EAS vulnerability exposes the soft underbelly of firmware

Operators of the Emergency Alert System have begun updating equipment to close vulnerabilities that exposed the nationwide system to exploit by unauthorized users. Vendors of the affected codec equipment have replaced firmware that exposed sensitive encryption keys, but researchers say the EAS incident could be just the tip of the iceberg.

The problem was uncovered early this year when researchers at computer security company IOActive examined freely available firmware for two brands of codecs used for emergency messaging systems. They found the firmware contained the private root SSH (Secure Shell) key that could be used to authorize access to the devices with root privileges. Although the exposed key was not hard-coded into the devices, changing it was difficult before firmware updates were released in April.

Firmware made openly available by equipment manufacturers as a matter of convenience for customers is not unique to the messaging industry, said IOActive CTO Gunter Ollmann.

“We should expect to see many more vulnerabilities over the next few years derived from firmware,” Ollmann said.

The firmware has been updated to disable the compromised key, simplify the process of installing new keys and improve password policy. However, the long-term fix for the problem would be for manufacturers to restrict access to firmware to legitimate users who have bought or licensed the products, Ollmann said.

The problem was discovered in January in firmware for the Digital Alert System DASDEC-I and II and the Monroe Electronics R189. These are widely used application servers that receive, authenticate and pass along emergency messages to radio and television stations for broadcast as part of the Emergency Alert System.

EAS replaced the Cold-War era Emergency Broadcast System in 1997 to adapt to changes in the broadcast industry and provide a nationwide platform for the president to address the nation during an emergency. It is run jointly by the Federal Communications Commission, the Federal Emergency Management Agency and the National Weather Service. The president has designated authority to activate EAS nationally to the Federal Emergency Management Agency.

Although EAS has never been used nationally, it is commonly used at the state and local level to issue alerts for severe weather or other emergencies. Alerts are formatted using the Common Alerting Protocol standard and sent by authorized users to the Open Platform for Emergency Networks for sender authentication and to ensure compliance with the standards. The platform then distributes the message to media in the designated alert area through a hierarchical system.

In the national distribution system, the top tier of the hierarchy is Primary Entry Points, a network of hardened AM radio stations with backup equipment and power supplies that cover most of the U.S. population. PEP stations distribute the message for rebroadcast to other local radio and TV stations. At the bottom of the hierarchy are cable networks, which monitor local stations for alerts.

Exposing a common SSH key in firmware can allow remote login to EAS equipment by unauthorized users. A number of other, less critical, vulnerabilities also were found, including default administrative passwords that also could allow unauthorized log-ins. The exposed key apparently was exploited by a hacker in February to broadcast a false alert of a zombie apocalypse over KRTV-TV in Great Falls, Mont.

Ollmann said IOActive began working with the Homeland Security Department’s US-CERT in February to orchestrate release of the updated firmware and public disclosure of the vulnerability. US-CERT published the vulnerability alert in June.

Ollmann said there is no way to say how much of the affected equipment has been updated at this time, but new equipment now being deployed should include the updated firmware.

EAS now is being incorporated into a broader network called the Integrated Public Alert and Warning Systems (IPAWS) that is intended to take advantage of cellular, satellite and Internet technology to deliver multi-media messages in addition to the EAS audio and text messages. IPAWS will incorporate the National Warning System, the Commercial Mobile Alert System and NOAA Weather Radio in addition to EAS.

IPAWS was mandated by executive order in 2006 in the wake of the confused response to Hurricane Katrina.

For national emergencies, commercial news media have made EAS a last-ditch rather than front-line channel for alerts. Officials said EAS was not activated during the attacks of Sept. 11, 2001, because immediate and ubiquitous news coverage made it unnecessary.

The first nationwide test of the Emergency Alert System was held in November 2011 and exposed a number of minor problems. Three top-tier PEP stations did not receive the test message, a feedback loop caused some overlapping transmission of the message and some timestamp problems delayed some transmissions.