Exposed SSH Key Means US Emergency Alert System Can Be Hacked 86
wiredmikey writes "Recently discovered security flaws in the Emergency Alerting System (EAS) which is widely used by TV and radio stations across the United States, has made the systems vulnerable to remote attack. The vulnerability stems from an SSH key that is hard-coded into DASDEC-I and DASDEC-II devices made by Monroe Electronics. Unless the default settings were altered during deployment, impacted systems are using a known key that could enable an attacker with full access if the systems are publicly faced or if they've already compromised the network. By exploiting the vulnerability, an attacker could disrupt a station's ability to transmit and/or could send out false emergency information. 'Earlier this year we were shown an example of an intrusion on the EAS when the Montana Television Network's regular programming was interrupted by news of a zombie apocalypse. Although there was no zombie apocalypse, it did highlight just how vulnerable the system is,' said Mike Davis, a principal research scientist at IOActive. The DHS issued an alert on the vulnerability, and IOActive, the firm that discovered the flaw, has published additional technical details (PDF) on the security issue."
Zombie apocalypse false report (Score:5, Funny)
when I saw the first part of the blurb, I thought, "the least they could do is publicize the security hole by announcing the zombie apocalypse." Guess they beat me to the punch.
Re: (Score:1)
The real story is that this is a cover-up for a real zombie outbreak. The feds think they can keep it contained and hide the evidence, but we'll all know better in a month.
Re: (Score:3, Funny)
When I saw the second part of the blurb, I thought, "They *say* there wasn't a zombie apocalypse and that it was just a security flaw, but maybe that's only because they managed to contain the outbreak in Montana." :-)
Re:Zombie apocalypse false report (Score:4, Funny)
When I saw the second part of the blurb, I thought, "They *say* there wasn't a zombie apocalypse and that it was just a security flaw, but maybe that's only because they managed to contain the outbreak in Montana." :-)
I grew up in Montana. I've been to Great Falls. If there were zombies in February, the zombies arose from the grave and them promptly iced over, and were then disassembled using chainsaws.
Re: (Score:2)
Re: (Score:2)
It has already happened [wikipedia.org]
Check out the last incident on the list, from February of this year.
Re: (Score:2)
...or rather this is the second incident of it happening, not the first.
Re: (Score:1)
Why would anyone need a Barrel of lube? What, you're a porn star now? (55 gallons is a standard barrel)
Re: (Score:2)
Re: (Score:1)
Hard-Coded? (Score:3, Insightful)
Re:Hard-Coded? (Score:4, Insightful)
Re: (Score:2)
What, and add two more steps to the install??
Insanity!
Re: (Score:1)
These pieces of equipment are run by people who can't us the terms "hacker" correctly and who waive their hands in the air about "cyber attacks."
For morons, in other words.
Re: (Score:1)
Nah, this system isn't made for you.
It looks like this system is made for anyone who knows how to use SSH and can figure out how to get this emergency broadcast system to broadcast their message. I expect regular Zombie, Vampire, Killer Bee, and Klingon invasions for the next few months and maybe a few party political broadcasts by right-wing Christian nut-jobs.
Look on the bright side, it's better than regular TV.
Re: (Score:2)
These pieces of equipment are run by people who can't us the terms "hacker" correctly and who waive their hands in the air about "cyber attacks."
For morons, in other words.
I agree... anyone who waives their hands is a moron. You can waive my hands from my cold dead (animated) body.
Re: (Score:2)
I agree... anyone who waives their hands is a moron. You can waive my hands from my cold dead (animated) body.
Anyone that waves their hands about, in an enclosed space such as a train or a bus, whilst talking on a phone, is beyond moron.
Re: (Score:1)
*whoosh*
But yeah; that's due to the talking on a phone part. People need to waive their phone use prior to waving so they don't make waves.
Re:Hard-Coded? (Score:4, Interesting)
If the implications are that it can be changed by modifying the default settings, its not really hard-coded, is it ?
FTFS:
Unless the default settings were altered during deployment, impacted systems are using a known key
You missed an important bit there. It's very probably stored on an EPROM or SD Card, requiring physical access to the DASDECs. Some of my employer's products are used in the same market (local TV stations) and that's a pretty common method of configuring equipment for a particular customer.
Hard-coded, as in: Yes it's code, but there's no external interface protocol which permits changing the keys. In order to alter it, you have to remove the unit from the rack, take the cover off, and then you can upload a new config file. More recent products use external USB ports, but I bet these DASDECs are older than that...
Re: (Score:2)
What moron decided to use the same key on all of them is my question. If it is really on EPROM then you really need to avoid stupidity like this since it is harder to change later.
Re: (Score:1)
Pre-internet when this was built that wasn't stupid thinking. It was called redundancy. Yes it should have been updated.
Re: (Score:2)
SSH came about sometime in 1995 or later. The Internet, regardless of when you want to consider it "invented", predates that considerably. DASDEC products didn't come about until 2004.
