Slashdot Mirror
US Air Traffic Control System Is Riddled With Vulnerabilities
An anonymous reader writes: A recently released report (PDF) by the U.S. Government Accountability Office has revealed that despite some improvements, the Federal Aviation Administration (FAA) still needs to quash significant security control weaknesses that threaten the agency's ability to ensure the safe and uninterrupted operation of the national airspace system (NAS). The report found that while the "FAA established policies and procedures for controlling access to NAS systems and for configuring its systems securely, and it implemented firewalls and other boundary protection controls to protect the operational NAS environment [...] a significant number of weaknesses remain in the technical controls—including access controls, change controls, and patch management—that protect the confidentiality, integrity, and availability of its air traffic control systems."
C'mon now.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
I like riddles.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
The FAA is one of a very few government agencies that takes its job seriously and focuses on quality.
They're better than that. Surgeons in operating rooms are cribbing from the FAA for techniques and procedures to improve patient safety. The safety record of the airline industry is quite remarkable and the FAA deserves a huge amount of the credit for that achievement. I've worked as a quality engineer and whatever their other flaws might be, the FAA groks quality and safety as well as any organization I've ever seen.
I'd trust them to take IT systems security seriously and delegate the work to competent engineers.
As would I. The only thing I really worry about with the FAA is in keeping Congress from meddling with them too much. They are in my opinion one of the best run agencies in our government. That's not to say they don't have their flaws but on the big picture stuff, especially safety, they do a pretty good job overall even when they don't have all the resources they might.
Almost can't believe I'm saying this, but it would seem they have good workers.
Why should it shock you? We have many people in our government who are remarkably competent. I'd be happy to introduce you to some that I know personally. The FAA does not only have good workers but they have a safety first framework and have built a culture and procedures to support that. They also have the advantage of not being a political football for Congress to fight over. A good worker can be put into a system that doesn't work and chances are they will fail. Safety and reliability are NOT about competent people working hard. Those are important things but they will not get the job done unless you also have an organizational framework that supports them properly. The FAA has oversight over the entire process from certifying the airplanes before they even get built, to overseeing the ongoing maintenance and supply, to being able to force private companies to be grounded if they don't do what they are supposed to do when they are supposed to do it. They are able to get into all the corners of the industry that affect safety and they largely do a good job of ensuring that things are done properly like a regulator is suppose to.
And you can guarantee that that fiber can't be tapped between the end points? Just because a network is isolated from the Internet doesn't mean it's completely secure.
Almost everyone that has seen the systems in place have know this for over 2 decades.
It's a mess, an unholy mess that they really need to dump a couple billion into to do a full upgrade and redesign. The whole ATC system is a giant ball of bandaids.
Do not look at laser with remaining good eye.
I wonder how much that study cost.
Solving Unix problems since 1989...
Perhaps, but the FAA did actually manage to control physical access to that terminal fairly well.
All in all, my quick skim though the report tells me that where the FAA does have issues with security (Mostly with, network security, management of users and patches) they don't do that badly given their large size. They have similar problems to just about everybody else that has systems of similar complexity and by my estimation do better than average on just about all aspects of security. Given the "mission critical" nature of what these systems do and how complex the total system is things need to be better, but IMHO they are doing a bang up job now keeping aircraft from bouncing off each other in the sky.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
And for the most part, this is what the FAA does, or historically has done. Only recently they have started to phase out the 40 year old system that pre-dated the internet and move to IP based communications.
Also, I don't agree with your approach of just stringing up your own infrastructure for communications. IP networks can be built with LOTS of redundancy and using a couple of internet connections and routing your traffic over them can add huge redundancy gains with low cost. I think the FAA needs an "all of the above" solution, where it provides secure and redundant communications over as many different paths as they can. Nail up direct links, backup links over the internet, throw some satellites up with data link capacity, and even use direct RF links. Just don't depend on any ONE link for mission critical communications... Of course all these links need to be secure, but there are secure ways to tunnel though public channels, you just have to use them.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
is dealing with the malfeasance regarding 9/11.
Sure, these technical issues are very important and need to be addressed.
But all of these issues are moot if the diabolical, elite villains are still in power.
Even if the systems were patched and secure, they could still let another 9/11 happen if they choose to.
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
I really don't see that as a the most vulnerable point. Not by a long shot. Tapping a digital fiber link wouldn't be like US submarines tapping Soviet analog telephone cables. The data on the link can be encrypted and authenticated at either end such that it's not really practical to modify or impersonate without the kind of assets in the organization that would make an inside job a lot simpler.
The real problem is human factors. Air-gapping sensitive systems is a sound idea in principle but in practice it often fails because it's too cumbersome for users who then undermine the system. And Stuxnet showed that it's possible for a sufficiently advanced opponent to target systems of the far side of an air gap.
So the problem is with the notion that separate parallel systems separated from the outside world are a "simple" solution. They're a potential solution, but if you want to have confidence in that solution there's a lot of work analyzing and policing the behavior of the people who use, maintain, and produce the equipment.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
To take that a step further, attacking the people who have direct access to the network is harder. Instead, targeting the companies that supply the equipment is an easier vector. I may be wrong (and please correct me if I am) but wasn't Stuxnet infiltrated at the supplier of the computer equipment rather than by a successful compromising of an individual working directly on the system?
It won't be necessary to tap the fiber. Some moron will plug their smartphone in to their computer to charge it and that will be the end of the airgap.
www.wavefront-av.com
How it was initially deployed is known only to its makers, but Stuxnet was designed to enter an isolated facility on a USB drive. Once on the LAN it would propagate to other computers, and potentially to other networks via an infected laptop, which is how it ended upon the Internet.
You can use your imagination as to how they got the USB into the target facility. It might have been as simple as dropping the USB stick in the parking lot of a vendor, but given the resources needed to create the worm itself you can't rule out some kind of black bag job or human asset.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
I don't think we needed a report to know this. Last Octobers arson in Chicago was evidence that there are serious vulnerabilities with the FAA.
"Cyber-based threats to federal information systems such as those that FAA relies on for its ATC systems are evolving and growing .. Further, the growing interconnectivity among different types of information systems presents increasing opportunities for such attacks."
Just who in their right minds connect an Air Traffic Control system to the Cybernet?
That "one" facility controls traffic through one of the largest hub cities in the country. For some of the major airlines, if you can't connect through chicago, you can't get to about 75% of the rest of the country. So, yea, there's an argument about that...you dolt.
True on water as well. The ship's pilot is absolute commander.
I come here for the love
That's the trouble with very successful attacks that end up having unanticipated consequences. They leave behind enough evidence that the attack vector is now known and steps are taken to reduce vulnerability (to varying degrees of success). It works the first time but often not ever again, or at least not until people forget about it and get sloppy again.
That "one" facility controls traffic through one of the largest hub cities in the country. For some of the major airlines, if you can't connect through chicago, you can't get to about 75% of the rest of the country. So, yea, there's an argument about that...you dolt.
Put fault on the airline, not FAA.
mfwright@batnet.com