Slashdot Mirror
3,800 Vulnerabilities Detected In FAA's Web Apps
ausekilis sends us to DarkReading for the news that auditors have identified thousands of vulnerabilities in the FAA's Web-based air traffic control applications — 763 of them high-risk. Here is the report on the Department of Transportation site (PDF). "And the FAA's Air Traffic Organization, which heads up ATC operations, received more than 800 security incident alerts in fiscal 2008, but still had not fixed 17 percent of the flaws that caused them, 'including critical incidents in which hackers may have taken over control of ATO computers,' the report says. ... While the number of serious flaws in the FAA's apps appears to be staggering, Jeremiah Grossman, CTO of WhiteHat Security, says the rate is actually in line with the average number of bugs his security firm finds in most Web applications. ... Auditors were able to hack their way through the Web apps to get to data on the Web application and ATC servers, including the FAA's Traffic Flow Management Infrastructure system, Juneau Aviation Weather System, and the Albuquerque Air Traffic Control Tower. They also were able to gain entry into an ATC system that monitors power, according to the report. Another vulnerability in the FAA's Traffic Flow Management Infrastructure leaves related applications open to malware injection."
Gonna hack into the FAA's site and arrange for some low fly-bys of New York city so I can take some nice pics. I'm sure no one will notice.
Something perhaps the federal government needs. A pool of IT professionals that are available to all federal agencies, with the full range of clearances to keep critical, and not so critical, networked government information and hardware safe from ill-intentioned eyes.
I saw no mention of how they are using Windows or if they are using Windows at all. Under the recommendations, they made no recommendations to stop using Windows at all.
... and here we have people worried about exploding shoes and finger nail clippers.
no
As a security engineer(CISSP&CSSLP) with several years of experience in C&A and pen testing, I must say that the results aren't a surprise by any means. What I DO find disturbing is the amount of detail provided in a public report given the fact that the FAA has yet to fully apply it's remediation strategies for the vulnerabilities identified. Is there any info as to what tools they used for app testing? My experience shows that tools such as App Detective and Web Inspect actually inflate the number of findings. This is due to the fact that the applications identify vulnerabilities by instance and not by category/type.
The PDF report itself tests for the 3801st vulnerability.
Jeremiah Grossman, CTO of WhiteHat Security, says the rate is actually in line with the average number of bugs his security firm finds in most Web applications.
Oh, well that makes it OK then.
After all, when a Chinese or Russian hacker out to prove a point wreaks havok by exploiting one of these, they can always just say "Don't worry, we're no worse than blogger.com!"
As someone else mentioned and as I implied in my response about their obvious ineptitude in the previous slashdot story: Why are critical systems directly available through the web?
Using Windows? Sheesh, if they were serious about security at least install something like OpenBSD, or perhaps even OpenVMS.
It all fits though with their inability to see their own flaws because of a general 'we are superior' attitude that's present in most areas connected with air-travel.
For dutch readers, webpages on this and more on the subject of behaviour of people (in dutch organisations such as Schiphol, NLR, LVNL, and areas of the government that deals with air-traffic) see:
http://www.xs4all.nl/~swhs/kritiek/schiphol/index.html
Yeah, they're using windows without the .exe/.dll loader component.
Who builds the FAA web apps?
You didn't REALLY think Bush was serious about making America secure, did you?
It was all a joke! That's what the TSA "security performance theatre" is all about!
Tell me you weren't laughing when they ACTUALLY made you take off your shoes?
I would just build a CIP device to give access to all our nations infrastucture via a hardware interface. As long as Sengala doesn't screw with it, we should all be fine.
What apps? What vulns?
Surely they've all been fixed/replaced by now (if not, why not?), so why not let the rest of us know what was discovered?
Does that make you feel unsafe? How about the fact that all the guys hired after Reagan fired the ATCs for striking are retiring en masse right now? I guess the bright side is when the new guys show up, they'll raise hell about the Rube Goldberg computer system in operation now. "Hey, I can write an iPhone app that would do a better job than this old PASCAL program ..."
it is Air Traffic Control. They need those big gaping holes so they can fit the planes into the tubes...
Why does the FAA have web based air traffic control applications?!
Coder's Stone: The programming language quick ref for iPad
Sounds vaguely familiar...
Note that, although this is not a good thing, we're not actually talking about the ATC system here. We're talking about administrative web applications that employees can access from home, web sites that provide information about air traffic services to employees and to the public, power monitoring applications, things like that. Some are pretty serious, but most are not that serious. And none of them are the ATC system itself.
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
At least that's what happens in every automated security scanner audit I've seen. Of course, that CSS report often doesn't reflect that the input was accepted but cleaned- rendering it harmless- by the webapp, or that the css content is only shown back to the user who inputs it...ooo, you can hack yourself! Or the best one- the input is supplied by an authenticated user in an otherwise secure environment- meaning the bigger issue would be that an authenticated user's account was hacked and used to insert CSS attacks. The horse is already out of the barn...but lets close the barn door...
I'm sure # 3800 was "app server supports TRACE method" or "web server reports server version in response". Both incredibly dangerous- enough so to keep app security auditors in business until they think up other low risk things to report on.
It amazes me at some people's ignorance towards security.
Einstein - "Only two things are infinite, the universe and human stupidity, and I'm not sure about the former."
Scan Complete!
423,827
Viruses Found!
A New Record!!
"Waaugh! That is not a small number!! That is a big number!!! What'm I gonna do?!"
