The FCC issued the Notice of Proposed Rulemaking FCC-22-82 last week in an effort to shore up security vulnerabilities discussed recently. The vulnerabilities include the usual easy-to-guess passwords, lack of EAS device software updates, and so on. The FCC wants to require broadcasters and cable operators to report cyber threats to their EAS equipment within 72 hours and file a cybersecurity risk management plan with the FCC for their EAS system. The commission also wants broadcasters to download and install security patches for their EAS gear.

[FROM FEMA Advisory published 8/1/2022]

We recently became aware of certain vulnerabilities in EAS encoder/decoder devices that, if not updated to most recent software versions, could allow an actor to issue EAS alerts over the host infrastructure (TV, radio, cable network).

This exploit was successfully demonstrated by Ken Pyle, a security researcher at CYBIR.com, and may be presented as a proof of concept at the upcoming DEFCON 2022 conference in Las Vegas, August 11-14.

In short, the vulnerability is public knowledge and will be demonstrated to a large audience in the coming weeks.

FEMA strongly encourages EAS participants to ensure that:

1. EAS devices and supporting systems are up to date with the most recent software versions and security patches;
2. EAS devices are protected by a firewall;
3. EAS devices and supporting systems are monitored and audit logs are regularly reviewed looking for unauthorized access.

The FCC issued on April 21, 2022 a Notice of Inquiry to explore alternative approaches to solving issues regarding good receiver design, or the lack thereof.