Finding Barix and Other Unsecured Devices Easy

Last updated at Sat, 19 Aug 2017 03:50:27 GMT

Note: Rebekah Brown was the astute catalyst for the search for insecure broadcast equipment and the major contributor to this post.

Reports have surfaced recently of local radio station broadcasts being hijacked and used to play anti-Donald Trump songs (https://www.rt.com/viral/375935-trump-song-hacked-radio/). The devices that were taken over are Barix Exstream systems, though there are several other brands of broadcasters, including Pkyo, that are configured and setup the same way as these devices and would also be vulnerable to this type of hijacking.

Devices by these manufacturers work in pairs. In the most basic operating mode, one encodes and transmits a stream over an internal network or over the internet and the other receives it and blasts it to speakers or to a transmitter.

Because they work in tandem, if you can gain access to one of these devices, you have information about the other one, including the IP address and port(s) it's listening on. After seeing the story, we were curious about the extent of the exposure.

The View from the Control Room

We reviewed the January 31, 2017 port 80 scan data set from Rapid7's Project Sonar to try to identify Barix Instreamer/Exstreamer devices and Pyko devices based on some key string markers we identified from a cadre of PDF manuals. We found over a thousand of them listening on port 80 and accessible without authentication. They seem to be somewhat popular on almost every continent and are especially popular here in the United States.

Many of these devices have their administration interfaces on something besides port 80, so this is likely just a sample of the scope of the problem.

Because they operate in pairs, once you gain access to one device, you can learn about their counterparts directly from the administration screens:

It's trivial to reconfigure either the source or destination points to send or receive different streams and it's likely these devices go untouched for months or even years. It's also trivial to create a script to push a new configuration to all the devices very quickly (we estimated five minutes or less).

What is truly alarming is not only are these devices set up to be on the internet without any sort of authentication, but that this issue has been brought up several times in the past. The exposure – which in this case, is really a misconfiguration issue and not strictly a software vulnerability – was identified as early as April 2016, and this specific hijacking technique emerged shortly after the inauguration.

Coming Out of a Spot

The obvious question is that if this issue was identified nearly a year ago, why are there still systems that are susceptible on the internet? The answer is that just because an issue is identified does not automatically mean that the individuals responsible for securing them are aware that they are vulnerable or of what the impact would be. As much as we as an industry talk about information sharing, often we aren't sharing the right information with the right people. Station owners and operators do not always have a technical or security background, and may not read the security news or blogs. Even when the main stream media published information on the impacted model and version, system operators may not know that they are using that particular model for their broadcast, or they may simply miss the brief media exposure.

We cannot and should not assume that people are aware of the issues that are discovered, and therefore we are making a greater effort to inform U.S. station owners by reaching out to them directly in coordination with the National Coordinating Center for Communications (COMM-ISAC) and the National Association of Broadcasters (NAB). We've offered not only to inform these operators that they are vulnerable, but also to help them understand the technical measures that are required to secure their systems, down to walking through how to set a password. What is intuitive to some is not always intuitive to others.

Cross Fade Out

While hijacking a station to play offensive music is certainly not good, the situation could have been — and still can be — much more serious. There are significant political tensions in the U.S. right now, and a coordinated attack against the nearly 300 devices we identified in this country could cause targeted chaos and panic. Considering how easy it is to access and take control of these devices, a coordinated hijacking of these broadcast streams is not such a far-fetched scenario, so it is imperative to secure these systems to reduce the potential impact of future attacks.

You can reach out to research@rapid7.com for more information about the methodology we used to identify and validate the status of these devices.

baransusair.blogspot.com

Source: https://www.rapid7.com/blog/post/2017/02/06/on-air-broadcasting-insecurity/