| Recurring |
one_organization, multiple_organization |
(a) The software failure incident having happened again at one_organization:
- Symantec revealed a new campaign of attacks by a group called Dragonfly 2.0, targeting dozens of energy companies in the US and Europe [63128].
- Symantec tracked the Dragonfly 2.0 attacks back to at least December of 2015, but found that they ramped up significantly in the first half of 2017, particularly in the US, Turkey, and Switzerland [63128].
- The hackers behind the Dragonfly 2.0 attacks shared many characteristics with an earlier set of intrusions called Dragonfly, Energetic Bear, Iron Liberty, and Koala, which targeted the US and European energy sectors from 2010 to 2014 [63128].
(b) The software failure incident having happened again at multiple_organization:
- Symantec reported that the recent hacker attacks compromised energy companies in the US and Europe, resulting in intruders gaining hands-on access to power grid operations [63128].
- Symantec found that the Dragonfly 2.0 attacks targeted dozens of energy companies in the spring and summer of the year [63128].
- The article mentions repeated hacker attacks on the Ukrainian grid that caused power outages in the country in late 2015 and 2016, which were attributed to a hacker group known as Sandworm [63128]. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident related to the design phase can be seen in the article where it mentions that the recent hacker attacks compromised energy companies in the US and Europe, resulting in the intruders gaining hands-on access to power grid operations. The hackers obtained operational access, control of the interfaces power company engineers use to send actual commands to equipment like circuit breakers, giving them the ability to stop the flow of electricity into US homes and businesses [63128].
(b) The software failure incident related to the operation phase is evident in the article where it describes how the hackers penetrated deep enough to screenshot the actual control panels for their targets' grid operations, positioning themselves to sabotage those systems at will. The attackers used spearphishing emails and watering hole attacks to harvest credentials from victims and gain remote access to their machines, ultimately gaining the ability to cause a blackout in the US [63128]. |
| Boundary (Internal/External) |
within_system, outside_system |
(a) within_system: The software failure incident described in the articles is primarily due to contributing factors that originate from within the system. The failure involved a series of hacker attacks on energy companies in the US and Europe, resulting in the intruders gaining hands-on access to power grid operations, including control of the interfaces power company engineers use to send actual commands to equipment like circuit breakers [63128]. The hackers were able to penetrate deep enough to screenshot the actual control panels for their targets' grid operations, positioning themselves to sabotage those systems at will [63128].
(b) outside_system: The software failure incident also involved contributing factors that originate from outside the system. The hackers gained access to the target companies' networks through spearphishing emails and watering hole attacks that compromised websites commonly visited by targets to hack victims' computers [63128]. Additionally, the hackers used freely available tools and existing vulnerabilities in software rather than previously unknown weaknesses, making attribution more difficult [63128]. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident in the articles is primarily related to non-human actions. The incident involved a series of hacker attacks by a group known as Dragonfly 2.0, which compromised energy companies in the US and Europe, gaining hands-on access to power grid operations. The hackers successfully gained operational access to power company networks, including control of the interfaces used to send commands to equipment like circuit breakers, potentially allowing them to induce blackouts on American soil [63128].
(b) While the software failure incident was primarily due to non-human actions, there were also human actions involved in the incident. The hackers behind the attacks used methods like spearphishing emails and watering hole attacks to trick victims into opening malicious attachments, compromising websites commonly visited by targets, and harvesting credentials to gain remote access to their machines. Additionally, the hackers may have been waiting for strategic opportunities to cause an electric disruption, such as during a political event or armed conflict, indicating a potential human decision-making aspect in the timing of the attack [63128]. |
| Dimension (Hardware/Software) |
software |
(a) The software failure incident related to hardware:
- The incident reported in the articles is not directly related to a hardware failure. Instead, it involves a cybersecurity breach where hackers gained access to power grid operations through software vulnerabilities and malware infections [63128].
(b) The software failure incident related to software:
- The software failure incident reported in the articles is primarily related to software vulnerabilities and malware infections that allowed hackers to compromise energy companies' networks and gain operational access to power grid operations, potentially leading to blackouts [63128]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The objective of the software failure incident was malicious, as it involved hacker attacks on energy companies in the US and Europe, resulting in the intruders gaining hands-on access to power grid operations with the potential to induce blackouts on American soil at will [63128]. The attacks were part of a campaign by a group called Dragonfly 2.0, which targeted dozens of energy companies and successfully gained operational access to control the interfaces power company engineers use to send actual commands to equipment like circuit breakers [63128].
(b) The software failure incident was non-malicious in the sense that the hackers mostly used freely available tools and existing vulnerabilities in software rather than previously unknown weaknesses, making attribution more difficult [63128]. The hackers behind the attacks were focused on stealing passwords and credentials to gain access to the targeted networks, indicating a non-malicious intent in terms of exploiting vulnerabilities rather than directly causing harm [63128]. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
The intent of the software failure incident described in the articles is more aligned with poor_decisions rather than accidental_decisions. The incident involved a deliberate and sophisticated hacking campaign by a group known as Dragonfly 2.0, which targeted energy companies in the US and Europe, gaining hands-on access to power grid operations with the potential to induce blackouts [63128]. The hackers used tactics such as spearphishing emails and watering hole attacks to compromise victims' computers and gain control over the interfaces power company engineers use to send commands to equipment like circuit breakers [63128]. This level of access and control indicates a strategic and intentional effort to potentially sabotage power grids, rather than a random or accidental occurrence. |
| Capability (Incompetence/Accidental) |
accidental |
(a) The software failure incident related to development incompetence is not explicitly mentioned in the provided article. Therefore, there is no direct evidence to suggest that the incident was caused by a lack of professional competence by humans or the development organization.
(b) The software failure incident related to accidental factors is evident in the article. The article discusses how a series of recent hacker attacks compromised energy companies in the US and Europe, resulting in the intruders gaining hands-on access to power grid operations. The attacks were initiated through spearphishing emails and watering hole attacks that tricked victims into opening malicious attachments or compromised websites commonly visited by targets to hack victims' computers [63128]. These accidental factors led to the successful penetration of the target companies' networks and the gaining of operational access, allowing the hackers to potentially induce blackouts on American soil. |
| Duration |
temporary |
The software failure incident described in the articles is more aligned with a temporary failure rather than a permanent one. The incident involved a series of hacker attacks by a group known as Dragonfly 2.0, targeting energy companies in the US and Europe. The hackers successfully gained access to the target companies' networks and even obtained operational access to control power grid operations, including the ability to stop the flow of electricity into US homes and businesses [63128].
The duration of this software failure incident is temporary because it was caused by specific circumstances, such as the successful cyberattacks by the hackers, rather than being a permanent failure due to inherent flaws in the system that would persist regardless of external factors. |
| Behaviour |
other |
(a) crash: The articles do not mention any software failure incident related to a crash where the system loses state and does not perform any of its intended functions.
(b) omission: The software failure incident described in the articles does not involve the system omitting to perform its intended functions at an instance(s).
(c) timing: The software failure incident does not involve the system performing its intended functions correctly, but too late or too early.
(d) value: The software failure incident does not involve the system performing its intended functions incorrectly.
(e) byzantine: The software failure incident described in the articles does not involve the system behaving erroneously with inconsistent responses and interactions.
(f) other: The software failure incident described in the articles involves a cybersecurity breach where hackers gained hands-on access to power grid operations, potentially being able to induce blackouts on American soil at will. This behavior falls under the category of a security breach rather than a specific software failure mode. |