• To anyone looking to acquire commercial radio programming software:

    Please do not make requests for copies of radio programming software which is sold (or was sold) by the manufacturer for any monetary value. All requests will be deleted and a forum infraction issued. Making a request such as this is attempting to engage in software piracy and this forum cannot be involved or associated with this activity. The same goes for any private transaction via Private Message. Even if you attempt to engage in this activity in PM's we will still enforce the forum rules. Your PM's are not private and the administration has the right to read them if there's a hint to criminal activity.

    If you are having trouble legally obtaining software please state so. We do not want any hurt feelings when your vague post is mistaken for a free request. It is YOUR responsibility to properly word your request.

    To obtain Motorola software see the Sticky in the Motorola forum.

    The various other vendors often permit their dealers to sell the software online (i.e., Kenwood). Please use Google or some other search engine to find a dealer that sells the software. Typically each series or individual radio requires its own software package. Often the Kenwood software is less than $100 so don't be a cheapskate; just purchase it.

    For M/A Com/Harris/GE, etc: there are two software packages that program all current and past radios. One package is for conventional programming and the other for trunked programming. The trunked package is in upwards of $2,500. The conventional package is more reasonable though is still several hundred dollars. The benefit is you do not need multiple versions for each radio (unlike Motorola).

    This is a large and very visible forum. We cannot jeopardize the ability to provide the RadioReference services by allowing this activity to occur. Please respect this.

Hackers take down county Harris P-25 Phase II system

dlwtrunked

Member
Premium Subscriber
Joined
Dec 19, 2002
Messages
2,375
I can guess what has happened. One of the biggest problems with modern day radio systems is using the same devices and interfaces as I-T. Most I-T people think they own and have free rein over RJ45s, mux and routers. Only 5% seem to have the expertise and common sense to stay away from public safety's radio IT system. You don't know how many foreign RJ45's I have pulled then went nose to nose with them. I wish the industry would have standardized on a RJ46XWYZ that is colored bright red!

BTW: The same 95% think I-T is exempt from all laws of physics especially lightning! Their point to point microwave has a special blessing with increased range/reliability that common carrier and public safety microwave lacks!

Also it is very easy to blame all problems on "hackers". Unless someone catches them or shows what they actually did, I would treat "hackers caused it" with a grains of salt. Several times I have had PC problems which friends, some with extensive IT experience, have said I have been hacked but are not aware that I have already discovered another reason for the problem. It has become an extension of the conspiracy thinking that has become rampant. Of course, there is a true hacking problem though and precautions need to be taken (personally, I think all critical systems should be completely kept off INTERNET and kept encrypted).
 

mmckenna

I ♥ Ø
Joined
Jul 27, 2005
Messages
25,115
Location
United States
And L3Harris just sent out….

L3Harris InfoSec Notification (ISN) #0042 | Threat Actors Actively Attacking VPN via Brute Force



Category: InfoSec Notification
Subject: Threat Actors Actively Attacking VPN via Brute Force
Threat Actors are using brute force activity against Virtual Private Networks (VPN) protecting public safety networks. Threat Actors with enough time, have demonstrated the ability to compromise single factor authentication systems (i.e. a username/password combination) resulting in LMR system outages.
 

RFI-EMI-GUY

Member
Joined
Dec 22, 2013
Messages
7,386
What made you leery? Done properly, Cloud can provide availability and resiliency far beyond any locally owned physical installation, as long as the business case fits.
What mmckenna said. The equipment belongs to, is controlled by, someone else. No independent way to verify physical security to "cloud". Its the cloud and subject to failing circuits outside the realm of the customer.

Cloud Clowns promise "best effort". I got that from a carpenter recently. Had to hire another to fix and finish the job.
 

RFI-EMI-GUY

Member
Joined
Dec 22, 2013
Messages
7,386
Our dispatchers have separate computers for that. Anything radio/911 related is buried behind firewalls, access control lists in routers, etc. Even then, it's dangerous. I wish it was airgapped, but that's difficult to do with modern systems.

