Hackers Broke Into FAA Air Traffic Control Systems 124
PL/SQL Guy writes "Hackers have repeatedly broken into the air traffic control mission-support systems of the US Federal Aviation Administration, according to an Inspector General report sent to the FAA this week, and the FAA's increasing use of commercial software and Internet Protocol-based technologies as part of an effort to modernize the air traffic control systems poses a higher security risk to the systems than when they relied primarily on proprietary software, the report said. Intrusion detection systems (IDS) are deployed at only 11 of hundreds of air traffic control facilities. In 2008, more than 870 cyber incident alerts were issued to the organization responsible for air traffic control operations and by the end of the year 17 percent (more than 150 incidents) had not been remediated, 'including critical incidents in which hackers may have taken over control' of operations computers, the report said."
I guess this is what happens (Score:5, Funny)
Re: (Score:2)
So much for web applications.
Re: (Score:1)
Blisters in their rectums. That's what they get. Bad 'strong star property' design in network access.
Someone call Jack Bauer (Score:5, Funny)
They have the CIP device.
Re: (Score:2)
You beat me to it. But yes, it HAD to be mentioned.
Re: (Score:3, Interesting)
Sorry, Jack is in the slammer, for head butting some dude "to protect Brooke Shields' honor," or something like that: http://edition.cnn.com/2009/SHOWBIZ/TV/05/07/sutherland.charged/index.html [cnn.com]
Truly bizarre . . . an impromptu alcohol fueled celebrity involuntary nose job.
Re: (Score:2, Funny)
I hadn't heard the guy ran Mac.
Counterattacks - US Military Strikes Possible (Score:2)
The Times of India has a story about this. FTA:
"Gen Kevin Chilton, who heads US Strategic Command, said he worries that foes will learn to disable or distort battlefield communications.
"Chilton said even as the Pentagon improves its network defences against hackers, he needs more people, training and resources to hone offensive cyber war capacity. At the same time, he asserted that the US would consider using military force against an enemy who attacks and disrupts the nation's critical networks."
Basically
Re: (Score:2)
Cool, so this means that my NUKE FROM ORBIT button will finally work?
Question (Score:4, Funny)
Why are critical systems not protected by a one inch air gap between the NIC and cable from remote exploit?
Seems like from TFA [cnet.com] they're not:
Re: (Score:2)
Re:Question (Score:5, Insightful)
I believe in defense in depth. Even though the guards inside the castle may be trained to password challenge everybody walking around and check coats of arms, it never hurts to raise the drawbridge when there isn't anybody using it and there is a besieging army.
Sure, have firewalls all over the place, but any route into and out of the network itself needs to be HIGHLY secure. NOTHING goes IN or even OUT without a reason. Nothing wrong with the airport having a flight status board, but you have the ATC central database polled by some central server which generates an xml digest of the important info and have it dump that data across a serial line (transmit only) to another server which then puts it onto a webserver which the airports can parse. Flight plan requests come into some intermediate server on the internet (but well secured). That server validates the requests and sends xml files to some intermediate server (perhaps over serial) which otherwise isn't on any network. That server re-validates the input and then makes it available to a more trusted server that then does the application logic.
Of course the internal network has a firewall at every WAN connection that only passes the minumum defined data to make the system work. That still doesn't mean that you shouldn't keep the actual traffic on the mission critical network down to the minumum necessary. There shouldn't be a single packet on that ATC network that doesn't originate from an FAA-validated piece of software. Any connection to the outside should be sanitized, and they should be few in number.
This isn't about being smarter than the hackers - it is about being thorough and having a fully specified architecture.
Re: (Score:1)
Thank you for posting that. It seems like a valid, workable solution, that still for the most part takes advantage of the cost-savings by using modern products. There's definitely secure ways to handle their computing needs without it opening the network up to every script kiddie that comes along. Yes, it will cost a bit more than just buying a bunch of computer and networking gear off the shelf, but it can be every bit as secure as the previous setup, while being much cheaper to implement and maintain.
