US air traffic control 'vulnerable to hackers' says watchdog