Feel Safe?
This is a very unpleasant bit of news. The Federal Aviation Administration has had its computer systems hacked – repeatedly – as it has switched over to “commercial” software.
Hackers broke into US air traffic control computers on several occasions over the past few years and increased reliance on Web applications and commercial software has made networks more vulnerable, according to a government audit.
Among the breaches was an attack on a Federal Aviation Administration (FAA) computer in February 2009 in which hackers gained access to personal information on 48,000 current and former FAA employees, the report said.
In 2006, it said, a viral attack on the Internet spread and forced the FAA to shut down some of its air traffic control (ATC) systems in Alaska.
The current administration is apparently taking a cruise up denial, which is not a river in Egypt:
“We are working on developing security architecture for that whole system,” said FAA spokeswoman Laura Brown. “We have identified it as an issue we need to focus some attention on, and we’re doing that.”
Security tests identified 763 “high risk” vulnerabilities that could allow hackers access to administrative systems, which could then provide a path to more-sensitive operational systems, the report said.
Ms. Brown rejected the report’s conclusions that hackers could get into critical air-traffic operational systems through administrative systems.
“It’s not possible to use the administrative and mission support network to access the air-traffic control network,” she said. “We have specific orders that prohibit them from being directly connected.”
The Wall Street Journal reported last month that an Air Force air-traffic control system had been compromised, alarming intelligence officials who feared that such an attack could be used to interfere with air-traffic systems.
Most of the known penetrations of FAA systems involved administrative networks that manage air-traffic flow and electric power, as well as email systems and internal and external Web sites, the report said.
The nature of one 2006 attack is a matter of dispute between the inspector general and the FAA. The report says the attack spread from administration networks to air-traffic control systems, forcing the FAA to shut down a portion of its traffic control systems in Alaska. Ms. Brown said it affected only the local administrative system that provides flight and weather data to pilots, primarily of small aircraft.
Wow. I feel confidence just bubbling up, don’t you?
If the commercial software is this easily hacked – and if the FAA spokesman is this clueless to the threat – we all have a real problem.





