Incident: Cyberattack on US Airport Websites by Russian Hackers.

Published Date: 2022-10-10

Postmortem Analysis
Timeline 1. The software failure incident happened on Monday morning, as mentioned in [Article 134011]. 2. The articles were published on 2022-10-10. 3. Therefore, the software failure incident occurred on Monday morning, October 10, 2022.
System 1. Websites for more than a dozen US airports, including LaGuardia airport in New York City, Chicago’s O’Hare international airport, Atlanta Hartsfield-Jackson international airport, and Los Angeles international airport were taken offline by cyberattacks [134011, 133559, 134028]. 2. Public-facing airport websites, including those for some of the nation’s largest airports, were inaccessible due to the cyberattack [133559]. 3. Communication networks in Germany’s railway systems were also targeted by a similar attack [134011]. 4. The cyberattack involved distributed denial of service (DDoS) attacks, which flood computer servers with traffic to render them non-functional [134011, 133559, 134028].
Responsible Organization 1. Killnet group of Russian-speaking hackers [134011, 133559, 134028]
Impacted Organization 1. Public-facing websites for more than a dozen US airports, including LaGuardia airport in New York City, Chicago’s O’Hare international airport, Atlanta Hartsfield-Jackson international airport, and Los Angeles international airport were impacted by the cyberattacks [134011, 133559, 134028].
Software Causes 1. The software cause of the failure incident was a cyberattack carried out by a group of pro-Russian hackers known as Killnet, who used distributed denial of service (DDoS) attacks to flood computer servers with traffic, rendering the websites of multiple U.S. airports inaccessible to the public [134011, 133559, 134028].
Non-software Causes 1. The cyberattacks on the airport websites were attributed to a group known as Killnet, Russian hacktivists supporting the Kremlin ([134011], [133559], [134028]). 2. The cyberattacks were part of a broader trend of targeting organizations in NATO countries following Russia's invasion of Ukraine ([133559]). 3. The cyberattacks were carried out using distributed denial of service (DDoS) attacks, where hackers flood computer servers with phony web traffic to render them non-functional ([134011], [133559], [134028]). 4. The cyberattacks were coordinated by the Killnet group through a list posted on their Telegram channel, which included several major U.S. airports as targets ([134028]).
Impacts 1. The software failure incident resulted in the temporary unavailability of public-facing websites for more than a dozen US airports, including LaGuardia airport in New York City, Chicago’s O’Hare international airport, Atlanta Hartsfield-Jackson international airport, and Los Angeles international airport [134011, 133559, 134028]. 2. The cyberattacks caused a denial of public access to airport websites, impacting travelers' ability to access information such as airport wait times and capacity information [134011, 133559]. 3. The disruption was characterized as an inconvenience for travelers seeking travel information, but it did not affect air traffic control, internal airport communication, or other key operations [134011, 133559]. 4. The software failure incident was attributed to a group of pro-Russian hackers known as Killnet, who favor distributed denial of service (DDoS) attacks [134011, 133559, 134028]. 5. The cyberattacks were considered more of a "public nuisance" than serious security threats, as they did not target major internal systems that could affect airport operations [134028]. 6. While the websites were knocked offline, the hackers did not gain access to the airports' systems, and there were no operational disruptions at the airports [134028].
Preventions 1. Implementing robust cybersecurity measures such as firewalls, intrusion detection systems, and regular security audits to prevent cyberattacks like DDoS attacks [Article 134011, Article 133559, Article 134028]. 2. Enhancing network security protocols and ensuring proper encryption of sensitive data to protect against unauthorized access [Article 134011, Article 133559, Article 134028]. 3. Conducting regular cybersecurity training for employees to raise awareness about potential threats and how to mitigate them [Article 134011, Article 133559, Article 134028]. 4. Collaborating with government agencies like the FBI and CISA to share threat intelligence and enhance overall cybersecurity posture [Article 134028]. 5. Implementing multi-factor authentication for accessing critical systems to prevent unauthorized access in case of a breach [Article 134011, Article 133559, Article 134028].
Fixes 1. Implementing robust cybersecurity measures to prevent future cyberattacks, such as distributed denial of service (DDoS) attacks, by enhancing network security and monitoring systems [134011, 133559, 134028]. 2. Conducting thorough investigations to identify vulnerabilities in the affected websites and addressing them to prevent similar incidents in the future [134011, 133559, 134028]. 3. Enhancing coordination and communication between government agencies like the Cybersecurity and Infrastructure Security Agency (CISA), Transportation Security Administration (TSA), and airport authorities to respond effectively to cyber threats [134011, 133559, 134028]. 4. Increasing awareness and training for airport staff and IT teams on cybersecurity best practices to mitigate the risk of future cyberattacks [134011, 133559, 134028]. 5. Collaborating with cybersecurity experts and firms to continuously monitor and assess the security posture of airport websites and systems to proactively detect and prevent potential cyber threats [134011, 133559, 134028].
