Incident: Insecure Control Software in Drones Leads to Vulnerabilities and Hacks

Published Date: 2012-12-31

Postmortem Analysis
Timeline 1. The software failure incident mentioned in the article happened before 2012-12-31, the publication date of the article [55145].
System The software failure incident mentioned in the article did not involve a specific system failure but rather highlighted the pervasive vulnerability in the control algorithms of various crucial machines, including drones, cars, medical devices, and power plants due to the fundamentally insecure manner in which they are written [55145].
Responsible Organization 1. The software failure incident was caused by vulnerabilities in the control algorithms of drones, shared with other systems like cars, medical devices, and power plants, due to the fundamentally insecure manner in which the software was written [55145].
Impacted Organization 1. Drones used in the U.S. campaign to take out extremists globally were impacted by the software failure incident [55145].
Software Causes 1. The software vulnerability in the control algorithms of drones due to being written in a fundamentally insecure manner [55145].
Non-software Causes 1. Lack of systematic way for programmers to check for vulnerabilities in control algorithms of drones, trucks, and pacemakers [55145]. 2. Insecure cyber perimeter constructed from standard software components surrounding control systems designed for safety but not for security in various systems [55145]. 3. Difficulty in verifying that a particular program will always work as promised, requiring significant time and effort [55145].
Impacts 1. The software vulnerability in the control algorithms of drones and other crucial systems led to the potential for hack attacks, leaks of classified information, and remote access to devices like pacemakers and insulin pumps [55145]. 2. The traditional approaches to security were deemed ineffective in addressing the vulnerabilities in the software, leading to the need for a new, secure way of coding and verifying software [55145]. 3. The software failure incident highlighted the challenge of verifying and ensuring the security of complex software systems, with efforts such as the High-Assurance Cyber Military Systems (HACMS) project aiming to address these issues [55145]. 4. The incident underscored the importance of developing hack-proof software to protect autonomous systems like drones from external attacks and potential malfunctions [55145].
Preventions 1. Implementing a new, secure way of coding such as the High-Assurance Cyber Military Systems (HACMS) program could have prevented the software failure incident by developing software with fewer vulnerabilities [55145]. 2. Verifying that particular programs will always work as promised through rigorous testing and verification processes could have prevented the software failure incident [55145]. 3. Developing software that writes near-flawless code on its own could have prevented the software failure incident by reducing human error in coding [55145].
Fixes 1. Developing a new, secure way of coding through initiatives like the High-Assurance Cyber Military Systems (HACMS) program, which aims to create secure software for drones and ground robots [55145]. 2. Verifying that particular programs will always work as promised, even though it is an exceedingly difficult task, can help prevent software failures [55145]. 3. Funding research into software that can write near-flawless code on its own, which could potentially reduce software vulnerabilities and failures [55145].
References 1. Dr. Kathleen Fisher, a Tufts University computer scientist and a program manager at the Defense Advanced Research Projects Agency [55145] 2. Researchers at MIT and Yale funded by Fisher [55145] 3. Rockwell Collins, Boeing, Black-I-Robotics, and another firm supplying vehicles for the program [55145] 4. Galois, Inc. working on a fully-verified, hack-proof software monitor [55145]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to vulnerabilities in control software affecting drones has happened again within the same organization or with its products and services. The article mentions incidents such as viruses infecting drone cockpits, leaking classified video streams, and malware ordering nuclear centrifuges to self-destruct, among others. These incidents highlight the vulnerabilities in the control software of drones and other important systems [55145]. (b) The software failure incident related to vulnerabilities in control software affecting drones has also happened at multiple organizations or with their products and services. The article discusses how various systems, including drones, cars, pacemakers, insulin pumps, and even nuclear centrifuges, share a common structure with an insecure cyber perimeter, making them susceptible to cyber attacks. This indicates that similar vulnerabilities exist across different organizations and their products and services [55145].