Many years ago some well meaning IT person that runs the "automatic force feed updates to all computers on the network" decided that updating the radio console PC's to the latests/greatest windows version was a wise idea. Some network guy left that hole in the firewall open. Took about 2 hours to get everything restored and some very tense conversations with some IT individuals about not *^&#ing around with radio/911 stuff, no matter what their manager told them.
I could never understand Motorola's rush to embrace Windows for dispatch operations. The console, 911 and and communications do not need to be wading in that quagmire just "for convenience".
 

mmckenna

I ♥ Ø
Joined
Jul 27, 2005
Messages
25,115
Location
United States
I could never understand Motorola's rush to embrace Windows for dispatch operations. The console, 911 and and communications do not need to be wading in that quagmire just "for convenience".

Windows has worked OK for us, but it's (now) well protected on the network and locked down. They are still running XP, as that's what our old radio console supports. As long as the IT guys don't start screwing around with them, they've been mostly OK. Occasionally one takes a dump, but rebooting it is easy enough.

Soon to be replaced, but once Microsoft stopped constantly trying to "fix" it and we got it sufficiently isolated from the rest of the network, it has been partially tolerable. I'll still be happy to see them go.
 

RFI-EMI-GUY

Member
Joined
Dec 22, 2013
Messages
7,386
Windows has worked OK for us, but it's (now) well protected on the network and locked down. They are still running XP, as that's what our old radio console supports. As long as the IT guys don't start screwing around with them, they've been mostly OK. Occasionally one takes a dump, but rebooting it is easy enough.

Soon to be replaced, but once Microsoft stopped constantly trying to "fix" it and we got it sufficiently isolated from the rest of the network, it has been partially tolerable. I'll still be happy to see them go.
I would still be using XP at home if it were not for the browser security issues. Win 10 has proven to be a huge annoying learning curve for me, as the office suite, Word, Excel, etc, Acrobat and associated programs are very counterintuitive compared to old versions I got to be a power user on. Even cutting and pasting between programs is crippled.
 

mmckenna

I ♥ Ø
Joined
Jul 27, 2005
Messages
25,115
Location
United States
Yeah, we're running it only for a Zetron radio console, nothing else. I think XP was the last version I felt comfortable with. I have a new Windows laptop for radio programming, and it's just so loaded with windows bloatware that likes to turn itself back on after the frequent windows updates.
 

cifd64

Member
Joined
Oct 27, 2007
Messages
612
Location
Northern Passaic County, NJ
Harris released an ISN the leads me to believe that someone left the door visible, not necessarily open, but visible. They are calling it a Brute Force attack. The systems I worked on, the first thing we do is remove VPN Access from everyone, including Harris. Our system spend less than an hour a year, if that, exposed to the outside world. Recently, we've made it policy and part of maintenance contracts that any prolonged access requirements be handled in person, on-site. It seems that while not explicitly stated, this is likely what happened in KS. Someone left the door open.
 

PACNWDude

Member
Joined
Oct 15, 2012
Messages
1,407
Prepping for a M core with DSR upgrade, MCC7500's running Windows 10......but PC's kept from updates on any network (we did not purchase "hardening" but firewall/border router dispatch sites).

I had a dispatcher complain because her PC had a little yellow triangle that said "No Internet" while the others did not show that (wonderful Windows indicators), as she had just rebooted her console computer. I had to explain that none of the dispatch PC's have Internet access.

When I worked at Zetron, we had a script that would set up console PC's to prevent cell phone charger, external hard drives and other devices from adding malware to the network (Win XP, 7, then 10), but saw some of the Microsoft influence on the console computers, as we had hired a lot of people from Microsoft. Eventually, I found my self and another engineer teaching classes of new hires the basics of radio and 9-1-1 Dispatch, since many came from countries that did not have this system, but some local process that might be similar, but not standardized.