References 1. Senior official (unnamed source) - [Article 134011] 2. Group known as Killnet - [Article 134011, Article 133559, Article 134028] 3. Cybersecurity and Infrastructure Security Agency (CISA) - [Article 134011, Article 133559, Article 134028] 4. Transportation Security Administration (TSA) - [Article 134011, Article 133559, Article 134028] 5. FBI - [Article 134028] 6. John Hultquist, vice president for intelligence at Mandiant - [Article 134028] 7. Port Authority of New York/New Jersey - [Article 134028] 8. Denver International Airport officials - [Article 134028] 9. Los Angeles International Airport managers - [Article 134028]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - The group known as Killnet, which was responsible for the recent cyberattacks on US airport websites, has been involved in similar incidents before. Killnet had previously targeted US state government websites and even briefly downed a US Congress website in July [Article 133559]. - The Los Angeles International Airport website was also affected by the recent cyberattack, but it was restored shortly after. The airport's information technology team is investigating the cause of the disruption, indicating a recurrence of such incidents [Article 134028]. (b) The software failure incident having happened again at multiple_organization: - The cyberattacks on US airport websites were not isolated incidents, as similar attacks also targeted communication networks in Germany's railway systems, causing massive service disruptions in the northern part of the country [Article 134011]. - The hacking group Killnet has targeted organizations in NATO countries and has been involved in cyberattacks on organizations in Lithuania as well. These incidents show a pattern of attacks on multiple organizations beyond just airports [Article 133559].
Phase (Design/Operation) design (a) The software failure incident in the articles was primarily due to design-related factors introduced by the cyberattacks on the airport websites. The cyberattacks, attributed to the group Killnet, utilized distributed denial of service (DDoS) attacks to flood computer servers with traffic, rendering the websites non-functional [134011, 133559, 134028]. These attacks disrupted public access to airport websites, affecting the reporting of airport wait times and capacity information. The incident did not directly impact air traffic control or internal airport communication but caused inconvenience to travelers seeking information [134011]. (b) The software failure incident was not primarily due to operation-related factors introduced by the operation or misuse of the system. The articles emphasize that the cyberattacks did not disrupt airport operations or compromise internal airport systems. The attacks targeted public-facing websites of airports, causing temporary outages but not affecting the core operational functions of the airports [134011, 133559, 134028]. The Transportation Security Administration (TSA) confirmed that the cyberattack did not disrupt airport operations, and the websites being knocked offline did not result in hackers gaining access to airport systems [134028].
Boundary (Internal/External) within_system, outside_system (a) within_system: - The software failure incident involving the cyberattacks on US airport websites was primarily within the system. The attacks were carried out by a group of hackers known as Killnet, who used distributed denial of service (DDoS) attacks to flood computer servers with traffic, rendering the websites non-functional [Article 134011, Article 133559, Article 134028]. - The Port Authority of New York/New Jersey mentioned that LaGuardia Airport's website experienced a denial of service incident, which was detected by their cybersecurity defense system, indicating that the issue originated within the system [Article 134028]. (b) outside_system: - The software failure incident was also influenced by factors outside the system. The cyberattacks were attributed to a group known as Killnet, Russian hacktivists who support the Kremlin but are not directly government actors. The loosely organized hacktivists are politically motivated to support the Kremlin, but their ties to Moscow are unknown, suggesting external influence [Article 134011, Article 133559]. - The attacks were not tied to any foreign state, indicating that the source of the cyberattacks was external to the airport systems [Article 134011].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident was caused by a cyberattack carried out by a group of pro-Russian hackers known as Killnet, who used distributed denial of service (DDoS) attacks to flood computer servers with traffic, rendering the websites of several U.S. airports inaccessible to the public [134011, 133559, 134028]. - The cyberattacks did not directly target major internal systems that could affect airport operations but rather aimed at disrupting public-facing websites to cause inconvenience and draw public attention [134028]. - The Cybersecurity and Infrastructure Security Agency (CISA) is investigating the incident and coordinating with potentially impacted entities to offer assistance as needed [134028]. (b) The software failure incident occurring due to human actions: - The hackers responsible for the cyberattack are identified as Russian-speaking hacktivists known as Killnet, who support the Kremlin but are not directly linked to the Russian government [134011, 133559]. - The group targeted multiple U.S. airports' websites as part of their activities, which escalated after Russia's invasion of Ukraine [133559]. - The Transportation Security Administration (TSA) is monitoring the issue and working with airport partners to address the cyber threats [134011, 133559].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - The articles do not mention any hardware-related issues contributing to the software failure incident. Therefore, there is no information available regarding hardware-related factors in this incident. (b) The software failure incident occurring due to software: - The software failure incident in this case was primarily attributed to a cyberattack carried out by a group of pro-Russian hackers known as Killnet. The hackers used a distributed denial of service (DDoS) attack to flood computer servers with traffic, rendering the websites of several U.S. airports inaccessible to the public [134011, 133559, 134028].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident was malicious, as it was caused by cyberattacks carried out by a group of pro-Russian hackers known as Killnet. These hackers used distributed denial of service (DDoS) attacks to flood computer servers with traffic, rendering the websites of multiple U.S. airports inaccessible to the public [134011, 133559, 134028]. (b) The software failure incident was non-malicious in the sense that there were no reported impacts on actual air travel operations. The disruption caused by the cyberattacks was more of an inconvenience for travelers seeking information from the affected airport websites. Additionally, the Cybersecurity and Infrastructure Security Agency (CISA) stated that there were no concerns about operational disruptions at the airports [133559, 134028].
