F5 products pose imminent risk to federal agencies

Federal cyber authorities issued an emergency directive last week requiring federal agencies to identify and apply security updates to F5 devices after the cybersecurity vendor said a nation-state attacker had long-term, persistent access to its systems. The order, which mandates federal civilian executive branch agencies take action by Wednesday, Oct. 22, marked the second emergency directive issued by the Cybersecurity and Infrastructure Security Agency in three weeks. CISA issued both of the emergency directives months after impacted vendors were first made aware of attacks on their internal systems or products. F5 said it first learned of unauthorized access to its systems Aug. 9, resulting in data theft including segments of BIG-IP source code and details on vulnerabilities the company was addressing internally at the time. CISA declined to say when F5 first alerted the agency to the intrusion. CISA officials said they’re not currently aware of any federal agencies that have been compromised, but similar to the emergency directive issued following an attack spree involving zero-day vulnerabilities affecting Cisco firewalls, they expect the response and mitigation efforts to provide a better understanding of the scope of any potential compromise in federal networks. Many federal agencies and private organizations could be impacted. CISA said there are thousands of F5 product types in use across executive branch agencies. Sens. Maria Cantwell, D-Wash., and Ted Cruz, R-Texas, moved to mandate comprehensive new safety reviews for all aircraft operations near DCA and at all major and mid-size U.S. airports, in a new bipartisan agreement that would also require fleets across the nation to be equipped with more precise situational awareness technology. Their proposal aims to resolve safety issues identified by the federal investigation into the tragic crash in January, where an Army UH-60M Black Hawk helicopter fatally collided with an American Airlines passenger plane over the Potomac River near Ronald Reagan Washington National Airport. All 67 people aboard both aircraft were killed in the collision. In a statement on Thursday, Tim and Sheri Lilley — whose son was the first officer onboard that AA Flight 5342 — called on Congress “to continue moving quickly and decisively to pass and fully implement these reforms, because every person who boards an aircraft depends on it.” The 42-page Cantwell-Cruz Bipartisan Aviation Safety Agreement combines elements of legislation the lawmakers previously put forward separately in the months after the fatal collision. It includes language that directs every military service with an aviation component to sign a memorandum of understanding with the Federal Aviation Administration to share appropriate safety information and expand coordination to prevent future accidents. Another safety failure that came to light in the wake of the crash was associated with the Army Black Hawk helicopter not transmitting via Automatic Dependent Surveillance–Broadcast (ADS-B) technology, which essentially enables aircraft to receive data and information about other systems, weather and traffic — delivered directly in the cockpit. The senators’ proposal would set a clear 2031 deadline for aircraft operators to equip their fleets with the full package of ADS-B capabilities. The Daily Scoop Podcast is available every Monday-Friday afternoon. If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.