This is my sig. There are many others like it, but this one is mine.
Newsworthy? Yes. Should it be reportable? No. One of the biggest problems in reporting stories like this is the fact that the information is now OUT THERE. FFS, it's pretty dumb to put this information in the public press. "Hey! Terrorists! You want to know where our vulnerabilities are!? We've just finished the report, so here you go!" I don't believe in censoring press... but doesn't common sense kick in at some point? Fix the vulnerabilities FIRST!!!
So, when they say this isn't out of the ordinary, what they mean is "it's got more holes than Swiss cheese, but that's OK, because *everything*'s got more holes than Swiss cheese"?
Thanks for putting that into perspective, guys. I'm feeling much safer already. :)
(Sorry for the self-reply, but I wanted my two points to be independently moddable; this'll probably get modded OT, but I got karma to burn...)
Speaking of computers and technology in pop culture, I've recently watched Die Hard 4.
In general, it's everything we hate: overblown graphical interfaces ("tracing $BADGUY, [$n percent progress bar]"), interfaces that work the "wrong" way (when your box gets hacked, the screen goes fuzzy like a TV with poor reception), nonsensical terminology ("it's a E-bomb!").
But! It has one redeeming quality; Mr. Nerdy Sidekick described cryptography as "Math-based security". That's a phrase that's handy for talking to non-geeks ("the washed masses"? :D)
It points in the general direction of the application of cryptography, "security", and it says something about what cryptography is (or contains), "math[-based]".
And since cryptography requires math which most people haven't learned anything about, if people start to speculate "so how can you secure stuff with math", in the two seconds or so they can do it during a conversation they're not going to come up with something wrong which they don't know is wrong---they're going to come up with nothing, making them ask "so how can you make security with math?".
Thus, saying "math-based security" gives you an opportunity to give people only correct ideas about what you do, and in as much detail as people want to hear about.
Some vulnerabilities have been known for years.
No enforcement of basic IT security.
Connecting ATC systems to non-ATC networks.
Allowing access to the FAA WAN by foreign nationals.
Allowing unlimited vpn access to FAA networks.
Organizations that simply don't comply with security policies.
davecb5620@gmail.com
The solution is obvious
"I set up a logger on my website and asked a big security firm to demo their own automated web assessment tool on my website. I received a report of some hundreds of vulnerabilities. Needles to say not one of them was correct"
What was the name of this big security firm, the name of the web assessment tool and the name of your site. And how does this affect the validity or otherwise of the FAA report?
Where does it say they were using FreeBSD
'if you store passwords as plaintext instead of hashes and secure data in plaintext, you will run into problems (TFA: "...hackers had the ability to obtain more than 40,000 FAA user IDs, passwords, and other information used to control a portion of the FAA mission-support network.")'
Where does it say they were using plaintext passwords. According to the FAA report they installed malicious codes and an administrator's password.
"
"
.. PHP, JSP, ASP, ASP.NET, Ruby, Perl or whatever, if you program poorly, you're going to have problems"
"Microsoft may not patch in a timely manner, but it doesn't matter what platform you're running if you don't apply the patches
Where does it say a poorly patched PHP, JSP, Ruby, Perl or whatever app was the cause of the vulnerabilities?
"As a security engineer(CISSP&CSSLP) with several years of experience in C&A and pen testing, I must say that the results aren't a surprise by any means"
Any 'security engineer' who is responsible for such a system should be fired and face criminal charges. The average ISP has better security.
I would love for Obama to step it up a notch and force these guys to adopt better policies for their ATC units.
This is the question I'm really interested in... are the machines in question (particularly those actually involved in ATC) connected to the internet? If the machines can be hit from the internet, this is a giant problem. But if you have to start with physical access to the network because it's physically isolated from the larger internet, that's not nearly as bad. You still have to worry about an "inside job", but that's a lot less likely than an attack from outside. TFA didn't make it clear whether the auditors hit the machines from the internet, or started with access to the actual network in question.
I work for a defense contractor, and in every contract where I've been a part of the bidding process, yes, cost is a factor... but it's explicitly the least important factor. It comes in behind past performance, demonstrated ability to do the work, etc. I'm not sure how the government selected contractors in the past, but these days, cost is only part of the answer, and not necessarily the biggest part.
I'm the last person to defend a federal agency, but if you run any large application through something like Fortify this will happen and this is 70 applications being tested for the first time.
High and medium vulns need to be addressed very quickly, and there were 1267 of those. Of those, 381 were on public facing systems. The remaining were "low" which are often things like "your server appears to be running Apache" or on internal systems, which while bad, is not as bad as stuff in your DMZ.
This headline is just a wee bit sensationalist.
7.63 highs per web app is not bad for the first run through, it's 100% average. Some of the apps are probably 10 years old to boot.
I don't care how good you think you are, I'll find something if I test your app. Getting your stuff tested, coming to terms with this and fixing it is *what is supposed to happen*. The fact that there are vulnerabilities on an untested app is like saying there's water in the ocean, and is almost as surprising.
I come from a code security background, and what the testers found is about as surprising as the sun coming up.
I think the *real* issue, and the one people should be fired over, is why did they wait til now to start pen-testing them and looking for code security issues?
Boggles the mind...
Realistically they need to be doing this once per quarter. I guarantee you they'll find something every time they test.
-Viz
Don't kid yourself. It's the size of the regexp AND how you use it that counts.