Intent (Poor/Accidental Decisions) unknown (a) poor_decisions: The software failure incident related to the cyberattacks on US airport websites was not due to poor decisions but rather a deliberate and malicious act by a group of hackers known as Killnet. The hackers used distributed denial of service (DDoS) attacks to render the websites non-functional, causing inconvenience to travelers seeking information. The attacks were politically motivated to support the Kremlin, but ties to Moscow are unknown [134011, 133559, 134028]. (b) accidental_decisions: The software failure incident was not a result of accidental decisions but a deliberate cyberattack orchestrated by the Killnet hacking group. The attack involved flooding computer servers with phony web traffic to knock the airport websites offline. The incident was not accidental but a targeted and intentional act by the hackers [134011, 133559, 134028].
Capability (Incompetence/Accidental) accidental (a) The software failure incident related to development incompetence is not explicitly mentioned in the provided articles. (b) The software failure incident was accidental, as it was caused by a cyberattack carried out by a group of pro-Russian hackers known as Killnet. The hackers used distributed denial of service (DDoS) attacks to flood computer servers with traffic, causing the websites of several U.S. airports to go offline. The incident was characterized as a "public nuisance" rather than a serious security threat, as it did not target major internal systems that could affect airport operations [Article 134028].
Duration temporary The software failure incident related to the cyberattacks on multiple US airport websites was temporary. The incident caused the websites of several airports, including LaGuardia, O’Hare, Hartsfield-Jackson, and LAX, to be taken offline temporarily by the distributed denial of service (DDoS) attacks carried out by the group known as Killnet [134011, 133559, 134028]. The websites were eventually restored, and there were no reported impacts on actual air travel operations. The attacks were characterized as a "public nuisance" rather than serious security threats, as they did not target major internal systems that could affect airport operations [134028].
Behaviour crash, other (a) crash: - The software failure incident in the articles can be categorized as a crash as the websites for multiple U.S. airports, including LaGuardia airport in New York City, Chicago’s O’Hare international airport, Atlanta Hartsfield-Jackson international airport, and Los Angeles international airport, were taken offline by cyberattacks, rendering them non-functional temporarily [134011, 133559, 134028]. - The incident resulted in a denial of public access to airport websites that report important information for travelers, such as wait times and capacity information [134011]. - The cyberattacks caused interruptions and inconveniences for travelers attempting to access information from the affected airport websites [134011, 133559, 134028]. (b) omission: - There is no specific mention of the software failure incident being categorized as an omission in the articles. (c) timing: - The software failure incident does not align with the timing category as it is not related to the system performing its intended functions too late or too early. (d) value: - The incident does not fall under the value category, which refers to the system performing its intended functions incorrectly. (e) byzantine: - The software failure incident does not exhibit characteristics of a byzantine failure, which involves the system behaving erroneously with inconsistent responses and interactions. (f) other: - The behavior of the software failure incident can be categorized as a denial of service (DoS) attack, specifically a distributed denial of service (DDoS) attack, where hackers flooded the computer servers of the airport websites with traffic to render them non-functional temporarily [134011, 133559, 134028]. - The incident was described as a "public nuisance" by John Hultquist, a vice president at Mandiant, emphasizing that such attacks draw public attention but do not target major internal systems that could affect airport operations [134028].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence unknown (a) death: People lost their lives due to the software failure (b) harm: People were physically harmed due to the software failure (c) basic: People's access to food or shelter was impacted because of the software failure (d) property: People's material goods, money, or data was impacted due to the software failure (e) delay: People had to postpone an activity due to the software failure (f) non-human: Non-human entities were impacted due to the software failure (g) no_consequence: There were no real observed consequences of the software failure (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? The articles do not mention any consequences related to death, physical harm, impact on access to food or shelter, or impact on material goods, money, or data due to the software failure incident. The primary consequence discussed in the articles is the inconvenience caused to travelers seeking information from the affected airport websites. The disruption mainly led to denial of public access to airport websites, affecting the ability of travelers to access information on wait times and capacity [Article 134011, Article 133559, Article 134028].
Domain information, transportation, government (a) The failed system was related to the information industry as it involved the production and distribution of information through public-facing websites for several US airports [134011, 133559, 134028]. (b) The transportation industry was impacted by the software failure incident as the cyberattacks targeted airport websites, affecting the ability of travelers to access information about airport wait times and capacity [134011, 133559, 134028]. (l) The government sector was also affected by the software failure incident as the cyberattacks targeted public-facing websites of US airports, leading to disruptions in accessing essential information for travelers. The FBI and Transportation Security Administration were notified about the cyberattacks, and the Cybersecurity and Infrastructure Security Agency (CISA) was involved in investigating the incident [134011, 133559, 134028].

Sources

Back to List