all password authentication" as stupid and dangerous advice since it will be read by every ssh newbie (and a lot who are not newbies) as meaning not to use a passphrase on the key. If you are going to mention passwords at all you need to make that clear, otherwise you are setting people up for an easy attack
        • by smash (1351)

          Password auth in SSH and password protected keys are two entirely different things - password auth on your key is a client side thing; to enforce key use you turn off password auth in SSH. Unfortunately, I'm not aware of a way to enforce password protection on private keys on the server end. So your options are to generate the private key with the user under supervision or via a script or such which forces them to supply a passphrase.

          It is also why you also block access to networks you don't know and p

          • by dbIII (701233)
            Doesn't matter - the above post had a long list of things but left out the one thing that offers protection from the compromised key the article is about and gave some advice that can be misinterpreted as not doing the one thing that can stop it.
            • by 1s44c (552956)

              I refer you again to the line about keeping current keys in authorized keys and again to the fact you should not be allowed to managed anything more important than a pocket calculator.

              • by dbIII (701233)
                Don't take criticism well do you?
                • by 1s44c (552956)

                  Don't take criticism well do you?

                  It's not that, I just don't take ignorant fools who think they know what they are talking about well.

                  • by dbIII (701233)
                    I'm not the one that missed the passphrase. If that makes me the incompetent one you must have an incredibly low opinion of yourself.
              • by smash (1351)
                Removing a key from authorized_keys relies on the fact that you happen to KNOW it has been stolen. If you don't know, you're fucked. Password protect your keys!
              • by dbIII (701233)

                I refer you again to the line about keeping current keys in authorized keys

                Obviously that is not going to help in any way at all until it's already been revealed that the key is stolen - most likely by somebody using it to get in and create some sort of incident.
                If I'm not fit to use a calculator by spotting these things that you are not then where does that leave you? Not fit to brush your teeth without risking an accident or something? You are better with the insults than with ssh so I'll leave it up to

        • by 1s44c (552956)

          I never said leave your car unlocked with the keys in the ignition, that doesn't mean I'm advising people to do that. I really hope you don't manage anything more serious than your home system because you don't have a clue.

          'Check you only have current and correct keys in authorized_keys' means getting rid of keys that have, or may have, leaked. I never said don't use passphrases but ultimately you can't trust them because you can't trust users to do the right thing.

          • by dbIII (701233)
            You wrote about not using passwords, which just about everyone other than a sysadmin is going to assume means not using a passphrase on the key either. Look at older posts here every single time ssh passwords are mentioned to get a depressingly huge number of examples of people making that mistake.
            I didn't insult you for your bad advice so lay off the childish bullying insults on the messenger. Do you really think I'm so insecure as to take you seriously, and do you really lay the boot in so rudely to peo
      • by smash (1351)

        I'm not talking about moving it to a different port. I'm talking about blocking port 22 inbound using your firewall or hosts.allow, except for a specific set of management IPs that are preferably on the end of an IPSEC tunnel or other VPN service. If not, at least reduce the IP space that is allowed to hit that port to a well defined set of IPs that you either own or at the bare minimum belong to the ISP you use. There is ZERO reason to be listening on port 22 for connections from say, China or Russia!

    • We rot13 out keys, nothing could be safer I tell you!

  • - pedantic mode on - "...although there was no zombie apocalypse..." implies that there COULD have been one for real. Gosh. These 'mericans !
  • We have potentially thousands of these devices in the field that were deployed with the default factory configuration? That's security 101 -- Don't go with the factory settings. I haven't looked up the manual for these devices so I can't say how difficult it is to change the "hard coded" SSH keys but apparently the article suggests that it is possible to generate and deploy your own SSH keys provided the sending station(s) have the public keys required to encode and send these broadcasts. It requires quires

  • Although there was no zombie apocalypse...

    oh, phew. thanks for that.

  • Now we can use this as an example every time the "key only" idiots pop up and start yelling at those that suggest using a passphrase as well. Such idiots spout "never use a password" which is utterly stupid and dangerous advice when they ignorantly extend it to hatred of key+passphrase combinations.
    If someone gets the key it should never be enough to let them into anything other than trivial systems where it doesn't matter who has access.
  • by Anonymous Coward

    there was no zombie apocalypse!?!

nohup rm -fr /&

Working...