I have seen some dispatch entities take network security seriously and others, not so much. There is an industrywide "security through obscurity" issue, and attitude that USB ports on dispatch computers, are free to use for whatever. then the IT attitude that if it is a network device, it must be upgraded to the latest and greatest as patches and updates come out, often without testing beforehand. If XP works and PC's never touch the outside world, great.....I know many places that continue to use that configuration. Routers and switches, well Motorola systems with acl files, leave them alone IT! Even making them get GROL's often does not keep them from messing with a public safety radio network.

Our M core and DSR backup is not hosted in the cloud as Motorola would like, and they do NOT have remote access, they must come to us and be escorted.....perhaps this Harris network could have been kept secure through physical and procedural security measures?
 

MTS2000des

5B2_BEE00 Czar
Joined
Jul 12, 2008
Messages
5,629
Location
Cobb County, GA Stadium Crime Zone
Changing default IP schemes, default passwords, removing default root accounts are a must. Anyone who doesn't do it is lazy, incompetent and shouldn't be in their position if they don't understand the implications of not doing so. When I was first hired, my old division chief did that just after staging and got a lot of people upset "why would you want to change the defaults". Now you know why.
 

longrf01

Newbie
Premium Subscriber
Joined
Jul 24, 2021
Messages
2
At the risk of reviving a dead threat, but ...

Actual conversations:

Exec: "I'm so glad this new vendor H system uses COTS hardware and OSs."
Me: "Oh?"
Exec: "Yes - now that it's all Cisco routers, switches, and Windows, Linux VMs running on VMware, we can dump the radio guys and transfer it to IT. And since we offshore IT to India we'll be able to dump five people who cost nearly $100k fully loaded for some $3k/year contractors. And won't actually hire more contractors, just add this to their workload!"
Me: "Remember when someone (eh hem) said the same about VoIP phones and how we could dump the telecom guys at have IT handle it? And offshoring support was great until the US-based users revolted because the offshore people were hard to understand and also didn't understand why it would take more than 30 minutes to get a phone from Chicago to Orlando?"
Exec: "Well, that was different, now we know that voice is a specialized application and just like all our other apps it needs specialists to support it."
Me: "Think about what you just said."
Exec: "Well anyways radioguy, this more of a strategy sharing session than a feedback solicitation session."
.... Later that day ...
Exec: "Hey Vendor H, I'm told your new NSC uses Windows xxxx release yyy and your Cisco devices are running IOS zzzz. Our Information Assurance team has determined those versions are unacceptable and highly vulnerable. We're upgrading the NSCs to ..."
Vendor "H" : "Don't do that. We will send a bulletin once we've throughly tested those versions. Besides, your NSCs are firewallled from the rest of the network so this vulnerability can't even be exploited unless you're plugged in on the NSC side of the firewall."
Exec: "Hey ITguy - vendor H is being difficult and doesn't share our comprehensive vision of all IT in the enterprise running a common IA approved release. Go ahead and upgrade it. We're not going to wait for them, because IA flags it as vulnerable and I don't want to go through the hassle of getting an exception and having to explain something I don't really understand to the Risk Management Committee of the Board."
... Later that day ...
Everything broken.
Everyone panicking.
Exec: "Radioguy, what the heck did you do wrong! Vendor H, we've spent many millions and look at how lousy your system is working."
Me: "IT did what you told them to. It was a compatibility issue."
Exec: "Well why didn't you add your NSC VMs as Configuration Items (CIs) to the IT Service Management (ITSM) application and build an approval workflow which automatically triggers when a CHG ticket is opened against those CIs to get a documented objection?"
Me: "I have no foggy clue what you're talking about."
Exec: "This is standard IT terminology and processes from the ITIL standards."
Me: "Yeah, so we here in radioland don't have access to those IT systems and no knowledge of how that works."
Exec: Basically says that when Vendor H switched to using COTS equipment we should have magically, perhaps by osmosis, learned all about IT processes.

