TV Alert Systems Warn of Zombie Attack After Hack

Gullible TV viewers in Montana and Michigan got a shock this week when their programming was interrupted by this announcement from the Emergency Alert System:

“Civil authorities in your area have reported that the bodies of the dead are rising from their graves and attacking the living. Follow the messages onscreen that will be updated as information becomes available. Do not attempt to approach or apprehend these bodies as they are considered extremely dangerous.”

The fake warning appeared as a voiceover during the Teen Cheaters Take Lie Detectors segment of The Steve Wilkos Show (imagine a lower rent Jerry Springer Show) on KRTC in Great Falls. A scrolling warning also appeared at the top of the screen naming various Montana counties as targets. It didn’t suggest specific ways to deal with the living dead, but this was Montana so most of those in danger probably wouldn’t have to go far for access to a shotgun.

There is absolutely no truth to the rumor I am starting here that the alert was issued because Dick Cheney went out for a walk. None.

The next day the zombie uprising hit Michigan’s Upper Peninsula via PBS affiliate WNMU and ABC affiliate WBUP. (PBS?? Do zombies like brie?)

The MichiGuide (“Michigan’s Radio and TV Broadcast Guide”) reported in very mangled English that:

“WNMU-TV station manager Eric Smith has also confirmed the intrusion and stated that the Northern Michigan University Public Safety Department, the Michigan State Police, and the Michigan Association of Broadcasters are involved in the investigation that this morning identified the origin of the hacking overseas.”

Should we blame China or Iran this week?

The fine folks at ThreatPost figured out how it all happened:

“There are a set of easily exploited vulnerabilities in the appliances used in the emergency alert system (EAS) that could be used by attackers to log in to these boxes remotely and send fake emergency alerts like the one that interrupted a TV broadcast in Montana on Monday. The vulnerabilities include authentication bypasses and other bugs that a researcher says can be used to compromise the ENDEC machines that are responsible for sending out alerts over the EAS on TV and radio.”

So it turns out we can now add the Emergency Alert System to our vulnerable critical infrastructure.

And now the rest of this week’s IT security news:

Sex sites out, IT sites in for cybercrooks planting malware

• (Network World) – It has long been a tactic by cybercriminals to load up compromised websites with malware-laden links to snare victims, but instead of it being the sex sites as of old, the favored type of website now is for information technology, according to analysis in the Websense

Hacker arrested after taunting police with clues attached to cat

• (Techworld) — Japanese police believe they have finally caught the man behind an extraordinary malware campaign that included taunting police in January by sending them clues on an SD card strapped to a cat. According to TV station NHK, 30 year-old Yusuke Katayama was picked up after Tokyo police accessed CCTV pictures that showed the accused near the animal not long before the memory card was retrieved from its collar. Katayama is alleged to have issued bomb threats against schools in the last six months, hijacking the PCs of uninvolved people using a Trojan in order to hide the origin of the messages. It later emerged that police had attempted to coerce confessions from four of the innocent suspects which led to a hugely embarrassing climbdown when they were shown to be uninvolved.

Google warns Myanmar reporters of ‘state-sponsored’ attack of Gmail accounts

• (IDG News Service) – A number of journalists covering Myanmar were warned by Google that their Gmail accounts had been targeted by “state-sponsored” attackers.

DHS: Kiss even more of your Civil Liberties goodbye 

• (Threatpost) — The Department of Homeland Security’s Office for Civil Rights and Civil Liberties has determined that the DHS’s warrantless, and often suspicion-less, search and seizure of electronics devices at U.S. borders does not violate the Fourth Amendment protection against unreasonable search or seizure.