There is ZERO reason to key them all the same.
Re: (Score:2)
It was updated. FTA:
According to an advisory from the company, most (but not all) of their customers have installed the updated firmware.
The problem is getting customers to do the update. In typical egocentric Slashdot fashion, many posters will sanctimoniously say that they do daily checks for security updates or whatever. The problem is that they forget that broadcasters, and many other folks, have a lot of things to worry about in addition to Internet security. Maybe the answer is just to take stuff like this off the Internet. They had ways of handling this before it was popular to connect everything including your toa
Re: (Score:2)
There is also another reason...
You haven't worked for a state agency before if you think the "customer" is the emergency management team. It is the IT departments that have control of all the equipment as well as have the responsibility for its maintenance and upkeep.
Having said all that, is it really the job of even the IT department to fix a flaw in equipment supplied by a vendor? Or is it the job of the vendor (who usually has a maintenance contract for it) to do that fixing?
Re: (Score:2)
What moron decided to use the same key on all of them is my question. If it is really on EPROM then you really need to avoid stupidity like this since it is harder to change later.
Vendor: "But it's perfectly secure because we promise to keep the key safe!"
PHB of whatever government department: "I see no problem with that"
Re: (Score:1)
Bee Doe! Bee Doe! Bee Doe! (Score:2)
Yep, I'll suddenly get more emergency alerts over my satellite radio, for whatever reason they do them now.
Warning purple fuzzy minions attacking everyone on Earth!
Ok... that one would make sense as it isn't location specific.
Re: (Score:2)
And don't forget your cellphone. The problem is the weather service sends out stupid alerts I don't care about and I have no way to filter them. I have a weather radio at home and I never turn it on because it goes off at least once a week at 3am with "Thunderstorm warning!!!!" Ok, yea, as if the thunder and my panicking dog didn't already alert me to that. Then there's the flash flood warnings. I live on high ground, and work on the 6th floor of a highrise and even if I didn't what the hell am I supposed t
Re: (Score:3)
At least they chose an obviously fake alert. Imagine if they had announced a terrorist threat to a major sporting event. They could have easily caused a mass panic with thousands of casualties. This is why we must take cyber-security seriously. Specifically:
Re: (Score:2)
Reality is not a disaster movie. In real disasters people are surprisingly sensible.
Re: (Score:2)
That's why provoking a mass panic by faking a deasaster could be even more evil that the deasaster itself....
Say no to drugs! (Score:2)
Misdirection (Score:5, Funny)
I think this is just misdirection and cover up.
'Earlier this year we were shown an example of an intrusion on the EAS when the Montana Television Network's regular programming was interrupted by news of a zombie apocalypse. Although there was no zombie apocalypse, it did highlight just how vulnerable the system is,
How do we know there was no zombie apocalypse. Maybe they're just claiming a vulnerability to pretend the apocalypse was a fake. When was the last time you talked to somebody in Montana, would you even know if it'd been overrun ?
Re:Misdirection (Score:5, Funny)
Plausible.
Most people when meeting somebody from Montana wouldn't be able to tell if they are "living" or "living dead".
Re: (Score:3)
I lived in Montana for a few years in my youth.
I can confirm that I was like unto the undead during that period. It was living death, except colder in the winter.
The only living thing there is cattle, and that's only because you can't market zombie beef yet.
Re:Misdirection (Score:4, Funny)
They only got 4 calls about the alert.
That was a full 50% of their audience.
Re: (Score:2)
I just got back from Montana. No need to worry, all the zombies are just fine. We just let them loose from time to time to eat all the Californians that keep showing up..
Interesting idea. Can we borrow some of you zombies for my state?
Re: (Score:2)
Everyone knows that so-called "Montana" is just a ridiculous liberal myth.
Re: (Score:3)
If Montana was overrun by Zombies would anyone care?
Now if Hannah Montana was fighting off a zombie invasion, maybe with a chainsaw, that would be a great film.
Re: (Score:2)
More to the point...what is the criticality in your life that Montana has been over-run. As In: Montana has been over-run by a Zombie Apocalypse. This affects your life exactly...HOW?
Sure, that is what they are saying (Score:2)
So this is the cover story they are using this time?
I guess they need some way to explain it away. Just like the Chinese did with SARS to keep people from finding out the truth.
hardcoded secrets (Score:2)
"bad form"? it's just security-through-obscurity. it's tempting to try to enumerate some ground rules for security (like "never hardcode a secret"), but if someone is violating these sorts of commonsense rules, would they ever read such a list?
Re: (Score:1)
FAST
GOOD
CHEAP
choose two
The "hack" earlier this year was not a hack. (Score:2)
They found the freaking phone number that these units still use to make brain dead Government officials able to use it. IT probably had a easy to guess 4 digit password.
seen any publickey scanning? (Score:2)
normally, any system on the internet will receive lots of bruteforce ssh scans, using password authentication. I wonder if this botch means that Bad Guys will be scanning with publickey as well. (obviously, the set of known and interesting private keys is much less effective than the usual catalog of common passwords...)
