| Recurring |
one_organization, multiple_organization |
(a) The software failure incident related to vulnerabilities in control software affecting drones has happened again within the same organization or with its products and services. The article mentions incidents such as viruses infecting drone cockpits, leaking classified video streams, and malware ordering nuclear centrifuges to self-destruct, among others. These incidents highlight the vulnerabilities in the control software of drones and other important systems [55145].
(b) The software failure incident related to vulnerabilities in control software affecting drones has also happened at multiple organizations or with their products and services. The article discusses how various systems, including drones, cars, pacemakers, insulin pumps, and even nuclear centrifuges, share a common structure with an insecure cyber perimeter, making them susceptible to cyber attacks. This indicates that similar vulnerabilities exist across different organizations and their products and services [55145]. |
| Phase (Design/Operation) |
design, operation |
(a) The article discusses vulnerabilities in the control algorithms of crucial machines like drones, trucks, and pacemakers due to the way software is written. It mentions that updating the control software on a drone requires practically re-certifying the entire aircraft, and security programs often introduce new vulnerabilities [55145].
(b) The article mentions instances where software failures have occurred in various systems, such as viruses infecting drone cockpits, robotic planes leaking classified video streams, malware ordering nuclear centrifuges to self-destruct, hackers remotely accessing pacemakers and insulin pumps, and academics hijacking a car without touching the vehicle. These incidents highlight failures due to the operation or misuse of the systems [55145]. |
| Boundary (Internal/External) |
within_system, outside_system |
(a) within_system: The software failure incident discussed in the articles is primarily related to vulnerabilities and insecurities within the system itself. The control algorithms for crucial machines like drones are written in an insecure manner, making them susceptible to hacks and attacks [55145]. The article mentions that the software used in drones, pacemakers, insulin pumps, and other systems have an insecure cyber perimeter, constructed from standard software components, which surround control systems designed for safety but not for security [55145]. The goal of the High-Assurance Cyber Military Systems (HACMS) project is to develop new, secure ways of coding and running software on drones and ground robots to address these internal vulnerabilities [55145].
(b) outside_system: While the articles focus on vulnerabilities within the system itself, they also mention external threats and attacks that exploit these internal weaknesses. The incidents of viruses infecting drone cockpits, leaking classified video streams, malware affecting nuclear centrifuges, remotely accessing pacemakers and insulin pumps, and hijacking cars all highlight how external factors can exploit the vulnerabilities within the software systems [55145]. The need for secure software and monitoring systems is emphasized to protect against both external attacks and internal vulnerabilities [55145]. |
| Nature (Human/Non-human) |
non-human_actions |
(a) The software failure incident occurring due to non-human actions:
The article discusses vulnerabilities in the control algorithms of drones and other important systems, which are written in a fundamentally insecure manner. These vulnerabilities are not introduced by human actions but are inherent in the software design itself. The vulnerabilities in the software can lead to incidents such as viruses infecting drone cockpits, leaking classified video streams, malware ordering nuclear centrifuges to self-destruct, remotely accessing pacemakers and insulin pumps, and hijacking cars without touching the vehicle [55145].
(b) The software failure incident occurring due to human actions:
The article does not specifically mention any software failure incidents caused by contributing factors introduced by human actions. Instead, it focuses on the vulnerabilities in the software design and the need for more secure coding practices to prevent non-human actions from exploiting these weaknesses [55145]. |
| Dimension (Hardware/Software) |
software |
(a) The article discusses vulnerabilities in the control algorithms of drones and other systems due to insecure coding practices. It mentions that the control software on drones needs to be updated carefully as it practically requires re-certifying the entire aircraft, and security programs can introduce new vulnerabilities [55145]. These vulnerabilities are attributed to the fundamental insecurity in the way programmers write the software that runs drones, trucks, pacemakers, and other critical systems.
(b) The article highlights software failures and vulnerabilities in various systems, including drones, due to insecure coding practices. It mentions incidents such as viruses infecting drone cockpits, leaking classified video streams, malware affecting nuclear centrifuges, remote access to pacemakers and insulin pumps, and hijacking cars without physical contact [55145]. These software failures are a result of the insecure cyber perimeter constructed from standard software components surrounding control systems designed for safety but not for security. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The objective of the software failure incident was malicious, as it involved vulnerabilities in the control algorithms of drones and other systems that could be exploited by hackers to remotely access pacemakers, insulin pumps, and even hijack cars without physical contact with the vehicle. The incident highlighted the risks posed by insecure software components and the potential for malicious attacks on critical systems [55145]. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
(a) The intent of the software failure incident related to poor_decisions:
- The software failure incident discussed in the article is related to poor decisions made in the design and implementation of control algorithms for drones and other critical systems [55145].
- The article highlights that the control algorithms for these crucial machines are written in a fundamentally insecure manner, leading to vulnerabilities that are difficult to detect and patch [55145].
- Dr. Kathleen Fisher emphasizes the need for a new, secure way of coding to address the inherent weaknesses in the software controlling drones, trucks, pacemakers, and other important systems [55145].
(b) The intent of the software failure incident related to accidental_decisions:
- The software failure incident is not primarily attributed to accidental decisions or unintended mistakes but rather to the inherent insecurity in the design and implementation of control software for critical systems [55145].
- The vulnerabilities and flaws in the software controlling drones and other systems are a result of systemic issues in the way these programs are developed, rather than isolated accidental decisions [55145]. |
| Capability (Incompetence/Accidental) |
development_incompetence, accidental |
(a) The article discusses the pervasive vulnerability in the control algorithms of drones and other crucial systems due to the insecure manner in which they are written. Dr. Kathleen Fisher highlights the challenges faced by programmers in checking for vulnerabilities as they develop software for drones, trucks, pacemakers, and other devices [55145].
(b) The article mentions incidents where drones have been infected by viruses, leaked classified video streams, and been remotely accessed by hackers. These incidents highlight failures that have occurred accidentally, leading to vulnerabilities in the systems [55145]. |
| Duration |
unknown |
The articles do not provide information about a specific software failure incident related to the duration of the failure being permanent or temporary. |
| Behaviour |
omission, byzantine |
(a) crash: The articles do not specifically mention a software failure incident related to a crash where the system loses state and does not perform any of its intended functions.
(b) omission: The articles discuss vulnerabilities in the control software of drones and other systems, highlighting the omission of security measures that could lead to failures in performing intended functions. For example, the article mentions how updating the control software on a drone requires practically re-certifying the entire aircraft, and security programs often introduce new vulnerabilities [55145].
(c) timing: The articles do not mention a software failure incident related to timing, where the system performs its intended functions but at incorrect times.
(d) value: The articles do not specifically mention a software failure incident related to the system performing its intended functions incorrectly.
(e) byzantine: The articles discuss the vulnerability of drones and other systems to cyber attacks, malware infections, and remote access by hackers, leading to inconsistent responses and interactions. This behavior is exemplified by incidents such as viruses infecting drone cockpits, leaking classified video streams, and hackers remotely accessing pacemakers and insulin pumps [55145].
(f) other: The articles do not describe a specific software failure incident that falls under a behavior not covered by options (a) to (e). |