FCC sounds alarm after emergency tones turned into potty-mouthed radio takeover

Malicious intruders have hijacked US radio gear to turn emergency broadcast tones into a profanity-laced alarm system. That's according to the latest warning issued by the Federal Communications Commission (FCC), which has flagged a "recent string of cyber intrusions" that diverted studio-to-transmitter links (STLs) so …

[Catkin]

Fun fact: it's illegal in the US to simply use the tone (853, 960Hz overlaid) in a non-emergency broadcast.

[Phil O'Sophical]

Ah, the joy of in-band signalling. The phone companies learned about that the hard way back in the 60s, haven't radio stations caught up yet?

[Gene Cash]

Nah, it's not in-band signalling, they just want to make sure people associate that sound with an emergency, They don't want morons to dilute the urgency of it by using it as a special effect or something.

[DS999]

Its like a song with sirens

If you hear that in your car and you aren't familiar with the song you will check your mirrors to see if there's an ambulance behind you. Or back in the day when Nokia phones and that specific ring were ubiquitous, if that was on a TV show you might reach for your phone.

They want that type of reaction to only happen when there's an emergency broadcast, and not allow people to become desensitized to it.

[ChrisC]

Re: Its like a song with sirens

These days, having a TV show featuring a Ring doorbell can result in much the same type of response...

[Anonymous Coward]

Yeah, it is.

It is indeed in-band signaling, which originated in the old EBS (Emergency Broadcast System) from the 1960s. The intent was to have primary EBS stations broadcast the specific tones -- which were chosen due to the unlikelihood of their occurring accidentally in typical broadcast material -- and receivers at downstream stations would trip automatically, alerting the staff to take predetermined actions. Worked quite well, too.

[doublelayer]

Re: Yeah, it is.

A small but crucial correction: it was in-band signalling. Now it's not. You can't cause that cascade by broadcasting those tones alone anymore.

[Fruit and Nutcase]

Blue Box

In the 1970s, a pair of enterprising blokes came up with the Blue Box...

https://en.wikipedia.org/wiki/Blue_box

[KittenHuffer]

"playing an extremely vulgar track"?

So something by The Macc Lads then?!?

[BartyFartsLast]

Robbie Roadsteamer

[Anonymous Coward]

Star Trekking? Actually, no, that one was at least funny.

"Oh Superman" from Laurie Anderson

:)

[David 132]

"Je t'aime (Moi Non Plus)" by Jane Birkin and Serge Gainsbourg?

Apparently my grasp of what is "vulgar" is a little out of date :)

[Fruit and Nutcase]

A cover/parody version of the same by Frankie Howerd and June Whitfield, like the original got banned by the BBC

[tiggity]

I'm guessing the FCC interpretation of "extremely vulgar track" differs from a lot of UK people.

Mentioning the Macc Lads makes me feel old, remember first seeing them in the late 80's

[DarkwavePunk]

Yet...

Funding for cyber security keeps getting cut at a federal level. It's a bit of a mess.

[Anonymous Coward]

Re: Yet...

WTF does the federal cybersecurity budget (which should be larger than it currently is) have to do with terrible, or terribly configured, Swiss-made commercial radio equipment? Nothing.

I'm not sure why they didn't go after a larger provider like iHeartMedia, Cumulus,or Townsquare Media.

[Ididntbringacoat]

Re: Yet...

Well, AC, how about the inability (presumed) to higher competent Technical and Supervisory personnel?

[Spazturtle]

Re: Yet...

Why would the federal government be paying for cybersecurity staff for private companies?

[Mike 137]

"best practices" ????

● promptly patching and updating firmware

● replacing default passwords with strong alternatives (and rotating them periodically)

● putting EAS and other critical audio gear behind firewalls or VPN-protected networks

● restricting remote management to authorized devices

● systematically auditing logs for suspicious access attempts

Assuredly, the assumption that these are "best practices" is a prime source of our abysmal level of cybersecurity. They're the absolute minimum basics.

[MachDiamond]

Re: "best practices" ????

"● replacing default passwords with strong alternatives (and rotating them periodically)"

I've never seen the point of rotating passwords just because. That leads to people needing to write them down on sticky notes and affix them to their monitors so they don't forget what's current.

[david 12]

Re: "best practices" ????

There are reasons for rotating passwords, that have to do with the source and nature of password leakage.

But I think that the main *value* of password rotation comes from situations where overall password handling is *very very bad*.

I recall one situation where all of the users had the same database login and password. When it was compromised, the first action was to change the password

This used to be very common: it is the original use case. And the original use case included password rotation" -- password of the day -- pass, friend.

[Claptrap314]

Re: "best practices" ????

Of course NIST changed their recommendation away from periodic rotation in, wait for it, 2017. It's kinda scary that a commentard would not be aware...

[MachDiamond]

Re: "best practices" ????

"Of course NIST changed their recommendation away from periodic rotation in, wait for it, 2017."

Hmm, the US Copyright office never heard about that. They require a new password every 90 days and I file around, wait for it, every 90 days for full protection. If I forget my password since it changes so often, it's dead easy to have it reset. Now where's that security again?

[Rory B Bellows]

Pump up the Volume

Eat your cereal with a fork, and do your homework in the dark

[MachDiamond]

Re: Pump up the Volume

"Eat your cereal with a fork, and do your homework in the dark"

Just don't believe that a cute young woman is going to hunt you down and take her clothes off for running a pirate radio station.

[Fruit and Nutcase]

Re: Pump up the Volume

Just don't believe that a cute young woman is going to...

He could be like Professor Simon Peach (Benny Hill) in the Italian Job

[dirigible]

Fines?

So, will the responsible (in the sense that it’s their transmitter) radio stations be fined for sending the emergency tones and dirty words to the Æther?

After all, it’s not just the loss of a gazillion customer records, youngins will hear shit on the radiowaves! (The three amish children that still listen to radio.)

(see icon)

[Doctor Syntax]

"Broadcasters are also urged to alert the FCC etc"

Only urged rather than required?

[powershift]

yeah, right

I'd like to hear what was said before believing it was offensive. It could have been the truth and that in itself could be offensive to the FCC.

[Anonymous Coward]

Re: yeah, right

It was a broadcast by the President aka "Moscow Russ"

[JulieM]

Whisky Tango Foxtrot

Why were they using the public Internet for studio-to-TX links, as opposed to private leased lines with tamper detection?

And how did they get hold of the correct private keys to sign the content?

[IGotOut]

It's lucky it was so benign...

If it's a potty mouth tirade, then most people would go WTF? Then move on.

If it had alarms going then a convincing voice had said "China has just launched several hundred missiles bound for the USA. They are due to arrive in the next 26 minutes. Please take shelter and await further instructions" I'd say all hell would have broken lose.

[Anonymous Coward]

Re: It's lucky it was so benign...

"China has launched 10,000 incendiary devices at the US. Amazon is expected to deliver them in the next 72 hours. They may be identified by the iphone charge cable included in the package"

[Fruit and Nutcase]

Full of holes

unsecured broadcasting equipment, notably devices manufactured by Swiss firm Barix

Swiss Cheese

[Mostly Irrelevant]

They should be glad this came out this way instead of as part of an organized attack by a foreign state actor.

[Anonymous Coward]

explicit and highly offensive content

In highly conservative America that could be anything.

https://youtu.be/bf9d7rSf_Ks?si=UuehLffYLhEnK_ok