Slashdot Mirror
No Zombie Uprising, But Problems Persist With Emergency Alert System
chicksdaddy writes "More than six months after hacked Emergency Alert System (EAS) hardware allowed a phony warning about a zombie uprising to air in several U.S. states, a security consulting company is warning that serious issues persist in software from Monroe Electronics, whose equipment was compromised in the earlier attack. In a blog post, Mike Davis of the firm IOActive said patches issued by Monroe Electronics, the Lyndonville, New York firm that is a leading supplier of EAS hardware, do not adequately address problems raised earlier this year, including the use of 'bad and predictable' login credentials. Further inspection by Davis turned up other problems that were either missed in the initial code review or introduced by the patch. They include the use of “predictable and hard-coded keys and passwords,” as well as web-based backups that were publicly accessible and that contained valid user credentials. Monroe’s R-189 CAP-EAS product was the target of a hack in February during which EAS equipment operated by broadcasters in Montana, Michigan and other states was compromised and used to issue an alert claiming that the 'dead are rising from their graves,' and advising residents not to attempt to apprehend them. CAP refers to the Common Alerting Protocol, a successor to EAS. A recent search using the Shodan search engine by University of Florida graduate student Shawn Merdinger found more than 200 Monroe devices still accessible from the public Internet. 66% of those were running vulnerable versions of the Monroe firmware."
It's no longer just an uphill battle trying to make things secure - we've lost the war.
Time warner cable recently "upgraded" several of our analog cable channels to the basic digital tier which now requires a digital adapter. Unfortunately some of these are local stations that I watch regularly, so if I want to watch them I need the adapter, and using the adapter is mutually exclusive with regular analog cable without running a convoluted system of splitters and coax. Now after "upgrading" with the free digital adapter it's been *incessant* EAS tests and bogus alerts, sometimes going off every hour for days at a time, and the people at TWC can't or won't even attempt to fix it. This is annoying enough, but during one of these swarms of false alerts there was a REAL alert of a TORNADO in the area that ended up doing a lot of damage nearby. TWC's stupid mismanagement of the EAS system has completely undermined the use of the system itself. Bastards. Rant over.
I, for one, am looking forward to the inevitable
It's funny, I was going to say that I hope there isn't a REAL zombie uprising or we'd all be sitting around so complacent; and then you kill my joke with an actual life-threatening account...
Give that shit to a private contractor if you want it done RIGHT.
Damn you, Bass Monroe!
What if it was real zombies, the government testing some sort of containment protocol, and subsequent cover-up?
This is a non-issue that they probably have spent hundreds of thousands of dollars on so far and want more money to fix. More studies, network security, login keys, blah, blah...
Last time it was zombies and we kind of know that to be fake when we hear it. Next time it might be something serious like a nuclear reactor meltdown and people will flee. Maybe it will be secure enough to prevent the average hacker from getting in, but what if the hacker turns out to be an expert team of special agents from another country? We don't have to consider if they have a motive for doing so because they might have a motive we will never figure out, at least not in advance.
When will people in charge realize that the only way to keep a system secure is to deny it access to the internet? This includes indirect access like access to computers with access to the internet. Trying to secure the software is a bit like detective series, except the detective have to solve the murder before it happens and then take action to prevent it. He would fail as he might catch 500 out of 501, but he did miss one.
1. ``i am not secure, but i want to be.''
2. ``ignorance will not make me more secure''
3. ``no product available will make me completely secure''
4. ``if i cannot understand the entirety of my system, i can make no claims to it's security''
5. ``just because knowledge is denied, does not mean that knowledge is protected.''
6. ``i am not secure, but i want to be.''
If the chinese attacks, I won't know until all mcdonalds are switched with PF Chang and churches are replaced with assembly factories.
NOAA Weather Radio should be receivable anywhere in CONUS and there are decent radios to be had (that will activate automatically during severe weather events) for less than $50. Something worth considering.
As far as the asshats at TWC, have you considered going OTA-only or at least OTA for your local channels? If you're lucky you have a local station with a good weather operation that will go above and beyond the EAS reporting -- one of our local stations preempted NBC for the better part of an hour when we had a tornado earlier this year -- but even if they don't you'd still be assured of getting the EAS alerts.
Check out TV Fool and AntennaWeb as starting resources for determining if OTA reception is feasible from your location and what kind of antenna system you would need to make it happen. As an added bonus, you'll get a far better HD picture than anything Time Warner is sending down their pipe, they compress the hell out of their digital channels.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
No need to get the bought off politicians to fine them when you can simply stop doing business with them. Cable television is not a life essential service. One month of your cable bill is likely enough cash to purchase everything that most people would need for solid OTA reception.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
... is when your message me and a 6 million others at 4 in the morning because some kid (white) is missing.
Do your fucking jobs, assholes. Next time you message me, you are agreeing to the updated ToS that you will find in your inbox next week. Each message I receive will cost you a $1000. Is it worth it?
Scratch that, let's make it $10K.
Law is fun.
test made me turn on the radio not the TV at night.
The Zombie Warning Was Legit, they've just decided that they want to cover it up now. Nuke the site from orbit..... its the only way to be sure.
They need MyCleanPC!
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Hey, if it's good enough for the pentagon...
Confucius say, "Find worm in apple - bad. Find half a worm - worse."