Decades ago, Orson Welles pranked the nation with his radio broadcast of “The War of the Worlds.”  With a very short message that this was fiction, which many missed, he sent hundreds or thousands of people into a panic, with nothing more than a voiced description of flying saucers, and tripods from Mars.  But we’re more sophisticated now!

And maybe we are.  Have you seen the “Caution! Zombies Ahead!” Road signs? It turns out it’s not just the CDC who’s concerned about the implications of a zombie apocalypse – a number of hackers with a sense of humor are, as well.

These warning signs are easy to reprogram with a default password, and provide a way to reset the password if they actually did change it.

Montana residents got an emergency alert TV warning message that the dead are rising from their graves!  Apparently KRTV and The CW (locally) had their federal emergency alert system hacked as a prank. (unless they are actually experiencing a zombie invasion. Not likely, but keeping my options open).

Moral of the story? We all recognize these as pranks, so no harm really done.  However, if these systems are this carelessly constructed, and some bad actor was actually out to cause trouble…How hard would it be to push people out of their work, into a street, use signs to direct them together (or apart), cause trouble, blackouts, confusion, and panic?

<Emergency Alert> There is a bomb in an office building in this city!  Evacuate all office buildings now!

<Road sign outside> Evacuate!  Run!!

That’s not a prank.  That’s going to kill people.  So the pranks are cute, and we all laugh.

But our job is to make sure things aren’t quite this easy to tamper with.  Not a laughing matter.  Let’s fix them.

Related News

Joshua Marpet is on the Board of Directors of two Infosec conferences, BSides Las Vegas, and Security BSides Delaware. He is also staff at Derbycon, Shmoocon, and as the "InfoSec Megaphone", anywhere else he goes. Joshua is an experienced Forensic, Incident Response, and mobile forensics expert and researcher. As an adjunct professor at Wilmington University, he teaches Information Security at an NSA/DHS certified Center of Academic Excellence. In his professional life, he is a managing partner at Guarded Risk, a proactive forensics and proactive incident response firm.