Slashdot Mirror
Hacked Tornado Sirens Taken Offline In Two Texas Cities Ahead of Major Storm (zdnet.com)
An anonymous reader quotes a report from ZDNet: A hacker set off the tornado emergency sirens in the middle of the night last week across two North Texas towns. Following the unauthorized intrusion, city authorities had to shut down their emergency warning system a day before major storms and potential tornados were set to hit the area. The false alarm caused quite the panic in the two towns, as locals were already on the edge of their seats regarding incoming storms. The city had run tests of the tornado alarm sirens a week before, but the tests were set during the middle of the day and had long concluded. The two hacked systems were taken offline the next morning, and remained offline ever since.
Bad weather, including storms and potential tornadoes, was announced for all last week in the North Texas area. A severe thunderstorm hit the two cities the following night, on March 13. Thunderstorms are known to produce brief tornadoes, but luck had it that no tornado formed and hit the towns that day. Tornadoes are frequent in Texas, as the state is located in Tornado Alley, and tornado season, a period of the year between March and May when most tornadoes happen, had officially begun. Nevertheless, a tornado didn't form on March 13, and, luckily, the sirens weren't needed.
Bad weather, including storms and potential tornadoes, was announced for all last week in the North Texas area. A severe thunderstorm hit the two cities the following night, on March 13. Thunderstorms are known to produce brief tornadoes, but luck had it that no tornado formed and hit the towns that day. Tornadoes are frequent in Texas, as the state is located in Tornado Alley, and tornado season, a period of the year between March and May when most tornadoes happen, had officially begun. Nevertheless, a tornado didn't form on March 13, and, luckily, the sirens weren't needed.
It's times like that you kinda wish cracking/hacking carried the death penalty ...
From the second paragraph: "The incident impacted DeSoto and Lancaster, two cities in Dallas County, Texas --both suburbs located south of the main Dallas metropolitan area."
Given the target, it was likely some stupid kid.
The kids deserves at least six months in jail.
Unless you call the panhandle Texas, but since no one lives there, no one does. Oklahoma is thee tornado alley.
Texas is the largest real state in the nation.
I know I'm not adding to the discussion but this just brought my reading to a jarring halt...
"Thunderstorms are known to produce brief tornadoes"
Pray tell some other method knowing of producing tornadoes strong enough to risk life and property?
Why would anyone think it was good idea to set this off in the middle of the night? I suppose if this was an ISIS hacker I can see why they might. It would obviously be a good idea to have better security on emergency systems. But I find it a shame that it's even necessary. I would like think people would have the decency to not bother systems like this. But I guess when we're in an age where swatting is a thing it's not surprising.
will like to see where this goes.
For example, if some vandal spray painted the traffic light covers and make them useless, or drops a sackful of nails on a highway, he/she could cause huge damage. We don't immediately take DoT for not creating secure highways where vadals could not mess with traffic lights or strew nails on the road.
Invariably in almost all these incidents we keep blaming "the officials", "the authorities". And they instinctively develop CMA tactics. They don't do anything unless they can have a paper trail that lets them shift the blame to someone else.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
"Cracking", or "hacking"? In the latter case, you can basically start killing everyone because the definition is that nebulous.
Idle hands are the devil's plaything. Just remember that a lot of the misery in the world is caused by people doing stuff like this without any thought given to consequences. Justification for doing it? Selfish reason, because it's fun.
Sadly, a stupid stunt like this from some unknown party makes everyone's life harder.
Why?
A) blame games
B) You should have know games ( Defcon had a topic about this )
C) local government will raise taxes to cover the repair and security of the system.
So people will get extremely tough and demand harsher punishments for criminals if ever caught.
it's getting worse.
if you see me, smile and say hello.
I know its not impossible but how in the bloody hell can a system like that be hackable ? Read those papers and I saw no info on that or how the system works.
...but this was probably a test by one of the "big 3" cyber threats to the US (China/Russia/N. Korea). Emergency systems and ICS are ideal targets in cyber warfare.
Somewhere someone doesn't know it yet, but they are going to get the book tossed at them. We have a whole host of natural disasters that can hit, and for all of them seconds count. Almost everyone gets a warning they can react to when it comes to tornados.
Should anyone lose their lives as a result of these systems being turned off, the culprit should get a manslaughter count for each one.
I'm all for ethical hacking, but this is no where near close.
-- botsex is {grep;touch;strip;unzip;head;mount}
You'd think the other cities in the area would have learned from this vulnerability and fixed the problem.
