This article originally appeared on VICE US
Control panels for lights placed on tall structures to warn airplanes not to hit them were exposed to the open internet, meaning hackers could have turned the lights off.
The news highlights how sensitive systems intended only for internal use by a certain team of people can accidentally be exposed to the wider internet, including those with malicious intent.
"I was thinking that this is something that can impact directly [lives] of people, by interfering with air traffic," Amitay Dan, an independent security researcher who discovered the issue, said in an online chat.
The issue was with "obstruction lighting" designed to alert aircraft to obstacles. Dan found at least 46 control panels online for light systems, including in Baltimore; Tuscola, IL; Decatur, TX; as well as Ontario in Canada, according to a list of IP addresses and other details he provided to Motherboard. The names of the systems' locations suggest some of the systems could have controlled lighting on tall cell phone towers.
One panel Dan showed Motherboard included controls such as "Force Day, "Force Twilight," and "Force Night."
Dan used a computer search engine to find the exposed systems, according to the original Federal Aviation Administration (FAA) disclosure email that Dan sent to the agency. Dan shared some of his correspondence with the FAA and the company that makes the light systems, called Dialight, with Motherboard.
"It appears that this vulnerability allows users to access the control panel of the Obstruction Light Control system, and provides controls to change the intensity of the light fixtures, turn them on, ..
Support the originator by clicking the read the rest link below.
