| Recurring |
unknown |
a) The software failure incident related to the 911 emergency system being disrupted by a TDoS attack has not been reported to have happened again within the same organization or with its products and services [47969].
b) The article mentions that denial-of-service attacks against 911 systems have been discussed as a concept at hacker conferences for years, and there have been instances where TDoS attacks were launched against the administrative lines of various 911 call centers as part of extortion plots [47969]. However, there is no specific mention of similar incidents happening at other organizations or with their products and services. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident related to the design phase can be seen in the article. The incident involves a vulnerability in the 911 emergency phone system that could be exploited by attackers to disrupt the system. Researchers found a way to disable the 911 system across an entire state by launching a TDoS attack, which involves infecting mobile phones to make bogus 911 calls and overwhelm call-center queues [47969].
(b) The software failure incident related to the operation phase is also evident in the article. The 911 system's limited call capacity and the potential for overwhelming call centers with just a small increase in call volume highlight operational vulnerabilities. The article mentions that the call capacity of 911 systems is exceptionally limited, with just three to five circuits processing all calls for a 911 center, making it trivial to overwhelm them [47969]. |
| Boundary (Internal/External) |
within_system, outside_system |
(a) within_system: The software failure incident described in the articles is primarily within the system. The failure involves a TDoS (telephony denial-of-service) attack on the 911 emergency phone system, which disrupts the system's ability to route calls to emergency responders. The attack is initiated by infecting mobile phones with malware that automatically makes bogus 911 calls, overwhelming call-center queues and preventing legitimate callers from reaching operators [47969]. The attack targets the infrastructure and operation of the 911 system itself, exploiting vulnerabilities in the call centers, routers, and network setup to disrupt the service.
(b) outside_system: The software failure incident also involves factors originating from outside the system. The attack is launched by external malicious actors who infect mobile phones with malware to create a botnet of phones, which is used to carry out the TDoS attack on the 911 system [47969]. The attackers exploit weaknesses in the design and operation of the 911 network, taking advantage of the limited call capacity and the lack of robust security measures to disrupt the service. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident occurring due to non-human actions:
The software failure incident described in the articles is related to a telephony denial-of-service (TDoS) attack on the 911 emergency phone system. This attack involves infecting mobile phones with malware to automatically make bogus 911 calls, which clog call-center queues and prevent legitimate callers from reaching operators. The attack can disrupt the 911 system across an entire state or even the nation by overwhelming the call capacity of the system. The attack is facilitated by infecting mobile phones to create a botnet that silently makes repeated 911 calls without the phone owners' knowledge, thus causing a denial-of-service situation [47969].
(b) The software failure incident occurring due to human actions:
The failure due to human actions in this incident involves the deliberate launching of TDoS attacks by attackers who infect mobile phones with malware to disrupt the 911 system. The attackers take advantage of vulnerabilities in the system and exploit the limited call capacity of 911 centers to overwhelm them with bogus calls. Additionally, the attackers use techniques to prevent authorities from halting the bogus calls, exacerbating the situation. The attack was also used as part of an extortion plot, where attackers demanded money and launched high volumes of calls against the target network when turned down [47969]. |
| Dimension (Hardware/Software) |
hardware, software |
(a) The software failure incident occurring due to hardware:
The article discusses a potential software failure incident related to hardware in the context of infecting mobile phones with malware to launch a TDoS attack on the 911 emergency system. The attackers could infect phones by sending malware through email attachments, text messages, or embedding malicious code in applications. The malware infects the phone's firmware, allowing the attacker to control the devices and command them to make repeated 911 calls silently in the background without the phone owner's knowledge. Additionally, the malware changes the International Mobile Subscriber Identity (IMSI) and International Mobile Equipment Identity (IMEI) numbers with each call to thwart blacklisting attempts by carriers [47969].
