UPDATE – Firmware images for the application servers that distribute messages for the Emergency Alert System in the United States were shipping with a private root SSH key that has been disclosed. Hackers who have this key can access one of these servers and interrupt or manipulate an EAS message.
The EAS is a system that enables, in a worst-case scenario, the president to speak to the nation within 10 minutes of a disaster over radio and television. In February, ENDEC machines at a Montana television station were accessed by hackers and broadcast a phony emergency alert warning of a zombie apocalypse.
DHS’ ICS-CERT issued an alert last week warning that Digital Alert Systems’ DASDEC and Monroe Electronics One-Net E189 EAS devices were shipping a compromised shared private root SSH key in publicly available firmware images. The vulnerabilities in the DASDEC application servers were reported by IOActive principal research scientist Mike Davis. The servers authenticate EAS messages and interrupt broadcasts with the familiar alert tone that accompanies emergency messages.
“These DASDEC application servers are currently shipped with their root privileged SSH key as part of the firmware update package. This key allows an attacker to remotely log on in over the Internet and can manipulate any system function,” Davis said in a statement. “For example, they could disrupt a station’s ability to transmit and could disseminate false emergency information. For any of these issues to be resolved, we believe that re-engineering needs to be done on the digital alerting system side and firmware updates to be pushed to all appliances.”
The compromised SSH keys ship in the firmware images for the Linux-based DASDEC-I and DASDEC-II appliances. An attacker can use the key to log in over the Internet and impact emergency messages delivered to an undetermined number of locations and stations. Depending on the device configuration, IOActive said, manipulated messages could be sent to other DASDEC systems.
According to an IOActive advisory, the publicly available SSH key can be removed only by a root privileged user on the server. An attacker with access can also view the server logs, which includes machine information, administrator data and other sensitive data.
In addition, DHS CERT said the administrative Web server generates predictable session ID passwords that could also allow an attacker to own an admin dashboard. The DASDEC and One-Net ENDEC machines also ship with default administrative credentials that some sites neglect to change.
As far as mitigations go, Monroe Electronics and Digital Alert Systems updated their firmware in April disabling the compromised SSH key. There are also simplified means of installing new unique keys and a new password policy. Until a new image is obtained and installed, users are urged to disable the compromised root SSH key immediately, especially if it is Web-enabled. DHS CERT said that if users are unable to replace the SSH root key, they should restrict access to trusted hosts and networks, and change all default passwords.
Monroe Electronics said most users have implemented the cumulative security update released in April that patched these vulnerabilities, a Monroe representative told Threatpost.
“We undertook great efforts to both provide a cumulative security update that removed the SSH keys, among other enhancements, and contacted our users directly with information about the nature of the concern, and the software mitigation, and the need to adhere to accepted network security practices,” he said.
This story was updated with information from Monroe Electronics on July 11.
