DOT Issues Vulnerability Report On The FAA’s ATC System

NEWSROOM


DOT Issues Vulnerability Report On The FAA’s ATC System By Steve Hall

		April 22, 2011 - Department of Transportation’s Office of the Secretary of Transportation Office of Inspector General (OIG) issued a quality control review report on the vulnerability assessment of the Federal Aviation Administration's (FAA's) operational air traffic control (ATC) system. The review was conducted at the request of the current Chairmen of the House Transportation and Infrastructure Committee and its Subcommittee on Aviation. The objective of audit was to determine whether the ATC systems can be accessed by unauthorized users from inside ATC facilities through FAA’s Mission Support System Network by assessing systems and networks at two FAA facilities.

Clifton Gunderson LLP, of Calverton, Maryland, completed the audit under contract to the Office of Inspector General (OIG). OIG staff performed a quality control review of Clifton Gunderson's audit work to ensure that it complied with generally accepted government auditing standards. Their review disclosed no instances in which Clifton Gunderson did not comply in all material respects with applicable auditing standards. Clifton Gunderson concluded that unauthorized users were unable to gain access to FAA's operational ATC systems. However, they identified the following weaknesses at the Air Route Traffic Control Centers: 1) information disclosure vulnerabilities; 2) inadequate system patch levels and unsupported operating systems; 3) improper network configurations; and 4) communication system vulnerabilities. Information disclosure vulnerability, information disclosure vulnerability during testing at one ARTCC that allowed them to view, without using a password, hundreds of pages of sensitive technical information describing network configuration, gateways and other devices. This sensitive information may provide a rogue employee or contractor sufficient understanding to identify and exploit weaknesses in the ATC security structure. Patch management vulnerabilities on FAA's MSSN revealed several critical and high risk Common Vulnerabilities and Exposures (CVE) related to missing or outdated system patches or the running of operating systems no longer supported by their vendors. System patch levels and operating systems that are not kept current not only may result in system unavailability, but may also create a risk of exploitation of security holes for access to ATC systems and data. Any of these systems could be compromised, and allow the attacker to use the system to hide his or her identity in order to launch more attacks.

System configuration vulnerabilities on FAA's MSSN revealed several critical and high risk CVEs related to improper system configurations. An attacker could leverage these vulnerabilities to gain total control of the systems. Furthermore, the systems could be used to compromise other systems that depend on the same network management and configuration services.

		Communication system weaknesses identified a communication system at one location that does not require complex passwords and is no longer supported by the vendor. This lack of sufficiently complex passwords could lead to an unauthorized manipulation of the communication system, a total system shutdown, or falsification and impersonation of facility communications. Other News Stories (For the latest news please checkout our home page) Final Flight Of Space Shuttle Endeavour, Canada's Contribution European Commission Blacklist Airlines From Operating In The EU Southwest Airlines To Close Deal With AirTran DOT Expands Airline Passenger Protections Bell Helicopter Honors "Heroes of Aviation" Kentucky, Sale Of Two State Aircraft ‘Smart Government Initiative’ NLRB Issued Complaint Against Boeing For Unlawful Labor Practices Aircraft Repair Stations Choose AAIRRG As Insurance Carrier BAE Systems Enhances UK Royal Air Force Training Capabilities Eglin Air Force Base Receives First F-35 Full Mission Flight Simulator Rockwell Collins, Safety Benefits Of Head Up Flying Guidance System Civil Aviation Authority Sets Out Policy On Performance Based Navigation Discovery Air Announces Debt Repayment Moller International Schedules Test Flight Of The M400 Skycar EADS To Conduct Flight Demonstrations Of Its Armed AAS-72X Helicopter U.S. Air Force And Northrop Honor 50 Year History Of The T-38 Talon Jet Boeing Delivering 787 Pilot Training On Global Scale FAA Spoke On Biometric Pilots Licenses Before U.S. House Committee NTSB Report Details How Close United Airlines Flight 889 Came To A Midair FAA Administrator Changing ATC Scheduling Practices ICAO Standards Weak On Shipping Lithium Batteries By Aircraft Report Shows UK Airline Pilots Suffer Significant Fatigue New Touch Screen Attendant Control Panel For Airplane Cabin Upgrades 2011 Bahamas & Caribbean Pilot's Guide Now On The iPad Hawaiian Airlines Pilots Raise Money For Victims Of Japan’s Tsunami Sikorsky And Other Pioneering Aviation Families Support Lindbergh’s LEAP Program Airline Traffic Up 2.2 Percent From January 2010 B/E Awarded Cabin Seat Contract On Lufthansa’s A330 And A340 Aircraft L-3 To Begin Upgrading The Navy’s EP-3E Aircraft Avionics Suite E-2D Advanced Hawkeye Program Completes Successful DAB Review GE Aviation Breaks Ground For New Research & Development Center BA Cabin Crew Strike On Hold Both Sides Believe Issues Can Be Solved FAA's Head Of ATO Resigns Amid Reports Of Controllers Falling Asleep FAA To Add Additional Staffing On The Grave Yard Shift At 27 Control Towers Grassroots Campaign To Improve Airport Passenger Security Screening Airlines Participate In ICAO Volcanic Ash Crisis Exercise Finnair Publishes More Extensive Corporate Responsibility Report Delta TechOps Expands Partnership With Evergreen Aviation Technologies Northrop’s Lake Charles Aircraft Maintenance Center Selected MRO Of The Year Eurocopter Attends LAAD 2011 Defense Show To Expand Presence In Latin America Honolulu Coast Guard Receives New MH-65 Dolphin Helicopter FAA Announces Barbados Does Not Comply With ICAO Safety Standards