On Saturday, December 13, County 10 received calls from both the Lander and Riverton Police Department Chiefs after multiple listeners tuning in to 90.1 FM KRWY called law enforcement to report that a radio station had apparently been hacked.
The station, which has no affiliation with County 10 radio stations, had ceased broadcasting regular content and was instead airing the same one-minute recording on repeat.
The recording began with what sounded like a standard EAS alert tone, followed by a voice urging listeners to go to a specific YouTube channel. After that first message, the recording then transitioned to a reworded nursery rhyme laced with racial slurs directed toward African Americans, interspersed with an individual shouting the same slur over and over for about 45 seconds before the same EAS-like tone rang again, and the recording repeated itself.
(Note: County 10 has chosen not to share the name of the YouTube channel or include the recording, just in case there is a possibility that interacting with the channel could lead to a virus or another hacking situation.)
It is unknown at this time how long the recording had been airing on 90.1 FM, but as of this posting, the station has been taken off the air by its ownership until the situation can be resolved.
Similar incidents have occurred in other parts of the country in the past few weeks, including an ESPN station in Houston, which prompted the station to issue the following statement at the time: “In the past hour, there was audio airing on 97.5 FM signal that didn’t come from the radio station. Our signal had been hacked. We are actively trying to rectify the problem. We appreciate the many of you who posted to alert us of the issue.”
Those reported incidents also included that same EAS-like tone, the same voice recommending the YouTube channel, and various racial slurs mixed with profanity and mock nursery rhymes with racially-charged wording.
Following that incident and a few other similar reports, the Federal Communications Commission’s Public Safety and Homeland Security Bureau issued a notice on November 26 urging broadcasters to ensure the security of their networks.
“It appears that these recent hacks were caused by a compromised studio-transmitter link (the broadcast equipment that carries program content from the studio to remote transmitters), with threat actors often accessing improperly secured Barix equipment and reconfiguring it to receive attacker-controlled audio in lieu of station programming,” the notice states. “Affected stations broadcast to the public an attacker-inserted audio stream that includes an actual or simulated Attention Signal and EAS alert tones, as well as obscene language, and other inappropriate material.”
The FCC also advised that all broadcasters, “especially those using Barix equipment,” do the following:
- Install software security patches issued by the equipment manufacturer as soon as they become available, and upgrade equipment firmware and software to the most recent versions recommended by the manufacturer.
- Change their devices’ default passwords and replace them with robust alternatives, and regularly change passwords to promote continued security.
- Where reasonably feasible, install EAS, Barix, and other equipment interconnected to the broadcast signal processing system behind network firewalls, and utilize VPNs that are configured to limit remote management access to only authorized devices.
- Continually monitor EAS equipment and software and review audit logs to detect and report incidents of unauthorized access.
- Review the list of recommended best practices to address potential data security vulnerabilities issued by the Communications Security, Reliability, and Interoperability Council in 2014. Communications Security, Reliability and Interoperability Council IV, Initial Report, EAS Security Subcomm. Report at 10-13 (2014).
“We encourage broadcasters to contact their EAS equipment manufacturers with any specific questions regarding the security of EAS equipment,” the FCC notice concludes. “If you suspect that broadcast equipment has been subject to attempts at unauthorized access, we recommend you contact the equipment manufacturer and/or a data security firm. We strongly encourage broadcasters who suspect unlawful access to their systems to notify the FCC Operations Center at 202-418-1122 or FCCOPCenter@fcc.gov, and to report any cyberattacks to the Federal Bureau of Investigation’s Internet Crime Complaint Center (IC3).