Otherwise known as (Score:2)
id_nsa.pub
for fucks sake people (Score:5, Informative)
It's really not that hard.
The fact that an emergency services network has been left in a state like this is bordering on.... no, IS criminal negligence.
Re: (Score:3)
Re: (Score:2)
It's unlikely those decision makers are the same people who hard-coded an ssh key into the device. They don't even know what ssh is.
Re: (Score:2)
Re: (Score:2)
All things being relative, this is a government contract/project, so I guess we should feel lucky it wasn't open port 23 telnet with a null password. Therefore, they'll probably get a reward for using that newfangled SSH encryption stuff (circa 1995, but who's keeping score?)
Re: (Score:2)
well.. they could spend the money either on tapping your daughters video chats OR for training people responsible for these systems, they didn't have money for both and tapping the skype feeds was easier so they went with it.
Re: (Score:3)
There is no security reason to move SSH to a different port. It's dead easy to work out what port it's on as it has a clear banner. VPN and ipsec are not more secure than SSH and often cause more problems as they can bridge trusted to untrusted networks.
If you want to setup SSH right:
Turn off all password authentication.
Turn off everything else in the config you are not using, like host based and kerberos authentication.
Use big key lengths.
Check you only have current and correct keys in authorized_keys
Limit
Another one gets it wrong (Score:2)
Thus I see your "Turn off all password authentication" as stupid and dangerous advice since it will be read by every ssh newbie (and a lot who are not newbies) as meaning not to use a passphrase on the key. If you are going to mention passwords at all you need to make that clear, otherwise you are setting people up for an easy attack
Re: (Score:2)
Password auth in SSH and password protected keys are two entirely different things - password auth on your key is a client side thing; to enforce key use you turn off password auth in SSH. Unfortunately, I'm not aware of a way to enforce password protection on private keys on the server end. So your options are to generate the private key with the user under supervision or via a script or such which forces them to supply a passphrase.
It is also why you also block access to networks you don't know and p
Re: (Score:2)
Re: (Score:2)
I refer you again to the line about keeping current keys in authorized keys and again to the fact you should not be allowed to managed anything more important than a pocket calculator.
Re: (Score:2)
Re: (Score:2)
Don't take criticism well do you?
It's not that, I just don't take ignorant fools who think they know what they are talking about well.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Obviously that is not going to help in any way at all until it's already been revealed that the key is stolen - most likely by somebody using it to get in and create some sort of incident.
If I'm not fit to use a calculator by spotting these things that you are not then where does that leave you? Not fit to brush your teeth without risking an accident or something? You are better with the insults than with ssh so I'll leave it up to
Re: (Score:2)
I never said leave your car unlocked with the keys in the ignition, that doesn't mean I'm advising people to do that. I really hope you don't manage anything more serious than your home system because you don't have a clue.
'Check you only have current and correct keys in authorized_keys' means getting rid of keys that have, or may have, leaked. I never said don't use passphrases but ultimately you can't trust them because you can't trust users to do the right thing.
Re: (Score:2)
I didn't insult you for your bad advice so lay off the childish bullying insults on the messenger. Do you really think I'm so insecure as to take you seriously, and do you really lay the boot in so rudely to peo
Re: (Score:2)
I'm not talking about moving it to a different port. I'm talking about blocking port 22 inbound using your firewall or hosts.allow, except for a specific set of management IPs that are preferably on the end of an IPSEC tunnel or other VPN service. If not, at least reduce the IP space that is allowed to hit that port to a well defined set of IPs that you either own or at the bare minimum belong to the ISP you use. There is ZERO reason to be listening on port 22 for connections from say, China or Russia!
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
We rot13 out keys, nothing could be safer I tell you!
Semantico-linguistic glitch (Score:2)
Stating the obvious (Score:2)
We have potentially thousands of these devices in the field that were deployed with the default factory configuration? That's security 101 -- Don't go with the factory settings. I haven't looked up the manual for these devices so I can't say how difficult it is to change the "hard coded" SSH keys but apparently the article suggests that it is possible to generate and deploy your own SSH keys provided the sending station(s) have the public keys required to encode and send these broadcasts. It requires quires
Re: (Score:2)
UPDATE
Check out page 29 and 30 of the manual. They include a method to push updated SSH keys out to other DASDEC devices. So it isn't as complicated as I first assumed.
http://www.digitalalertsystems.com/pdf/DASDEC_II_manual.pdf [digitalalertsystems.com]
really? (Score:2)
Although there was no zombie apocalypse...
oh, phew. thanks for that.
Can use this as an example (Score:2)
If someone gets the key it should never be enough to let them into anything other than trivial systems where it doesn't matter who has access.
Wait, (Score:1)
there was no zombie apocalypse!?!