3,800 Vulnerabilities Detected In FAA's Web Apps 88
ausekilis sends us to DarkReading for the news that auditors have identified thousands of vulnerabilities in the FAA's Web-based air traffic control applications — 763 of them high-risk. Here is the report on the Department of Transportation site (PDF). "And the FAA's Air Traffic Organization, which heads up ATC operations, received more than 800 security incident alerts in fiscal 2008, but still had not fixed 17 percent of the flaws that caused them, 'including critical incidents in which hackers may have taken over control of ATO computers,' the report says. ... While the number of serious flaws in the FAA's apps appears to be staggering, Jeremiah Grossman, CTO of WhiteHat Security, says the rate is actually in line with the average number of bugs his security firm finds in most Web applications. ... Auditors were able to hack their way through the Web apps to get to data on the Web application and ATC servers, including the FAA's Traffic Flow Management Infrastructure system, Juneau Aviation Weather System, and the Albuquerque Air Traffic Control Tower. They also were able to gain entry into an ATC system that monitors power, according to the report. Another vulnerability in the FAA's Traffic Flow Management Infrastructure leaves related applications open to malware injection."
Re:Just read through the PDF (Score:5, Informative)
They do mention a compromised domain controller, which suggests (though doesn't guarantee) Windows.
They also mention DOT, which I believe is heavily into Windows.
In the late 1980s I know there was some UNIX/X11 development going on for ATC in Germany, but I never heard whether it went big time in Europe, much less in the USA.
There are some references on the net from 2007 or so that the FAA was switching from Win to Lin, but I'm not sure what systems those were, or if it really happened. They could easily run a mix of UNIX, Linux, Windows and others on the back end, and mostly Windows on the front end.
Finally, the ATC systems probably run RTOS or a real-time UNIX.
Re:Security expert point of view. (Score:3, Informative)
As a pilot I've had to interact with a lot of the FAA's web presence. Much of this seems to stem from convenience and cost cutting around flight planning.
Currently, the FAA operates a telnet based Direct User Access Terminal, which provides flight planning information (both weather and wind/time calculations) and the ability to file a flight plan over the internet. That system is used by any number of sites to put a pretty face on it and make it more user friendly. In short, a pilot could plan a flight and file a flight plan all from the comfort of his armchair, and not have to call a Flight Service Station.
Its convenient, but as the parent posters said, also introduces a major vulnerability.
In addition, the FAA has moved Airman certification over to a web based client that, frankly, is a total disaster. When it first went online, it would ONLY work with IE 6 on Windows. It was totally nonfunctional outside that little segment of the population. Its been upgraded recently, so its slightly less irritating. It still loses applications, which forces applicants to recreate their application (a non-trivial process).
All in all, I've been happy with the FAA as a regulatory body. Their IT division, however, has to get their act together.
Different Article; Same Report (Score:5, Informative)
Sounds vaguely familiar [slashdot.org]...
Note that, although this is not a good thing, we're not actually talking about the ATC system here. We're talking about administrative web applications that employees can access from home, web sites that provide information about air traffic services to employees and to the public, power monitoring applications, things like that. Some are pretty serious, but most are not that serious. And none of them are the ATC system itself.
Re:Geeksquad.Gov (Score:3, Informative)
The problem is that an operating system is just something you need to get the application to work on the hardware you choose. It might be a small part of the problem. If you decide to create your own custom distro for the purpose of running your application you're going to possibly run into problems getting your application stack to work correctly on top of it or may have problems getting support.
The OS they chose was RHEL [gcn.com] and you can infer some of the rest of the stack from the requirements [74.125.47.132].
Looks like they went with an SOA architecture on top of a J2EE stack with an Oracle backend using Eclipse as the development platform.
I don't know why these stories turn into OS flame wars. It's like blaming the spark plug for poor engine performance. The OS is probably adding vulnerabilities (Don't know of any OS that doesn't have listed vulnerabilities) but you have to look at the whole stack. Any individual part of the stack could be fine on it's own, but in combination may create other problems. On top of that, this system isn't just a combination of off the shelf components, there is a lot of coding involved and for all we know that's where most of the issues may be.