I ha
Re: (Score:1)
Interesting factoid... NSA Wally and I recently visited an FAA remote air traffic monitoring location which was secured by an ancient cylinder lock and alarm system with a poorly hidden override switch.
Once inside the facility, network access was frame-relay, and traffic interception appeared trivial. Authentication controls were antiquated and simplistic, and firewall/IDS countermeasures were useless when physical security was that lax, and most facilities were unmanned.
One hopes that the systems involve
Re: (Score:3, Insightful)
Re: (Score:1)
Re: (Score:2)
The air gap need not be applied to only one system, it can apply to an entire network of systems.
That is, no common switches (for best results not even switches partitioned by vlans, one config error and you're screwed), common routers (same deal, MPLY is not secure against configuration screwups), or machines connected to more than one network domain. At least color code everything.
To make sure the air gap isn't violated, the address domains should be distinct as well. Both layer 2 and layer 3. A packet wi
Re: (Score:1)
They should have a separate, secured network for these systems to communicate with each other. I can see the convenience of management/support staff having access to these networks, but it's clearly not worth the risk.
Re:Question (Score:4, Informative)
Trust me, any NAS equipment doesn't remotely come close to the public network. This article is misleading as they are talking about websites that 'aid' in landing aircraft. Trust me, these websites don't land aircraft.
Re: (Score:2, Funny)
Re: (Score:1)
Re: (Score:2)
The FAA relies, I believe, on leased telco lines with a backup system of microwave transmitters. Unfortunately, either of these could be compromised between sites.
Lack of connectivity to other networks is no substitute for security between sites.
Re: (Score:3, Informative)
Why are critical systems not protected by a one inch air gap between the NIC and cable from remote exploit?
I'm honestly not sure. I work with ATC, although not in the US. The systems I have installed (Europe and Asia) have all been closed systems, there are very few physical connection between the servers and software working on radar- and flight data, and any equipment used to communicate externally.
Almost all communication is done via VCCS equipment (radio etc), so the controllers have screens with radar- and flight data, and separate screens and terminals for external data, such as flight plan processing term
Re: (Score:2)
Why are critical systems not protected by a one inch air gap between the NIC and cable from remote exploit?
Won't help. The 12AX7s the air traffic control system ENIAC runs on are microphonic. Brings a whole new meaning to the term "ping" ;)
Yes, I'm old. You will be too - if you're lucky.
Re: (Score:2)
They are. Or at least they were when I was involved in FAA security. Consider the agenda of the source of the report.
Then use IPv6. (Score:5, Insightful)
It's non-proprietary, the applications should work just fine, but most skript-kiddies don't have any idea on how to set up the necessary tunnels. It's also designed from the start to be secure, IPv4 has had all security back-ported in.
Also, use Active IDS, not passive. It's no good telling the operators that the last three planes crashed into a mountain because a system cracker decided it would be fun to use the radar computer for a game of Netrek. You're much better off by detecting the intrusions in real-time and countering them right then. Particularly if actual mission-critical systems are being broken into.
Third, Stop Using Windows! Gaah! The chances are that the software can be modded to work under Linux or OpenBSD just fine.
Re: (Score:2)
The only issue with an Active IDS is having zero false positives. You don't want some TRACON to go down when some IDS update causes a router to alarm and shut down JFK approach with 18 aircraft enroute to final on 3 runways.
Re: (Score:2)
That's very true. As things stand, though, that could potentially happen through computer misuse and (to judge from TFA) the level of security breeches already makes this a practical possibility.
It's a question of choosing the least-worst option, since all options are going to have problems. The solution they are actually migrating to (a totally insecure option) is the worst possible world, so all others will be at least equal and probably better.
Now, there are many approaches to Active IDS, some more likel
Re: (Score:2)
"Let's say, for example, that all authorized connections must use strong authentication and must use IPSEC (or S/WAN, or some other authenticated encrypted communication system of your choosing). The IDS can then look for any other type of connection and slam the door on it."
