FCC Alerts Broadcasters of Cybersecurity Threat

The Federal Communications Commission’s Public Safety and Homeland Security Bureau (PSHSB) has issued a Public Notice alerting broadcasters of a recent string of cybersecurity intrusions against radio broadcasters that resulted in the broadcasting of obscene materials and actual or simulated Emergency Alert System (EAS) tones.  According to the FCC, these cybersecurity intrusions were caused by compromised studio-transmitter links where the threat actor(s) often accessed improperly secured Barix equipment and reconfigured it to broadcast attacker-controlled audio in lieu of station programming.

As a result, the PSHSB has requested that broadcasters, especially those using Barix equipment, ensure that they have adequate cybersecurity measures in place.  Specifically, the FCC has recommended broadcasters to:

• Apply all software security patches and firmware updates promptly.
• Replace default passwords with strong alternatives and update them regularly.
• Secure equipment that is interconnected to the broadcast signal processing system behind firewalls and use VPNs for remote access.
• Monitor EAS equipment and software and audit logs for unauthorized activity.
• Report incidents of unauthorized access to the FCC’s Operations Center at [email protected] and report cyberattacks to the Federal Bureau of Investigation’s Internet Crime Compliant Center (IC3) at https://www.ic3.gov/.
• Review the FCC’s Communications Security, Reliability, and Interoperability Council’s best practices for EAS security.

The PSHSB has also recommended that broadcasters contact their EAS equipment manufacturers with any questions regarding the security of their equipment.