Believe it or not, it's not at all unlikely that word of the problem never got to the right people. And even if they were aware of it it's not axiomatic that they would be able to fix the problem. They might not have the budget or it might require coordination with (possibly uncooperative) other municipalities or it might be technologically impossible to "fix" the problem with existing equipment and budget. Stuff like this usually requires budgeting and possibly even taxpayer approval and doesn't tend to happen overnight.
Although that would require local governments to be competent.
Sigh... Just because not everything happens perfectly all the time does not imply local government is incompetent. Did it occur to you that the tech involved might be old and that the taxpayers haven't approved the money to replace the equipment? It's entirely plausible they don't have the resources to deal with the problem even if they are aware of it.
The meme that government is incompetent is really tired. No institution does everything perfectly, public or private. Just because they have a failure in one task it does not follow that they are generally incompetent. There are lots of things you don't do well either. Should we declare you to be incompetent every time you overlook something or don't handle it perfectly?
All they do is cause people to stop whatever theyre doing & go outside to gawk at clouds.
well if some died then they can get manslaughter change or more and in TX they like to do the death penalty
Leave a door open and it's only a matter of time until someone waltzes right in and takes a dump in the corner. If you leave unsecured systems out in the open, it's as good as declaring that you don't give a fig about what happens to it, it's no different from leaving physical property abandoned.
"Do the Death Penalty" - .you make it sound like a dance move.
Mother Nature has her own tornado siren.
It sounds like a freight train.
Kinda confusing if you are near a rail line but otherwise it's pretty distinctive.
Yeah, but do they have a HEMI in it?
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
I understand the movements are similar to the Polio Shuffle, which is also making a comeback in the ballroom of society.
Don't blame the hacking / cracking. Blame the insecure implementation.
The "kill the messenger" mentality is the underlying cause. Someone comes forward with a vulnerability, they are not taken seriously. Or if they are taken seriously, they are treated as a criminal who must be prosecuted. If not taken seriously, then they prove the vulnerability, which makes them a criminal.
Maybe it should be a crime to not seriously react to a provable vulnerability and get it fixed.
It's a good thing we can do both - work towards having more secure systems, and also prosecute those who play dangerous games with public safety equipment.
It doesn't matter how easy the firetruck is to hotwire (or even if the fireman left the keys in it), it's still illegal for me to jump in and take it for a joyride, or steal it. Doesn't matter if I say I was doing it to prove a point about how easy it is to do. I still can't do it.
I thought reasonable people had all left the internet long ago...
Everyone complains about government incompetence, but nobody wants to pay to have a competent government.
The vast, vast majority of the public alert systems in the USA were installed in the 1950's/60's. It's a dumb-simple system that has been hackable since then, too, using the same tools that are available now. The vast majority of the systems are RF based: It's simple carrier frequency that carries a particular pair or frequencies or a particular DTMF pattern that triggers the siren system. For my town, for instance, it's a carrier on 48.90mhz, and a 4-digit DTMF on the carrier, each one about 0.25 second long that tells the siren box what pattern to signal and how long signal it for. There's also a two-tone pair (about 1.4khz and 1.9khz) that signals the siren to stay on until it's signaled to turn off again.
The beauty of the system is its simplicity: it just works. No IoT bullshit, no computers being cranky, no downed wires matter. So long as the police station can broadcast the signal and the sirens have power, the system works. We've even tested it using a hand-held radio and two tuning forks, so in the unlikely event the police station was out of power or otherwise unuseable, we can still set the whole system off. Having a IoT, 256-bit AES 2xROT system would be useless if we're standing in the middle of a shitstorm and need to get the public's attention.
Disclaimer: am a volunteer firefighter and help keep this system running in our town
Chris Knight is my hero.
"Don't blame the hacking..."
"Don't blame the thief, blame the store owner for not installing titanium shutters and an auto-targeting laser defense system..."
"Don't blame the murderer, blame the victim for being a juicy target!"
"Don't blame the terrorist, blame the city for allowing people to just roam around, like some free country!"
Your final sentence has essentially no connection to your first sentence. And you have utterly failed to establish that these civil defense systems were in any way whatsoever, targeted by White Hats. Either before or during this attack. Or if they were, that White Hats were subjected to a "kill the messenger" mentality.
What a crap article ... 3 links ... one to zdnet which I block because they can't operate without a slew of external crap I don't trust ... one to Facebook, and one to Twitter.
I see we've given up on useful sources of information and are just linking shit to Facebook and Twitter.
The Slashdot editors really are fucking morons these days.