So Harris does what, in some ways, is a sensible thing - use COTS hardware instead of re-inventing the wheel. And on paper, having the same hardware and operating systems that the Company is familiar with sounds good. But one it becomes and "IT System" and they try to manage it like it's any other IT system, things fail. Badly.

The truth of the matter is that it only works right when radio guy, IT guy, and vendor H all work together. There's no way on Earth radioguy is going to know all the quirks, best practices, and issues with the latest version of VMware and how VMs should be dimensioned. And IT guy has no idea about the ISSI, P25 over-the-air interface, Erlangs and traffic queueing theory, and fleetmapping. And no one except Vendor H knows the little bugs, quirks and issues which necessitate certain configs. In fact, Vendor H probably subs half the software development out so they don't know all the gory details either. Hence why technical questions now take three days to be answered because the vendor has to go behind their curtain to the sub on another continent and ask them.

And sometimes it's good to have those annoying IA guys around. For example, when you need to setup two MPLS pipes to a statewide system for roaming and only they can convince the exec that even if it is the state of ___, you still must drop the coin to put a firewall pair between those MPLS circuits and NSC and pray to the deity of your choice that the state of __ did the same on their end.

Someone once said interop is not a technical problem, it's a political one. Deja vu.
 

ElroyJetson

Getting tired of all the stupidity.
Joined
Sep 8, 2002
Messages
3,881
Location
Somewhere between the Scylla and Charybdis
I'm an idiot when it comes to IT but even I can understand how to secure a multisite radio system. Leased private fiber (or microwave links) from site to site, all network traffic stays within that network, airgap any computer connected to the outside world. And of course, huge security around those computers that WILL occasionally have to be connected, the details of which I'd leave to someone who knows IT far better than me.

And when someone says "It's better when you connect it to the internet!", punch him right in the mouth until he stops.

Sadly I predict this incident won't be the last one. We'll see more systems taken down by hackers. It's just a matter of time.
What REALLY concerns me is physical damage to sites by threat actors who are more focused, not just on taking down "any network they can hack into", but actors who are specifically focused on destroying an entity's RF communications network.

My own county has some tower sites where the anchor points for the towers aren't even protected by so much as a chain link fence. And some are right alongside a road that doesn't get much traffic. Any idiot with a concrete saw could slingshot that anchor in 30 seconds. PUT A FENCE AROUND IT, DAMMIT!!!
 

mmckenna

I ♥ Ø
Joined
Jul 27, 2005
Messages
25,115
Location
United States
And when someone says "It's better when you connect it to the internet!", punch him right in the mouth until he stops.

My challenge is that we are (unfortunately) part of the larger IT organization.
Most IT guys don't know anything about two way radio systems, but they assume "it must be something like WiFi".

Challenges I've had, and so far been able to shield my systems from:

"Why are we spending all that money on a radio system, can't the officers just use WiFi? We could better invest that money in improving Wireless network coverage.".​
"Your radio system has a subscriber access control database, we want our database admins to help you run it."​
"Our data center needs to house the hardware so it's secure"​
"Our data center has a 1 hour UPS and a backup generator, your system would be much more reliable in here."​
And about a hundred other little challenges that pop up day to day. Mostly people wanting to "help", but often people trying to build their own little kingdom.

A fair amount of my job is protecting our systems from the internal IT guys that "just want to help". Hackers concern me, but not as much as our own people. Most of the issues I run into comes from someone assuming that a network change won't impact things, but then they knock down entire systems. "Oh, sorry, we weren't aware".

I agree, air gap everything, but make sure your own internal IT guys are not allowed to come in a "fix" things.
 