And here we have a glaring example of the "buzzword du-jour". "active IDS" in this case. Let's say, for example, that all authorized connections must look like X. Then you don't need "active IDS" you just don't open these kinds of con
Re: (Score:2)
I see you don't quite understand the process. Ok. If external machine A attempts an unauthorized connection type (say, a portscan), then not allowing it is not enough. What you want is to detect the attempt and then block all further connections from A, regardless of what they are. ie: You are actively updating the firewall to exclude known attackers. For this, you need Active IDS. That's what it is for, dynamic firewall updates and other countermeasures when a hostile source is identified.
This isn't a buzz
Re: (Score:2)
"What you want is to detect the attempt and then block all further connections from A, regardless of what they are. ie: You are actively updating the firewall to exclude known attackers. For this, you need Active IDS. "
Yes, that was exactly my point: that in order to shoot your foot off you need and active IDS. The example you used is typical on this regard: the next you will know is that somehow you lost contact to control tower five (of course my signature injection with source spoofing might have someth
Re:Then use IPv6. (Score:5, Insightful)
I love OpenBSD. We use it everywhere at work. But our computers do not control airplanes. A general-purpose OS is appropriate in the kind of environment where you have hard real-time limits and where bounds-checking errors have the potential to kill lots of people. This is a case where rolling-your-own is actually a good idea, and worth the money.
If you're trying to decide what kind of IDS to put on your air-traffic-control net, you need to back up and undo some of your decisions.
Re: (Score:2)
Well, yes, arguably you are correct on all points.
Ok, for the absolutely rigorous, there ARE pared-down versions of Linux which are considered "carrier-grade" and even one or two that are "FCC-approved" for limited applications. It's also hard to get a general-purpose OS to respect Hard Real-Time, the best you can really get is Soft Real-Time.
But aside from a couple of minor exceptions and a quibble over the real-time, yes, mission-critical systems should NOT be on the Internet. They should not even have US
No, use IBM's SNA . . . (Score:5, Funny)
. . . it's proprietary, so no one, not even IBM, understands how it works.
The script kiddies will have to learn JCL. Have fun, you little rotten bastards!
And even if they manage to break into a machine, they will be confronted with z/OS ISPF . . . can they get their tn3270 sessions to work? Hee, hee! Find your PA1 key!
The best choice for a truly secure system, is to use some weird shit, that nobody else wants to use. And thus, there are not a lot of folks hacking about trying to poke holes in it.
Wait for a script kiddie post, on how to use nmap to probe for ports on LU6.2.
Re: (Score:2)
JCL? You want the FAA to be prosecuted for crimes against humanity? You're sick! That's even more perverted than networking using X.25 PADs!
Re: (Score:2)
to them eh?
LOL the
Re: (Score:2)
The best choice for a truly secure system, is to use some weird shit, that nobody else wants to use. And thus, there are not a lot of folks hacking about trying to poke holes in it.
Yeah. So the only people that will try to break into that will be people who know it better than its admins. That will end well, indeed...
Remote Control (Score:1)
That was proposed. (Score:4, Interesting)
Glad they don't have commercial planes with complete remote control. Or do they?
That was proposed after 9/11 as a solution to hijacked planes. Remote control devices that could take over a hijacked plane, remotely, locking out control by those on board and allowing it to be landed safely. Remote devices strategically located at all major commercial airports - or at least those near high-value targets (which is pretty much all of 'em).
When the trial balloon went up it was soon pointed out that, with such a system, hijackers could use it to hijack the planes without even being on board. And the tech would be distributed to many locations (worldwide) from which it could be stolen.
Haven't heard much about it since. B-) Of course that means that it will fall off the mental horizon for decision makers and they might decide to do it after all. B-(
Re: (Score:2)
If such a device could be activated only by the pilot, it wouldn't be so unreasonable.
