| Recurring |
one_organization, multiple_organization |
(a) The software failure incident related to a critical vulnerability in the Tridium Niagara AX Framework has happened again within the same organization or with its products and services. Security researchers Billy Rios and Terry McCorkle, who have found numerous vulnerabilities in the Tridium system and other industrial control systems in the last two years, demonstrated a zero-day attack on the system at the Kaspersky Security Analyst Summit [17030]. This indicates that the organization has faced similar security vulnerabilities in the past.
(b) The software failure incident related to the Tridium Niagara AX Framework vulnerability has also affected multiple organizations. The vulnerability allows attackers to remotely control various critical building facilities managed by the system, such as electronic door locks, lighting systems, elevators, electricity and boiler systems, video surveillance cameras, and alarms [17030]. The Tridium systems are used in various facilities worldwide, including a government office complex in Chicago, a British Army training facility, Boeing's manufacturing facilities, Changi airport in Singapore, and the Four Points Sheraton hotel in Sydney, among others. Additionally, security researchers found around 21,000 Tridium systems visible over the internet, indicating a widespread impact on multiple organizations [17030]. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident in the article is related to the design phase. The vulnerability in the Tridium Niagara AX Framework allowed attackers to remotely control critical building facilities by exploiting a zero-day attack on the system. Security researchers Billy Rios and Terry McCorkle demonstrated a remote, pre-authenticated vulnerability that, combined with a privilege-escalation bug, gave them root access to the system's platform [17030]. This indicates that the failure was due to contributing factors introduced during the system development phase.
(b) The software failure incident is also related to the operation phase. The vulnerability allowed attackers to remotely access the system's configuration data, including usernames and passwords to log in to operator workstations and control the systems managed by them. This means that the failure was also influenced by the operation or misuse of the system, as attackers were able to exploit the system's features to gain unauthorized access and control over critical building facilities [17030]. |
| Boundary (Internal/External) |
within_system |
(a) The software failure incident described in the articles is primarily within_system. The vulnerability in the Tridium Niagara AX Framework, which allowed attackers to remotely control critical building facilities, was due to a flaw within the system itself. Security researchers Billy Rios and Terry McCorkle demonstrated a zero-day attack on the system, exploiting a remote, pre-authenticated vulnerability and a privilege-escalation bug to gain root access on the system's platform [17030]. The incident was a result of vulnerabilities present in the software system rather than external factors. |
| Nature (Human/Non-human) |
non-human_actions |
(a) The software failure incident in this case was primarily due to non-human actions, specifically a critical vulnerability discovered in the Tridium Niagara AX Framework that allowed attackers to remotely control various building facilities without human participation [17030]. |
| Dimension (Hardware/Software) |
hardware, software |
(a) The software failure incident in the Tridium Niagara AX Framework was primarily due to hardware-related vulnerabilities. Security researchers Billy Rios and Terry McCorkle discovered a critical vulnerability in the industrial control system that allowed attackers to remotely control various building facilities such as electronic door locks, lighting systems, elevators, and more [17030]. The vulnerability in the Tridium system's platform, which is written in Java, allowed the researchers to exploit a remote, pre-authenticated vulnerability and a privilege-escalation bug to gain root access on the system's platform [17030]. This hardware-related vulnerability in the system's platform enabled the attackers to access sensitive configuration data and control the managed systems.