ElroyJetson

Getting tired of all the stupidity.
Joined
Sep 8, 2002
Messages
3,881
Location
Somewhere between the Scylla and Charybdis
I don't have the specs of it but my county's RF sites all have 50KW backup generators and the attached fuel tanks are pretty big, I suspect it's a few day's worth of run time without refueling. A 1 hour backup time spec is laughable! The system is in prime hurricane territory so I would expect that the backup power system is spec'ed for at LEAST three days operation without refueling. I wouldn't be surprised if it's meant to run a week without refueling. Fuel tanks aren't really very expensive.

A 50KW generator should consume less than 4 GPH at full load. That's just 672 gallons a week, and a double wall UL rated 1000 gallon fuel tank is under 5 grand. Less than the cost of one high tier radio.
 

eorange

♦RF Enabled Member♦
Joined
Aug 20, 2003
Messages
3,028
Location
Cleveland, OH
A fair amount of my job is protecting our systems from the internal IT guys that "just want to help". Hackers concern me, but not as much as our own people. Most of the issues I run into comes from someone assuming that a network change won't impact things, but then they knock down entire systems. "Oh, sorry, we weren't aware".
That's a really poor operating model. It's common to bash "the IT guys", but really this comes down to a lack of investment in proper control and change management. Either an organization does it right, or they don't.
 

mmckenna

I ♥ Ø
Joined
Jul 27, 2005
Messages
25,115
Location
United States
I don't have the specs of it but my county's RF sites all have 50KW backup generators and the attached fuel tanks are pretty big, I suspect it's a few day's worth of run time without refueling. A 1 hour backup time spec is laughable!

Yeah, the guy that ran the data center at the time couldn't understand how my -48v plants with inverter could run my systems for 20+ hours, even with out a generator. His mind just didn't understand that sort of stuff.

All our generators have multiple days of on site fuel.
 

mmckenna

I ♥ Ø
Joined
Jul 27, 2005
Messages
25,115
Location
United States
That's a really poor operating model. It's common to bash "the IT guys", but really this comes down to a lack of investment in proper control and change management. Either an organization does it right, or they don't.

We have a pretty good change management system and have for many years.

The problem was that they didn't view telecom/radio as an IT service, no matter how many times we pointed out that our systems sat on the network. The criticality of 911 and public safety radio services don't fit well into their pre-canned processes that are designed around keeping websites up, databases functioning, and the more traditional "IT" services going.

It took a change they approved taking down some of our services to change that. Now, after asking for 2 years, I finally have one of my guys on the change management team that meets weekly. We've been able to stop a few changes that would have been blindly approved and would have knocked some of our systems off line.

But, hey, s*** breaks and that's what keeps us all making the big bucks. If things went smoothly all the time, they may decide to replace us with moderately well trained monkeys.
 

PACNWDude

Member
Joined
Oct 15, 2012
Messages
1,407
We have a pretty good change management system and have for many years.

The problem was that they didn't view telecom/radio as an IT service, no matter how many times we pointed out that our systems sat on the network. The criticality of 911 and public safety radio services don't fit well into their pre-canned processes that are designed around keeping websites up, databases functioning, and the more traditional "IT" services going.

It took a change they approved taking down some of our services to change that. Now, after asking for 2 years, I finally have one of my guys on the change management team that meets weekly. We've been able to stop a few changes that would have been blindly approved and would have knocked some of our systems off line.

But, hey, s*** breaks and that's what keeps us all making the big bucks. If things went smoothly all the time, they may decide to replace us with moderately well trained monkeys.
Even with a daily change management meeting with IT, we still have issues and problems that fall through the cracks.

However, the biggest issue for us is retirement of current employees without replacement. The fear is that it may become actual IT workers running the radio system through attrition, and some sites are going contractor/vended out soon.

A couple of the current radio techs are also more amateur radio/IT that bring their ideas to the table not even understanding P25 basics, (we run P25 Phase 1/2 and Trbo networks across the country - 58 cities).

We need to replace Aeroflex/Viavi 3920 test sets (going Astronics this time), and that budget meant no new hires this year.

Only when something crashes and burns will it get any better.
 
Top