If such a device could be activated only by the pilot it would mean:
a) The hijackers would keep the pilot from activating it as their first act upon storming the cabin.
b) If it got activated the pilot, minimum, would be far more likely to be killed than if he had no hand in activating it.
Also: If such a device existed, even if it required activation by the pilot, malfunctions could lead to a non-controllab
Re: (Score:1)
A relative of mine was working for KLM [wikipedia.org] 25 years ago and said they could remotely take off a 747 from New York and land it in Amsterdam with 0 persons onboard. Now, I'm not sure if they specially rigged stuff into it to accomplish that, but that leads me to believe that the infrastructure is already in the planes and it's A) not being used because of the ethical pile of mud, or B) not many people know about it.
Re: (Score:1)
Well that would explain (Score:5, Funny)
Why my last 4 flights arrived on time.
Re: (Score:1)
Why my last 4 flights arrived on time.
That has more to do with the fact that the Airline doesn't want to pay for overtime...
Re: (Score:2)
There, fixed that for you.
I usually laud hacker hijinks (Score:4, Insightful)
As it tends to enlighten people to the necessity of better computer security... but when it involves things like airport control towers and hospital equipment and files it is totally not cool.
Re: (Score:2)
I dunno...do you really think they'd have addressed things like "only 11 out of hundreds" of facilities having intrusion detection measures unless somebody did this?
Re: (Score:2)
I dunno...do you really think they'd have addressed things like "only 11 out of hundreds" of facilities having intrusion detection measures unless somebody did this?
To me, that seems an odd sort of thing to mention. Having an IDS rather assumes that hackers have free access to the network and that the "security" is limited to chasing them down.
Surely a system with correct security doesn't need IDS, because there would be nothing to detect?!? i.e. a secure system only allows actions which it knows are correct, whereas an IDS detects the system allowing actions which it knows are incorrect.
Re: (Score:2)
As others have mentioned, XKCD [xkcd.com] explains much better why IDS seems wrong...
Re: (Score:3, Informative)
Hacking into government computers is old hat. I'm more concerned that someone seems to have hacked /. and changed the front page to be an RSS feed.
Re: (Score:2)
Yeah, it is not cool, but if it weren't for them, those systems would be left untested and, probably, insecure.
As long as they keep testing without killing anyone or causing major financial losses...
This is Crazy (Score:1)
This was just a partial look at the ATC's systems and these are the kinds of numbers that come up?
"Our test identified a total of 763 high-risk, 504 medium-risk, and
2,590 low-risk vulnerabilities, such as weak passwords and unprotected critical
file folders."
This is just unacceptable, and I bet this get little to no mainstream media attention.
Ineptitude (Score:4, Informative)
That's what's usally called ineptitude, but those FAA guys like to spin it round so someone else, or circumstances beyond their control, are the problem.
From what I've read about air-industry people in the US they are no different from in the Netherlands: People who almost invariable have a superiority complex and think they're doing tremendously important work while not having justify why they make so much noise, are so inept at sound calculations (dBA which is pointless for noise as related to annoyance, contrary to Sone for example), produce reports with incorrect units (upper and lower case wrong showing they don't have a proper education in elementary physics) etc.
Recently small aircraft were prohibited from flying near Schiphol. Reason was transponders are now in all of them, the LVNL (dutch airtraffic control) couldn't handle all those signals. A tremendous display of ineptitude again as they had plenty of time to prepare their systems (software), but being the sort of people they are, this is actually logical. Because they feel superior, they don't actually consider they might be doing things badly or need to change. In other words, despite them feeling they are superior, they are in fact amateurs...
You can find more on the web on this (in dutch).
Re: (Score:2)
Re: (Score:3, Informative)
That's what's usally called ineptitude, but those FAA guys like to spin it round so someone else, or circumstances beyond their control, are the problem.
Their not happy until your not happy! You can't blame them for living their moto.
