| Recurring |
unknown |
(a) The software failure incident related to a cyberattack involving a logic bomb that wiped the hard drives of computers in South Korea does not indicate a similar incident happening again at the same organization or with its products and services [17638].
(b) The software failure incident involving the cyberattack with a logic bomb in South Korea does not mention a similar incident happening again at other organizations or with their products and services [17638]. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident in South Korea, where banks and broadcasting companies were targeted by a cyberattack, was attributed to a logic bomb in the code. The logic bomb dictated the date and time the malware would begin erasing data from machines, coordinating the destruction across multiple victims [17638].
(b) The operation of the malware involved triggering the wiping of hard drives and master boot records on Microsoft Windows machines at a specific date and time. The malware also included a module for deleting data from remote Linux machines by searching for remote connections and using stored credentials to access Linux servers and wipe their master boot record [17638]. |
| Boundary (Internal/External) |
within_system, outside_system |
(a) within_system: The software failure incident in South Korea, where banks and broadcasting companies had their hard drives wiped by a cyberattack, was caused by a logic bomb within the code of the malware. The logic bomb was set to trigger the wiping process at a specific date and time, coordinating the destruction across multiple victims [17638].
(b) outside_system: The cyberattack that led to the software failure incident in South Korea was initiated by external factors, specifically a phishing email that contained a malicious attachment. This attachment, posing as coming from a bank, was actually a downloader that fetched multiple files from different URLs, leading to the installation of the malware responsible for the attack [17638]. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident in South Korea was primarily caused by a logic bomb in the code, which was a non-human action. The logic bomb dictated the date and time for the malware to begin erasing data from machines, leading to the coordinated destruction across multiple victims [17638].
(b) Human actions also played a role in the incident as the malware was distributed through a phishing email that contained a malicious attachment purporting to come from a bank. This attachment was actually a downloader that initiated the attack on the machines. Additionally, there was confusion about the involvement of a hacking group called WhoIs, which may have been attempting to associate themselves with the attacks [17638]. |
| Dimension (Hardware/Software) |
software |
(a) The software failure incident in South Korea was primarily due to a logic bomb in the code, which was a contributing factor originating in the software itself. The logic bomb dictated the date and time for the malware to begin erasing data from machines, leading to the wiping of hard drives and master boot records of banks and media companies [17638].
(b) The software failure incident was also attributed to a malware attack that included a malicious attachment containing a Trojan, which was a software-related contributing factor. The malware triggered the wiping mechanism on machines, leading to the deletion of data from remote Linux machines as well [17638]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident in South Korea was malicious in nature, as it was caused by a cyberattack involving a logic bomb in the code that wiped the hard drives of computers belonging to banks and broadcasting companies. The attack was coordinated to begin erasing data across multiple victims at a specific date and time, indicating a deliberate intent to harm the systems [17638]. Additionally, the attack included a module for deleting data from remote Linux machines, showing a comprehensive and targeted approach to causing damage [17638].
(b) There is no information in the articles to suggest that the software failure incident was non-malicious. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
(a) The intent of the software failure incident was likely due to poor_decisions. The cyberattack that wiped the hard drives of computers in South Korea was set off by a logic bomb in the code, indicating a deliberate and malicious act [17638]. Additionally, the malware included a module for deleting data from remote Linux machines, showing a strategic and intentional effort to cause damage not just to desktops but also to infrastructure [17638]. The attack was coordinated to occur simultaneously across multiple victims, demonstrating a planned and targeted approach [17638]. |
| Capability (Incompetence/Accidental) |
development_incompetence, accidental |
(a) The software failure incident in South Korea, where banks and broadcasting companies were targeted by a cyberattack involving a logic bomb, could be attributed to development incompetence. The logic bomb was intentionally set to trigger the wiping of hard drives and master boot records at a specific date and time, indicating a deliberate act of malicious coding by the attackers [17638].
(b) The incident could also be considered accidental to some extent, as the malware used in the attack was initially delivered through a phishing email that contained a malicious attachment posing as coming from a bank. This suggests that the initial infection may have occurred unintentionally through unsuspecting users opening the attachment, leading to the subsequent triggering of the wiping mechanism [17638]. |
| Duration |
permanent |
(a) The software failure incident described in the articles was permanent. The cyberattack that wiped the hard drives of computers belonging to banks and broadcasting companies in South Korea was triggered by a logic bomb in the code, which dictated the date and time the malware would begin erasing data from machines [17638]. The attack wiped the hard drives and master boot record of at least three banks and two media companies simultaneously, causing significant damage and disruption. The malware included a mechanism to overwrite the hard drive and master boot record on Microsoft Windows machines and then reboot the system, rendering the affected machines inoperable [17638].
(b) The software failure incident was not temporary as the attack resulted in permanent damage to the affected systems, with the malware wiping data and causing disruption that required significant recovery efforts. The incident was not a transient glitch or error but a deliberate and destructive cyberattack that had lasting consequences on the targeted organizations [17638]. |
| Behaviour |
crash, omission, timing, value, other |
(a) crash: The software failure incident in South Korea involved a cyberattack that wiped the hard drives of computers belonging to banks and broadcasting companies. The malware triggered the wiping of hard drives and master boot records on Microsoft Windows machines, causing them to crash and display a message stating, "Boot device not found. Please install an operating system on your hard disk" [17638].
(b) omission: The malware in the attack omitted to perform its intended functions on remote Linux machines by wiping their master boot records. It searched for remote connections and used stored credentials to access Linux servers and delete data, indicating an omission in the system's intended functions [17638].
(c) timing: The software failure incident was timed to begin the wiping process at a specific date and time dictated by a logic bomb in the code. The malware was set to trigger the wiping on March 20, 2013, at 2 pm local time, demonstrating a timing-related failure [17638].
(d) value: The incident involved a failure in the system's value as it performed its intended functions incorrectly. The malware was designed to erase data from machines belonging to banks and media companies, causing financial disruptions and preventing South Koreans from withdrawing cash from ATMs [17638].
(e) byzantine: The software failure incident did not exhibit a byzantine behavior as described in the articles.
(f) other: The software failure incident also involved a phishing email with a malicious attachment that contained a Trojan. This additional behavior of spreading malware through phishing emails is another aspect of the incident not covered by the options (a) to (e) [17638]. |