Slashdot Mirror
Emergency Alert System Insecure
glebe writes "The U.S. Emergency Alert System used to issue disaster warnings and other alerts over T.V. and radio is vulnerable to spoofing and denial-of-service attacks, SecurityFocus is reporting. Apparently, 'the EAS was built without basic authentication mechanisms, and is activated locally by unencrypted low-speed modem transmissions over public airwaves.' The FCC acknowledged the security issues yesterday in a public notice seeking comment on the future of the system."
Dear FCC,
Since you asked, I thought I would weigh in with my comments about The U.S. Emergency Alert System (EAS). I think it's appalling that anyone with a 14.4 could tap into this system and alter it for their own aims. The whole system could be crashed by terrorists during an attack, compounding the devastation of any terrorist attack by cutting off access to the system, or providing false and possibly deadly information. For example, during the 9/11 attacks the EAS could have directed people to return to their desks in the WTC, magnifying the losses suffered that day.
I suggest you rebuild the EAS and take it offline until such a time that it can be secure.
>... the EAS is designed to allow the President to interrupt television and radio programming and speak directly to the American people in the event of an impending nuclear war, or a similarly extreme national emergency.
With the audio capabilities available today, it would be quite possible to dupe the public into thinking they were listening to George Bush, when in fact they were listening to the words of Osama bin Laden. And with the stuff Bush has been saying lately, the public might actually believe it was Bush no matter how insane the babble was!
Somehow you would want to have a method for ensuring the audio was legit, encrypted and unaltered. I'm sure there are many ways to do this today, so I'm not really sure why you're asking me! Throw up a bunch of secure pipes and give the president access to them. Come up with a way to keep his message secure. Yeah, it's going to be expensive, but not as costly as 80,000 employees of the WTC returning to their offices because the EAS said it was "just a test".
Kind Regards,
Scott
The dangers of knowledge trigger emotional distress in human beings.
10 bucks for whoever can get all of Nevada to evacuate due to imminent flooding.
after a mysterious color purple alert was issued. Officials believe it was the work of slashdot user outraged at the horrible color schemes on the popular news for nerds website.
XML
to give you this emergency message: ``Are your mortgage rates skyrocketing? Are your sexual organs too small? Do you have more money than brains? You can solve all of these problems by purchasing SUPER-VIAGRA! . . . and something about a tornado.''
MOUNT TAPE U1439 ON B3, NO RING
Conan + EAS + Bush picture + manlips = endless possibilities...
If you have to ask, you'll never know.
...how long until primetime television is interrupted so that we may be informed that 'all your base are belong to us'?
Use this to replay a nation wide brown note. Also good fun. Buy stock in American Standard.
Oh my god! The russians are attacking!!!!!
Free Software: Like love, it grows best when given away.
I'm sure it's nothing Halliburton or Diebold can't fix for $400 Million via a no-bid contract.
If they went public with this, I'd bet good money it's a precursor to an already set up proposal from a well-connected contractor who wants to ride the wave of public fear all the way to ten times the cost of fixing it.
Somewhat maybe related... In high school we had those fire alarms that have the handle that you pull down to trigger the alarm. Well, as one of my unlucky (and stupid) friends found out; when you pulled the alarm a big blast of marking dye shot out covering your hand, arm, torso, face and everything else with a blue/black stain that was almost impossible to wash off. Needless to say he was found and busted within minutes of pulling the alarm.
This Emergency Alert System message would like to inform you that hakz0rz pWn j00 aLL. All j00R Em3Rg3ncy Al3rt sY5teM 4RE BeLoNG t0 Slashdot!
Its just a phase. I was insecure too when I was tht young.
________________________
Huh?
After all the slashdot publicity it'll be broke
Know your pads. One time pad: good for cryptography. Two timing pad: where to take your mistress.
Kids...Itchy and Scratchy can't be here today. But instead,
we've got the next best thing! It's the Stingy and Battery
show! They bite. And light. And bite and light and...yatta,
yatta, you know what I'm talking about.
Just build a big brightly lit sign with "Core explosion. Repent sins" -- that should make everyone nervous.