In all seriousness, the FAA is in the middle of a huge political game right now, which is actually very complex to explain. They are working overtime trying to get out from under Congressional oversight. I wouldn't be surprised if they're looking the other way in an attempt to
Re: (Score:1)
Fixed that for you. Now what were you saying?
Re: (Score:2)
"despite them feeling they are superior, they are in fact amateurs"
This reminds me of the years I spent in IT for a large hospital chain.
Replace air-industry with medical-industry.
Replace air traffic controller with doctor, etc..
In many ways, they ARE superior in their field of expertise, they just seem to have a problem understanding that they are not experts in everything.
I've had many a highly trained physician do idiotic things on computers, and, left to their own devices, I'm sure they would have made
This is a serious break down in Security (Score:1)
SCADA systems should always be disconnected from Intranets and the Internet. Sorry, this is a serious architectural and national security issue.
Whoever came up with this architecture and authorized it should be terminated.
Yup (Score:3, Funny)
I'm not sure it gets much worse than this. I guess the local nuke plant could install a "whack-a-rod" live webcam game and secure it with DMCA technology...
Missing Forest for the Trees? (Score:5, Informative)
"However, Brown dismissed the notion that hackers could get access to critical air traffic control operational systems."
It's OK everybody, the hacker's have shut down the network but they havent gained any critical access.
Re: (Score:3, Interesting)
Air traffic controllers are quick to tell you that they do not care about the ATC system that sit in front of them.
If they are unreliable, or go down, they will continue to perform their job, by slowing everyone down, increasing the gaps, limiting the number of new plans onto the grid.
It gums up the works a bit, but everyone gets to walk away.
Is the FAA using Windows?!? (Score:2)
Obligatory (Score:5, Funny)
"Where do you want to go today?"
"The Good Ole Days" (Score:5, Insightful)
Being a programmer meant you could make a lot of money, not because you could make something that could be sold, but because you make programs that were useful for a purpose. Bill Gates and people like him turned computing into a software industry and this is more or less the result of that.
There was nothing "wrong" with systems maintained by professional programming teams and for those people to work at the same job for their entire lives earning a good wage. "Industry" has not only weakened systems everywhere with their homogenous nature, but cheapened the industry and lowered wages for everyone in the profession.
Re: (Score:3, Insightful)
If you want to look at it a different way, look at starting salaries for college graduates. [cnn.com] Computer Science graduates on average make $49,000 right out of college. This is compared to English majors who make $31,000 right out of college, or psychology majors who make $28,000 right out of college. Ouch. Keep in mind that the per capita GDP in
Re: (Score:2)
I know what you mean.
Around 15 years ago, I recall a couple small programming shops that employed ~5-6 people each in my original home town.
Each of the offices supported only a handful of industrial clients, creating unique software for them. They had been doing so for over 10 years (might have been a bit less, I forget).
One office, for instance, produced the software that 2-3 of the biggest fruit warehouses in the country used. Very very specific software. Sold pre-installed on the server, which was bas
Why is this stuff connected to the internet? (Score:2)
Re: (Score:2)
Let me guess -- China? (Score:2)
Event counts for IDS are mostly useless.. (Score:4, Interesting)
Anyone who has worked with IDS/IPS systems will realize that unless very carefully managed you will have a large number of events that amount to nothing, even some with some very scary sounding titles.
I am actually surprised to see the count levels so low, even for systems that are believed to be somewhat out of the way.
ATC is not actually a single system within the FAA this function is broken up over several different systems, each with their own silo of responsibility. My understanding from talking with traffic controllers is that the systems are not a requirement for controlling traffic. If the systems are down, or are believed to be unreliable the controllers will simply continue with a more conservative approach, although this can have the effect of gumming up the works as everyone is slowed down and larger gaps are used.
Real danger would be if information was off in some subtle way that was not detected, but as soon as it was determined that something was wrong, the system in question would be taken out of the work flow and further issues with it would not matter.
