US air traffic control computer system vulnerable to terrorist hackers

The US system for guiding airplanes is open to vulnerabilities from outside hackers, the Government Accountability Office said Monday. The weaknesses that threaten the Federal Aviation Administration's ability to ensure the safety of flights include the failure to patch known three-year-old security holes, the transmission and storage of unencrypted passwords, and the continued use of "end-of-life" key servers.
The GAO said that deficiencies in the system that monitors some 2,850 flights at a time has positioned the air traffic system into an "increased and unnecessary risk of unauthorized access, use or modification that could disrupt air traffic control operations." What's more, the report said the FAA "did not always ensure that sensitive data were encrypted when transmitted or stored." That information included stored passwords and "authentication data."
Among the findings:

While the Federal Aviation Administration (FAA) has taken steps to protect its air traffic control systems from cyber-based and other threats, significant security control weaknesses remain, threatening the agency's ability to ensure the safe and uninterrupted operation of the national airspace system (NAS). These include weaknesses in controls intended to prevent, limit, and detect unauthorized access to computer resources, such as controls for protecting system boundaries, identifying and authenticating users, authorizing users to access systems, encrypting sensitive data, and auditing and monitoring activity on FAA's systems. Additionally, shortcomings in boundary protection controls between less-secure systems and the operational NAS environment increase the risk from these weaknesses.

The flying public's safety is in jeopardy until there's a fix to the system used at some 500 airport control towers, the GAO said. (PDF) "Until FAA effectively implements security controls, establishes stronger agency-wide information security risk management processes ... the weaknesses GAO identified are likely to continue, placing the safe and uninterrupted operation of the nation's air traffic control system at increased and unnecessary risk."
The report chided the agency for failing to perform basic functions:

Additionally, the agency did not always ensure that security patches were applied in a timely manner to servers and network devices supporting air traffic control systems, or that servers were using software that was up-to-date. For example, certain systems were missing patches dating back more than 3 years. Additionally, certain key servers had reached end-of-life and were no longer supported by the vendor. As a result, FAA is at an increased risk that unpatched vulnerabilities could allow its information and information systems to be compromised.

Senators immediately demanded an explanation from the Transportation Department, which oversees the FAA.

"These vulnerabilities have the potential to compromise the safety and efficiency of the national airspace system, which the traveling public relies on each and every day," said John Thune (R-S.D.) and Bill Nelson (D-Fla.).

The transportation agency said it was working to correct the problems and has achieved "major milestones" toward that goal.