Slashdot Mirror
3,800 Vulnerabilities Detected In FAA's Web Apps
ausekilis sends us to DarkReading for the news that auditors have identified thousands of vulnerabilities in the FAA's Web-based air traffic control applications — 763 of them high-risk. Here is the report on the Department of Transportation site (PDF). "And the FAA's Air Traffic Organization, which heads up ATC operations, received more than 800 security incident alerts in fiscal 2008, but still had not fixed 17 percent of the flaws that caused them, 'including critical incidents in which hackers may have taken over control of ATO computers,' the report says. ... While the number of serious flaws in the FAA's apps appears to be staggering, Jeremiah Grossman, CTO of WhiteHat Security, says the rate is actually in line with the average number of bugs his security firm finds in most Web applications. ... Auditors were able to hack their way through the Web apps to get to data on the Web application and ATC servers, including the FAA's Traffic Flow Management Infrastructure system, Juneau Aviation Weather System, and the Albuquerque Air Traffic Control Tower. They also were able to gain entry into an ATC system that monitors power, according to the report. Another vulnerability in the FAA's Traffic Flow Management Infrastructure leaves related applications open to malware injection."
Gonna hack into the FAA's site and arrange for some low fly-bys of New York city so I can take some nice pics. I'm sure no one will notice.
Something perhaps the federal government needs. A pool of IT professionals that are available to all federal agencies, with the full range of clearances to keep critical, and not so critical, networked government information and hardware safe from ill-intentioned eyes.
They do mention a compromised domain controller, which suggests (though doesn't guarantee) Windows.
They also mention DOT, which I believe is heavily into Windows.
In the late 1980s I know there was some UNIX/X11 development going on for ATC in Germany, but I never heard whether it went big time in Europe, much less in the USA.
There are some references on the net from 2007 or so that the FAA was switching from Win to Lin, but I'm not sure what systems those were, or if it really happened. They could easily run a mix of UNIX, Linux, Windows and others on the back end, and mostly Windows on the front end.
Finally, the ATC systems probably run RTOS or a real-time UNIX.
As a security engineer(CISSP&CSSLP) with several years of experience in C&A and pen testing, I must say that the results aren't a surprise by any means. What I DO find disturbing is the amount of detail provided in a public report given the fact that the FAA has yet to fully apply it's remediation strategies for the vulnerabilities identified. Is there any info as to what tools they used for app testing? My experience shows that tools such as App Detective and Web Inspect actually inflate the number of findings. This is due to the fact that the applications identify vulnerabilities by instance and not by category/type.
The PDF report itself tests for the 3801st vulnerability.
Jeremiah Grossman, CTO of WhiteHat Security, says the rate is actually in line with the average number of bugs his security firm finds in most Web applications.
Oh, well that makes it OK then.
After all, when a Chinese or Russian hacker out to prove a point wreaks havok by exploiting one of these, they can always just say "Don't worry, we're no worse than blogger.com!"
Who builds the FAA web apps?
Karma be damned, but the use of Windows in a secure system is nowhere near as bad as not sanitizing your inputs on any system. No platform can just make up for bad practice. FreeBSD will happily allow someone to guess 'PASSWORD' as the login password (from TFA: "Software configuration involves setting up a software system for one's particular uses, such as changing a factory-set default password of "PASSWORD" to one less easily guessed."). If you're using Oracle DB, MS SQL or MySQL, if you store passwords as plaintext instead of hashes and secure data in plaintext, you will run into problems (TFA: "...hackers had the ability to obtain more than 40,000 FAA user IDs, passwords, and other information used to control a portion of the FAA mission-support network."). Microsoft may not patch in a timely manner, but it doesn't matter what platform you're running if you don't apply the patches (TFA: "...software with known vulnerabilities was not corrected in a timely manner by installing readily available security software patches released to the public by software vendors."). PHP, JSP, ASP, ASP.NET, Ruby, Perl or whatever, if you program poorly, you're going to have problems.
My UID is a prime number. Yeah, I planned that.
What apps? What vulns?
Surely they've all been fixed/replaced by now (if not, why not?), so why not let the rest of us know what was discovered?
Why does the FAA have web based air traffic control applications?!
Coder's Stone: The programming language quick ref for iPad
Mainly before it doesn't matter. These computers have a problems that are totally unrelated to Windows at all, such as easily guessable passwords, unpatched vulnerabilities and easily accessible passwords, unencrypted in the database.
Windows isn't the weak link here, and properly securing Windows isn't exactly rocket science.
Sounds vaguely familiar...
Note that, although this is not a good thing, we're not actually talking about the ATC system here. We're talking about administrative web applications that employees can access from home, web sites that provide information about air traffic services to employees and to the public, power monitoring applications, things like that. Some are pretty serious, but most are not that serious. And none of them are the ATC system itself.
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
No, it really doesn't secure it. Too many network based utilities require far too much privilege to operate, Internet Explorer is a sinkhole of security vulnerabilities, and autorun remains the default for CD's, USB's, and other detachable media. Proxies are like the Maginot Line of security: they provide a useful pretense at security, but only have to be pierced once to allow the invaders to overrun your internal network.
It only takes one newly installed laptop, exposed to the Internet while pulling down its first service packs and security software, to service as the staging point for all sorts of attacks.