Crafting such a problem would take not only the IT info to gain access to the system, but at least some level of ATC understanding on how to alter a situation without tipping your hand. While far from impossible, it is not what I would suspect would be a common skill set.
I hear that Candida uses Amiga systems for ATF (Score:2)
I hear that Candida uses Amiga systems for ATF or they used to.
Remind me again why we are replacing it? (Score:2)
Was there ever a real need to screw with the ATC other than giving airlines more control of the system so they can adjust things to maximize their profits?
I'm not suprised. (Score:4, Informative)
Re:I'm not suprised. - Ha Ha. (Score:1)
Remediate this! (Score:1)
Just who was the jackass that decided we had to say "remediated" instead of "fixed"??
You're Doing it Wrong! (Score:2)
I believe the late 20th / early 21st century poet, philosopher, and artist, Randall Munroe, said it best: "You're doing it wrong!"
http://xkcd.com/463/ [xkcd.com]
Correction: (Score:2)
"s/commercial software/Windows/g"
Sneakers reference (Score:2)
Whistler: Anybody want to crash a couple of passenger jets?
Back to vacuum tubes! (Score:1)
Airport hacking in the 1990s. (Score:2)
I have connections to someone who accidentally hacked an airport in the 1990s. Back then, the thing that board teenagers did was run programs that would find phone numbers answered by modems.
Anyway, as the story goes, this teenager came across a phone number, answered by a modem, that behaved very differently then any other phone number. There was NO password or security whatsoever. The interface was very foreign; however, this board teenager spent a few months hacking at the system, trying to learn what
dialback modem security (Score:2)
What was the name of this airport and are their any reports on this incident. Usually, where you have dial-in access to a modem, the modem drops the connection and dials back a particular number. See Dialback Modem Security [phrack.org] from a Phrack article of 1988
Re: (Score:2)
What was the name of this airport and are their any reports on this incident.
Worcester Airport, either 1997 or 1998. The lead investigator told his side of the story at the Microsoft Security Summit in Boston in 2004.
From what I understand, the story didn't hit the newspapers until 6-7 months after the incident because it really was a case where anyone with a modem could find the airport's phone number and type in the command to bring it down. They had to wait until they fixed the system.
Honestly, I'm not entirely sure what's public information at this point. I approached the lea
Re: (Score:2)
If this is it then I say connecting a computer to a modem without dialback is one of the dumbest things you can do.
.. he accessed and disabled both in sequence.
'The juvenile computer hacker identified the telephone numbers of the modems
Acting Special Agent in Charge Johnston stated, "This case, with the associated national security ramifications, is one of the
Re: (Score:2)
If this is it then I say connecting a computer to a modem without dialback is one of the dumbest things you can do.
Never underestimate what lazy contractors / employees can do. I worked with a guy who ignored my, "you're open to SQL injection" statement.
Anyway, dialbacks weren't common back in the late 90s. Some of my friends used to war dial and then trade numbers.
To put it bluntly: My hobby dial-up BBS had better security then some of these systems, and I was a teenager.
the solution is obvious (Score:2)
Re: (Score:1, Offtopic)
Re: (Score:2)
"poses a higher security risk to the systems than when they relied primarily on proprietary software"....Someone actually put this into an FAA IG report? That's ridiculous. Correlation and causation are two ENTIRELY different things. You'd think the FAA, of all people, would understand that.
Exhibit A: Microsoft products. A huge collection of proprietary software which are security swiss cheese. Sorry, that's not fair to swiss cheese.
I dont think that's what they mean by "prprietary". I think they mean specifically or "in house" developed specifically for the task.
The bigger issue here is infrastructure which is partially tied to the military is being run in the civilian domain. You don't use public radio to broadcast tactical data, why on EARTH would you use public internet?
The only way to ensure such critical defense communication infrastructure remains robust is to develop a second, completely separate military internet with deliber