(b) The software failure incident occurring due to software:
The software failure incident discussed in the article primarily originates from software-related factors. The attack involves infecting mobile phones with malware that manipulates the phone's firmware to make bogus 911 calls, leading to a denial-of-service situation for the 911 system. The malware created by the researchers for their TDoS test infects the phone's firmware, allowing the attacker to control the devices and command them to repeatedly call 911 without the phone owner's awareness. The software aspect of this incident involves the creation and deployment of malicious code to exploit vulnerabilities in the 911 system's call processing mechanisms [47969]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident described in the articles is malicious in nature. The incident involves a TDoS (telephony denial-of-service) attack on the 911 emergency phone system, where attackers infect mobile phones to automatically make bogus 911 calls, clogging call-center queues and preventing legitimate callers from reaching operators [47969]. The attack is intentional and aimed at disrupting the 911 system, potentially causing harm by preventing emergency calls from getting through. The attackers exploit vulnerabilities in the system to launch the attack, indicating a malicious intent to disrupt critical infrastructure and emergency services. |
| Intent (Poor/Accidental Decisions) |
unknown |
The intent of the software failure incident described in the articles is related to poor_decisions. The incident involves a deliberate attack strategy known as a TDoS (telephony denial-of-service) attack, where attackers infect mobile phones to automatically make bogus 911 calls, clogging call-center queues and disrupting legitimate emergency calls [47969]. The attack is intentional and aimed at disrupting the 911 system, showcasing a malicious intent rather than accidental decisions or mistakes. |
| Capability (Incompetence/Accidental) |
unknown |
(a) The software failure incident occurring due to development incompetence:
The incident described in the articles is not related to development incompetence. Instead, it focuses on the potential vulnerability of the 911 emergency system to TDoS attacks, which are deliberate actions by attackers to disrupt the system by infecting mobile phones and causing them to make bogus 911 calls, overwhelming the call centers and preventing legitimate callers from reaching operators [47969].
(b) The software failure incident occurring accidentally:
The incident described in the articles is not related to accidental software failure. It specifically discusses the intentional nature of TDoS attacks on the 911 emergency system, where attackers deliberately infect mobile phones to disrupt the system's operations [47969]. |
| Duration |
temporary |
The software failure incident described in the articles is more aligned with a temporary failure rather than a permanent one. The incident involves a potential TDoS (telephony denial-of-service) attack on the 911 emergency system, which could disrupt the system for an extended period of time but is not a failure due to contributing factors introduced by all circumstances. The attack involves infecting mobile phones to make bogus 911 calls, clogging call-center queues and preventing legitimate callers from reaching operators. The attack could be prolonged for days using techniques that would prevent authorities from halting the bogus calls, and the problem would be exacerbated as legitimate callers trying to get through made repeated calls that further clogged the lines [47969]. |
| Behaviour |
other |
(a) crash: The software failure incident described in the articles does not involve a crash where the system loses state and does not perform any of its intended functions. Instead, the incident involves a telephony denial-of-service (TDoS) attack on the 911 emergency system, which disrupts the system's functionality by overwhelming it with bogus calls, preventing legitimate callers from reaching operators [47969].
(b) omission: The incident does not involve a failure due to the system omitting to perform its intended functions at an instance(s). Instead, the attack involves flooding the 911 system with bogus calls, which leads to the omission of legitimate calls being able to reach operators [47969].
(c) timing: The software failure incident is not related to a timing failure where the system performs its intended functions correctly but too late or too early. The incident is about disrupting the 911 system's operations by clogging call-center queues with bogus calls, affecting the system's ability to route legitimate emergency calls to responders in a timely manner [47969].
(d) value: The incident does not involve a failure due to the system performing its intended functions incorrectly. Instead, the attack aims to disrupt the 911 system's value in quickly routing calls to emergency responders by overwhelming the system with bogus calls, causing a significant impact on the system's effectiveness [47969].
(e) byzantine: The software failure incident does not exhibit a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. The incident involves a deliberate attack on the 911 system through a TDoS attack, which disrupts the system's normal operations by flooding it with fake calls, leading to a denial of service for legitimate emergency callers [47969].
(f) other: The behavior of the software failure incident can be categorized as a deliberate cyber attack aimed at disrupting the 911 emergency system's operations by overwhelming it with bogus calls. This behavior falls under the category of a security threat rather than a traditional software failure such as a crash, omission, timing issue, or value error [47969]. |