Local Emergency Alert System Hacked, Warns Dead Rising From Graves

First time accepted submitter Rawlsian writes "Great Falls, Montana, television station KRTC issued a denial of an Emergency Alert System report that 'dead bodies are rising from their graves.' The denial surmises that 'someone apparently hacked into the Emergency Alert System...This message did not originate from KRTV, and there is no emergency.'"

Comments

Re:Let me guess...

[JJJJust]

If it was a Common Alerting Protocol-enabled system, it was entirely designed to be on the internet.

Capture of the broadcast

[beanfeast]

Supposedly this is the capture of the hacked broadcast: http://www.youtube.com/watch?v=nc60XPCXrh8

Re:find him, prosecute him

[TWX]

Nah, he did a community service by demonstrating the failure without starting a panic over a real possible event. No one should have believed it.. At least not anyone with half a BRAAAAAAAAAAIINSS!!!!

Re:find him, prosecute him

[LordLucless]

On the contrary.

This is an obvious prank, and is unlikely to cause any harm, except to embarrass those who ought to be embarrassed. It would have been much more harmful to send an alert about a more believable disaster. Can you imagine the panic if the hoax had been about rising floodwater, or an incoming storm or hurricane?

This hack has the benefit of exposing a weakness before it could be maliciously exploited, in probably the only way that guarantees action will be taken. As we've seen, being a good white-hat and reporting the potential security is likely to result in you being prosecuted, and the fault being swept under the carpet.

yeah right

[bitt3n]

This message did not originate from KRTV, and there is no emergency

those are some wily zombies

Re:find him, prosecute him

[Greyfox]

Not cause any harm? It won't be so funny when the dead start rising from the grave and no one believes it because this guy cried wolf already! Thousands of people will disregard the warning and subsequently get their brains eaten! It won't seem so fun then!

Full Recording of the Alert on KRTV

[AbsoluteXyro]

https://www.youtube.com/watch?v=I28e0IqIgPc -- KRTV out of Great Falls, Montana.

Re:find him, prosecute him

[LordLucless]

Later studies suggested the panic was less widespread than newspapers had indicated at the time. During this period, many newspaper publishers were concerned that radio, a new medium, would render them obsolete. In that time of yellow journalism, print journalists took the opportunity to suggest that radio was dangerous by embellishing the story of the panic that ensued

The parallels almost write themselves...

Gentle reminder about security

[hessian]

I think these gentle reminders about security are great and are part of the spirit of hacking.

Which would the USA rather have: (a) goofball hackers create a zombie panic, or (b) our next enemy uses a coordinated attack to create actual panic?

Reminds me of the infamous "War of the Worlds" broadcast by Orson Welles.

typical.

[frovingslosh]

First the undead rise from their graves. Then the establishment covers it up. And it's not a coincidence that there are shortages and limits on ammo.

Re:typical.

[knorthern knight]

> First the undead rise from their graves. Then the establishment covers it
> up. And it's not a coincidence that there are shortages and limits on ammo.

Chinese infiltrators in the US government want zombies to survive, so that they can be enslaved into preparing food at Chinese restaurants... the project codename is "Dead Men Wokking".

Astonishing news!

[nigelo]

Amazing that this got through to the front page of /. in the same week that it happened!

Likely attack vector: NOAA weather radio

[Dr. JJJ]

This hack is clearly an invocation of the Emergency Alert System. The EAS is a hierarchically-organized digital message propagation system that has no authentication scheme for the vast majority of the nodes that participate in the network. Since every moderately-sized licensed broadcast radio and TV station in the United States is required to participate in the network, that is a lot of attackable nodes.

The hierarchy is easy to exploit if you wish to spoof an alert on a specific station. All you need to know is the specific list of stations that your target listens to for alerts and a mobile radio transmitter that you can position relatively closely to your target's EAS receiving equipment. The list of "source" stations for your target is often public information, or can be deduced very easily. (Search for "<city> eas plan" in your favorite search engine.) The radio transmitter required is nothing more than a VHF two-way radio, which can often be a "modded" Amateur Radio which can transmit outside of the legal Amateur bands.

• Step 1: Assemble an EAS alert on a computer using a little bit of code to generate the appropriate tones and an audio editor to stitch them together. The exact format is tricky, but the information is publicly available.
• Step 2: Find your likely target's listening list. These are often listed as the "Local Primary" and "Local Secondary" stations in your target's metropolitan area. These, unfortunately, are hard to spoof because broadcast-band FM and AM transceivers are harder to get a hold of. Instead, look up the NOAA weather radio transmission frequencies in your target's area. These stations are often used as additional EAS sources by almost every broadcast station in the system, and they are easy to spoof with portable equipment.
• Step 3: Put the spoof transmitter in a car and drive as close as possible to the target's published studio headquarters. Targets often place their receiving equipment in their primary studio locations.
• Step 4: Put your transmitter into transmit mode and play back your spoofed alert. You need to remain nearby just long enough to complete the injection process. With a short message you only need about 60 seconds.
• Step 5: Drive away. The automated relay system at your target will do the rest.

Step 4 (transmission) is extremely easy, even with low-powered equipment (250mW). Because of your proximity and the FM Capture Effect you will have no problem overpowering the real source station without adversely affecting or alerting anyone outside a 1/2 mile radius.

My guess is the attackers here did precisely this. They probably exploited this TV station by spoofing a local NOAA weather radio channel that the TV station was listening to for alerts.