The U.S. Department of Homeland Security (DHS) has issued a warning that malicious actors could exploit vulnerabilities in Emergency Alert System (EAS) devices to spread fake alerts on television and radio. The Federal Emergency Management Agency (FEMA), part of DHS, sent this notification through the Integrated Public Alert and Warning System (IPAWS).
“We recently discovered vulnerabilities in EAS encoding/decoding devices that, if not updated with the latest software, could allow an attacker to send false alerts through television, radio, and cable infrastructure,” DHS said.
This problem was demonstrated in practice by security researcher Ken Pyle of CYBIR.com, who plans to present proof of concept at the DEF CON 2022 conference in Las Vegas (August 11-14). According to the DHS, information about the vulnerability has been made public and is expected to be demonstrated to a wide audience in the coming weeks.
FEMA has recommended that EAS device owners take steps to mitigate the risks:
- Protect devices with a firewall.
- Install the latest patches and security updates.
- regularly check audit logs for unauthorized access.
According to Pyle, the Monroe Electronics R189 One-Net DASDEC EAS device has serious vulnerabilities that have remained unpatched for a long time. If exploited successfully, an attacker could gain access to credentials, devices, and certificates, attack web servers, send fake alerts, and block legitimate users.
About ten years ago, Monroe Electronics (now Digital Alert Systems) fixed a critical vulnerability, CVE-2013-4735, in a similar EAS device. The problem was the presence of a common private SSH key available in public firmware. If left unaddressed, attackers could gain root access and send false signals via an SSH session.
At DEF CON 30, on August 13 from 10:00 a.m. to 2:00 p.m. in the IoT Village, Pyle will provide details on the vulnerabilities he discovered and how they can be exploited.
What is the Emergency Alert System?
EAS is the US national emergency alert system that allows the president, as well as state and local authorities, to communicate critical information during emergencies (such as weather threats, AMBER alerts, or other dangers) when other means of alerting the public are unavailable.
EAS signals are transmitted via IPAWS through various channels simultaneously: AM/FM radio, satellite radio, television, and cable broadcasting to reach the maximum number of people. The system is also capable of interrupting radio and television programs to broadcast emergency messages and send alerts in the form of text messages with or without audio.