3,800 Vulnerabilities Detected In FAA's Web Apps

ausekilis sends us to DarkReading for the news that auditors have identified thousands of vulnerabilities in the FAA's Web-based air traffic control applications — 763 of them high-risk. Here is the report on the Department of Transportation site (PDF). "And the FAA's Air Traffic Organization, which heads up ATC operations, received more than 800 security incident alerts in fiscal 2008, but still had not fixed 17 percent of the flaws that caused them, 'including critical incidents in which hackers may have taken over control of ATO computers,' the report says. ... While the number of serious flaws in the FAA's apps appears to be staggering, Jeremiah Grossman, CTO of WhiteHat Security, says the rate is actually in line with the average number of bugs his security firm finds in most Web applications. ... Auditors were able to hack their way through the Web apps to get to data on the Web application and ATC servers, including the FAA's Traffic Flow Management Infrastructure system, Juneau Aviation Weather System, and the Albuquerque Air Traffic Control Tower. They also were able to gain entry into an ATC system that monitors power, according to the report. Another vulnerability in the FAA's Traffic Flow Management Infrastructure leaves related applications open to malware injection."

Comments

Re:Just read through the PDF

[Roadkills-R-Us]

They do mention a compromised domain controller, which suggests (though doesn't guarantee) Windows.

They also mention DOT, which I believe is heavily into Windows.

In the late 1980s I know there was some UNIX/X11 development going on for ATC in Germany, but I never heard whether it went big time in Europe, much less in the USA.

There are some references on the net from 2007 or so that the FAA was switching from Win to Lin, but I'm not sure what systems those were, or if it really happened. They could easily run a mix of UNIX, Linux, Windows and others on the back end, and mostly Windows on the front end.

Finally, the ATC systems probably run RTOS or a real-time UNIX.

Different Article; Same Report

[Rary]

Sounds vaguely familiar...

Note that, although this is not a good thing, we're not actually talking about the ATC system here. We're talking about administrative web applications that employees can access from home, web sites that provide information about air traffic services to employees and to the public, power monitoring applications, things like that. Some are pretty serious, but most are not that serious. And none of them are the ATC system itself.