The majority of siren systems intentionally use wireless radio technology instead of internet connectivity to communicate as a security precaution, says Aaron Wolking, the national sales manager of Sentry Siren. To interfere with that set-up, a hacker would need the radio frequencies, code formats, and specific five to eight-digit codes to be able to access a particular siren system. The industry also offers widely used additional security protections, like the "continuous tone-coded squelch system," that keeps radios from from receiving and executing commands sent without additional access codes.
.
.
.
To pull off this weekend's siren episode, hackers would have needed extensive knowledge of the frequencies and codes used in the Dallas siren system to make them all go off at once. This could be particularly challenging, depending on the setup, because each siren might communicate with the control center independently, so officials have the choice of turning only one or a few of them on, or activating all of them depending on the situation. Dallas officials confirmed over the weekend that the breach came from within Dallas, because hackers would have needed to be physically close to the radio signals sent to each siren. They added that the commands to the sirens didn't come from their central control systems, something officials would naturally check first to see if the sirens had been activated by accident.
https://www.wired.com/2017/04/dallas-siren-hack-wasnt-novel-just-really-loud/
Anonymous comments are as pathetic as the anonymous "sources" that contaminate gutless journalism from the New York Time
If they're still using the electric chair, I'd imagine all they'd need to do is suspend the person and it could look like one too.
Everyone complains about government incompetence, but nobody wants to pay to have a competent government.
What evidence can you give to suggest that paying more (taxes/salaries) would improve competence?
It is not white hat activity if people end up getting hurt or killed "in the process of demonstrating your point".
That just makes you a dirt bag.
Please do not try again.
Who ever thought that it's a great idea to connect our Dams, Power grids, Nuclear reactors, ballot machines, weather warning systems, water supply system and shit like that to the internet, must be a god damn genius.
Aside from Democrats, Trump is in no way a traditional Republican candidate. Not exactly a "family values" guy, not someone who respects lessoned learned and is cautious about major changes. You could go down a little of what different Republicans tend to value and at least half of them, Trump is the opposite.
A LOT of Republicans don't care for Trump. Many disliked what Hillary would do to the country slightly more than they disliked Trump, so they held their nose and voted against Hillary, which meant marking "Trump".
As just one example, one of the top stories on Foxnews.com right now is:
DOUG SCHOEN: The world needs American leadership -- it's not getting it from President Trump
Im sure those brave Texans have all the guns they need to shoot the storm and their colors dont run so whats the problem??
When I worked as a 911 dispatcher from 2000 to 2008, we were responsible for activating the system. Unfortunately, it was by a simple, unencrypted radio system. It would sometimes go off because of stray signals, or even signals from far off transmitters that were coming in through tropospheric ducting. Way too many systems like this rely on obscurity for their security instead of encryption or hard wiring. Getting the right codes would require simple listening to the frequencies with a SDR during prior storm events, or, even easier, social engineering.
Beware of Sales Reps bearing gifts.
40% gives his job performance a thumbs up as opposed to a thumbs down.
So most think poorly, 40% think more positive than negative of his job performance.
Personally, my rating for "liking" the guy is a lot lower than my rating for his performance on the job.
CNN reports that 70% of Americans say (see) that the economy is doing well, and that probably factors very much into Trump's job approval rating. You can, as I do, dislike the man and also be literate in economics, seeing that things are going well.
For comparison, at the same point in his term, Bush Jr. had an 85% approval rating. So half as many people approve of Trump's performance Trump compared to Bush Jr.
So they aren't saying "he's great!" 40% say that what he is doing as president is slightly more positive than negative.
The radio frequencies are public, or can be identified using a basic scanner during a test. Many of these systems simply use DTMF "1 touch pad tone" for on and DTMF "2 touch pad tone" for off. If the control system is more complicated, the command sequence can be captured by GNU Radio during any pre-announced test. Sentry Siren is trying to convince cities that their cheap configuration is more secure that the even cheaper config they currently have ... when in reality it is brings very little additional security. Cities will always pre-announce their tests and it is unlikely that they will immediately change their codes after a test since that effectively invalidates the test.
"continuous tone-coded squelch system" may be offered, but does anyone use it? And it won't help much if someone decides to take their transmitter closer or use a high gain antenna since the hacker can transmit the continuous tone just as easily as the city can.
A replay attack would not require extensive knowledge of the frequencies and codes of the control systems.
The attacker even had advanced notice of when the control signals would be broadcasted. Nothing in that article suggests that an exact replay of the test signals weren't used, or couldn't be used.
I suspect that the same 90 second pattern that occurred during the hack was the same used for the announced test.