Slashdot Mirror
Hacked Tornado Sirens Taken Offline In Two Texas Cities Ahead of Major Storm (zdnet.com)
An anonymous reader quotes a report from ZDNet: A hacker set off the tornado emergency sirens in the middle of the night last week across two North Texas towns. Following the unauthorized intrusion, city authorities had to shut down their emergency warning system a day before major storms and potential tornados were set to hit the area. The false alarm caused quite the panic in the two towns, as locals were already on the edge of their seats regarding incoming storms. The city had run tests of the tornado alarm sirens a week before, but the tests were set during the middle of the day and had long concluded. The two hacked systems were taken offline the next morning, and remained offline ever since.
Bad weather, including storms and potential tornadoes, was announced for all last week in the North Texas area. A severe thunderstorm hit the two cities the following night, on March 13. Thunderstorms are known to produce brief tornadoes, but luck had it that no tornado formed and hit the towns that day. Tornadoes are frequent in Texas, as the state is located in Tornado Alley, and tornado season, a period of the year between March and May when most tornadoes happen, had officially begun. Nevertheless, a tornado didn't form on March 13, and, luckily, the sirens weren't needed.
Bad weather, including storms and potential tornadoes, was announced for all last week in the North Texas area. A severe thunderstorm hit the two cities the following night, on March 13. Thunderstorms are known to produce brief tornadoes, but luck had it that no tornado formed and hit the towns that day. Tornadoes are frequent in Texas, as the state is located in Tornado Alley, and tornado season, a period of the year between March and May when most tornadoes happen, had officially begun. Nevertheless, a tornado didn't form on March 13, and, luckily, the sirens weren't needed.
It's times like that you kinda wish cracking/hacking carried the death penalty ...
I know I'm not adding to the discussion but this just brought my reading to a jarring halt...
"Thunderstorms are known to produce brief tornadoes"
Pray tell some other method knowing of producing tornadoes strong enough to risk life and property?
Why would anyone think it was good idea to set this off in the middle of the night? I suppose if this was an ISIS hacker I can see why they might. It would obviously be a good idea to have better security on emergency systems. But I find it a shame that it's even necessary. I would like think people would have the decency to not bother systems like this. But I guess when we're in an age where swatting is a thing it's not surprising.
For example, if some vandal spray painted the traffic light covers and make them useless, or drops a sackful of nails on a highway, he/she could cause huge damage. We don't immediately take DoT for not creating secure highways where vadals could not mess with traffic lights or strew nails on the road.
Invariably in almost all these incidents we keep blaming "the officials", "the authorities". And they instinctively develop CMA tactics. They don't do anything unless they can have a paper trail that lets them shift the blame to someone else.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Sadly, a stupid stunt like this from some unknown party makes everyone's life harder.
Why?
A) blame games
B) You should have know games ( Defcon had a topic about this )
C) local government will raise taxes to cover the repair and security of the system.
So people will get extremely tough and demand harsher punishments for criminals if ever caught.
it's getting worse.
if you see me, smile and say hello.
Somewhere someone doesn't know it yet, but they are going to get the book tossed at them. We have a whole host of natural disasters that can hit, and for all of them seconds count. Almost everyone gets a warning they can react to when it comes to tornados.
Should anyone lose their lives as a result of these systems being turned off, the culprit should get a manslaughter count for each one.
I'm all for ethical hacking, but this is no where near close.
-- botsex is {grep;touch;strip;unzip;head;mount}
You'd think the other cities in the area would have learned from this vulnerability and fixed the problem.
Believe it or not, it's not at all unlikely that word of the problem never got to the right people. And even if they were aware of it it's not axiomatic that they would be able to fix the problem. They might not have the budget or it might require coordination with (possibly uncooperative) other municipalities or it might be technologically impossible to "fix" the problem with existing equipment and budget. Stuff like this usually requires budgeting and possibly even taxpayer approval and doesn't tend to happen overnight.
Although that would require local governments to be competent.
Sigh... Just because not everything happens perfectly all the time does not imply local government is incompetent. Did it occur to you that the tech involved might be old and that the taxpayers haven't approved the money to replace the equipment? It's entirely plausible they don't have the resources to deal with the problem even if they are aware of it.
The meme that government is incompetent is really tired. No institution does everything perfectly, public or private. Just because they have a failure in one task it does not follow that they are generally incompetent. There are lots of things you don't do well either. Should we declare you to be incompetent every time you overlook something or don't handle it perfectly?
The system isn't connected to the internet.
-- botsex is {grep;touch;strip;unzip;head;mount}
"Do the Death Penalty" - .you make it sound like a dance move.
Everyone complains about government incompetence, but nobody wants to pay to have a competent government.
The vast, vast majority of the public alert systems in the USA were installed in the 1950's/60's. It's a dumb-simple system that has been hackable since then, too, using the same tools that are available now. The vast majority of the systems are RF based: It's simple carrier frequency that carries a particular pair or frequencies or a particular DTMF pattern that triggers the siren system. For my town, for instance, it's a carrier on 48.90mhz, and a 4-digit DTMF on the carrier, each one about 0.25 second long that tells the siren box what pattern to signal and how long signal it for. There's also a two-tone pair (about 1.4khz and 1.9khz) that signals the siren to stay on until it's signaled to turn off again.
The beauty of the system is its simplicity: it just works. No IoT bullshit, no computers being cranky, no downed wires matter. So long as the police station can broadcast the signal and the sirens have power, the system works. We've even tested it using a hand-held radio and two tuning forks, so in the unlikely event the police station was out of power or otherwise unuseable, we can still set the whole system off. Having a IoT, 256-bit AES 2xROT system would be useless if we're standing in the middle of a shitstorm and need to get the public's attention.
Disclaimer: am a volunteer firefighter and help keep this system running in our town
Chris Knight is my hero.
The majority of siren systems intentionally use wireless radio technology instead of internet connectivity to communicate as a security precaution, says Aaron Wolking, the national sales manager of Sentry Siren. To interfere with that set-up, a hacker would need the radio frequencies, code formats, and specific five to eight-digit codes to be able to access a particular siren system. The industry also offers widely used additional security protections, like the "continuous tone-coded squelch system," that keeps radios from from receiving and executing commands sent without additional access codes.
.
.
.
To pull off this weekend's siren episode, hackers would have needed extensive knowledge of the frequencies and codes used in the Dallas siren system to make them all go off at once. This could be particularly challenging, depending on the setup, because each siren might communicate with the control center independently, so officials have the choice of turning only one or a few of them on, or activating all of them depending on the situation. Dallas officials confirmed over the weekend that the breach came from within Dallas, because hackers would have needed to be physically close to the radio signals sent to each siren. They added that the commands to the sirens didn't come from their central control systems, something officials would naturally check first to see if the sirens had been activated by accident.
https://www.wired.com/2017/04/dallas-siren-hack-wasnt-novel-just-really-loud/
Anonymous comments are as pathetic as the anonymous "sources" that contaminate gutless journalism from the New York Time
Most of these are very old systems that have zero security, triggered by a particular RF signal that pretty much anyone could transmit with some gear.
And it's not particularly clear that locking them down is all that good a plan. That ancient, simple system will go off when needed whereas a more "secure" system has many, many more failure modes.