(b) The software failure incident also had contributing factors originating in software. The vulnerability in the Tridium Niagara AX Framework allowed attackers to remotely access the system's config.bog file, which contained all the system's configuration data, including usernames and passwords for operator workstations [17030]. The attack exploited a zero-day vulnerability in the system, demonstrating a flaw in the software's design that allowed unauthorized access and control over critical building facilities [17030]. The software flaw in the Tridium system's platform, combined with the privilege-escalation bug, facilitated the attackers in gaining unauthorized access and control over the system. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident described in the articles is malicious in nature. Security researchers Billy Rios and Terry McCorkle discovered a critical vulnerability in the Tridium Niagara AX Framework that would allow attackers to remotely control various critical building facilities, such as electronic door locks, lighting systems, elevators, and surveillance cameras [17030]. They demonstrated a zero-day attack on the system, exploiting a remote, pre-authenticated vulnerability that gave them root access to the system's platform [17030]. Additionally, they developed a backdoor module to maintain access to the system once compromised [17030]. This incident highlights how the vulnerability could be exploited by malicious actors to gain unauthorized control over essential building systems. |
| Intent (Poor/Accidental Decisions) |
unknown |
(a) The intent of the software failure incident was not due to poor decisions. The vulnerability in the Tridium Niagara AX Framework that allowed attackers to remotely control critical building facilities was exploited by security researchers Billy Rios and Terry McCorkle, who demonstrated a zero-day attack on the system at the Kaspersky Security Analyst Summit [17030]. The researchers notified the company about the vulnerability, and Tridium has been working on a patch to fix the issue [17030].
(b) The software failure incident was not due to accidental decisions. The vulnerability in the Tridium Niagara AX Framework was exploited by the security researchers through a zero-day attack, indicating a deliberate attempt to demonstrate the vulnerability and potential risks associated with it [17030]. |
| Capability (Incompetence/Accidental) |
development_incompetence |
(a) The software failure incident in this case can be attributed to development incompetence. The vulnerability in the Tridium Niagara AX Framework was discovered by security researchers Billy Rios and Terry McCorkle, who have found numerous vulnerabilities in the Tridium system and other industrial control systems in the last two years [17030]. The attack exploited a remote, pre-authenticated vulnerability combined with a privilege-escalation bug, allowing the researchers to gain root access on the system's platform [17030]. The incident highlights the importance of professional competence in software development to prevent such vulnerabilities.
(b) The software failure incident can also be considered accidental. The vulnerability in the Tridium Niagara AX Framework was not intentionally created but was discovered by the security researchers during their analysis of the system [17030]. The researchers notified the company about the vulnerability, and Tridium has been working on a patch to fix the issue, which they planned to release in response to the incident [17030]. This accidental discovery of the vulnerability underscores the importance of thorough security testing and continuous monitoring to identify and address potential weaknesses in software systems. |
| Duration |
temporary |
The software failure incident described in the article is more likely to be temporary rather than permanent. This is because the vulnerability in the Tridium Niagara AX Framework was discovered by security researchers Billy Rios and Terry McCorkle, who then notified the company about the vulnerability in December and Tridium has been working on a patch to fix the vulnerability, which they expected to release by February 13 [17030]. This indicates that the failure was due to specific circumstances (the vulnerability) and efforts were being made to address and rectify the issue, making it a temporary failure. |
| Behaviour |
other |
(a) crash: The software failure incident described in the articles does not involve a crash where the system loses state and does not perform any of its intended functions. Instead, the vulnerability in the Tridium Niagara AX Framework allows attackers to remotely control various critical building facilities [17030].
(b) omission: The software failure incident does not involve omission where the system omits to perform its intended functions at an instance(s). The vulnerability allows attackers to remotely access the system's configuration data, including usernames and passwords, and control the systems managed by the operator workstations [17030].
(c) timing: The software failure incident is not related to timing issues where the system performs its intended functions correctly but too late or too early. The vulnerability allows attackers to remotely control electronic door locks, lighting systems, elevators, and other critical building facilities [17030].
(d) value: The software failure incident does not involve a failure where the system performs its intended functions incorrectly. Instead, the vulnerability in the Tridium Niagara AX Framework allows attackers to gain unauthorized access and control over critical building systems [17030].
(e) byzantine: The software failure incident does not exhibit a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. The vulnerability allows attackers to exploit a remote, pre-authenticated vulnerability to gain root access on the system's platform [17030].
(f) other: The software failure incident involves a security vulnerability that allows attackers to remotely access and control various critical building facilities through the exploitation of the Tridium Niagara AX Framework. The incident highlights a significant security flaw in the system that could have serious implications for the security of military, hospital, and other facilities using the affected industrial control system [17030]. |