Emergency Alert System: Vulnerable Systems Double, Despite Zombie Hoax

A security report describes vulnerabilities in Monroe Electronics' DASDEC EAS appliances: a root-privileged SSH key embedded in firmware and published factory default passwords which have been leveraged to compromise devices. IOActive's Internet scans found the number of exposed, potentially vulnerable DASDEC systems increased after a patch was released, indicating many customers have not applied fixes; attackers previously exploited default credentials to broadcast a bogus 'zombie' emergency alert.