Phase (Design/Operation) design, operation (a) The article discusses vulnerabilities in the control algorithms of crucial machines like drones, trucks, and pacemakers due to the way software is written. It mentions that updating the control software on a drone requires practically re-certifying the entire aircraft, and security programs often introduce new vulnerabilities [55145]. (b) The article mentions instances where software failures have occurred in various systems, such as viruses infecting drone cockpits, robotic planes leaking classified video streams, malware ordering nuclear centrifuges to self-destruct, hackers remotely accessing pacemakers and insulin pumps, and academics hijacking a car without touching the vehicle. These incidents highlight failures due to the operation or misuse of the systems [55145].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident discussed in the articles is primarily related to vulnerabilities and insecurities within the system itself. The control algorithms for crucial machines like drones are written in an insecure manner, making them susceptible to hacks and attacks [55145]. The article mentions that the software used in drones, pacemakers, insulin pumps, and other systems have an insecure cyber perimeter, constructed from standard software components, which surround control systems designed for safety but not for security [55145]. The goal of the High-Assurance Cyber Military Systems (HACMS) project is to develop new, secure ways of coding and running software on drones and ground robots to address these internal vulnerabilities [55145]. (b) outside_system: While the articles focus on vulnerabilities within the system itself, they also mention external threats and attacks that exploit these internal weaknesses. The incidents of viruses infecting drone cockpits, leaking classified video streams, malware affecting nuclear centrifuges, remotely accessing pacemakers and insulin pumps, and hijacking cars all highlight how external factors can exploit the vulnerabilities within the software systems [55145]. The need for secure software and monitoring systems is emphasized to protect against both external attacks and internal vulnerabilities [55145].
Nature (Human/Non-human) non-human_actions (a) The software failure incident occurring due to non-human actions: The article discusses vulnerabilities in the control algorithms of drones and other important systems, which are written in a fundamentally insecure manner. These vulnerabilities are not introduced by human actions but are inherent in the software design itself. The vulnerabilities in the software can lead to incidents such as viruses infecting drone cockpits, leaking classified video streams, malware ordering nuclear centrifuges to self-destruct, remotely accessing pacemakers and insulin pumps, and hijacking cars without touching the vehicle [55145]. (b) The software failure incident occurring due to human actions: The article does not specifically mention any software failure incidents caused by contributing factors introduced by human actions. Instead, it focuses on the vulnerabilities in the software design and the need for more secure coding practices to prevent non-human actions from exploiting these weaknesses [55145].
Dimension (Hardware/Software) software (a) The article discusses vulnerabilities in the control algorithms of drones and other systems due to insecure coding practices. It mentions that the control software on drones needs to be updated carefully as it practically requires re-certifying the entire aircraft, and security programs can introduce new vulnerabilities [55145]. These vulnerabilities are attributed to the fundamental insecurity in the way programmers write the software that runs drones, trucks, pacemakers, and other critical systems. (b) The article highlights software failures and vulnerabilities in various systems, including drones, due to insecure coding practices. It mentions incidents such as viruses infecting drone cockpits, leaking classified video streams, malware affecting nuclear centrifuges, remote access to pacemakers and insulin pumps, and hijacking cars without physical contact [55145]. These software failures are a result of the insecure cyber perimeter constructed from standard software components surrounding control systems designed for safety but not for security.
Objective (Malicious/Non-malicious) malicious (a) The objective of the software failure incident was malicious, as it involved vulnerabilities in the control algorithms of drones and other systems that could be exploited by hackers to remotely access pacemakers, insulin pumps, and even hijack cars without physical contact with the vehicle. The incident highlighted the risks posed by insecure software components and the potential for malicious attacks on critical systems [55145].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident related to poor_decisions: - The software failure incident discussed in the article is related to poor decisions made in the design and implementation of control algorithms for drones and other critical systems [55145]. - The article highlights that the control algorithms for these crucial machines are written in a fundamentally insecure manner, leading to vulnerabilities that are difficult to detect and patch [55145]. - Dr. Kathleen Fisher emphasizes the need for a new, secure way of coding to address the inherent weaknesses in the software controlling drones, trucks, pacemakers, and other important systems [55145]. (b) The intent of the software failure incident related to accidental_decisions: - The software failure incident is not primarily attributed to accidental decisions or unintended mistakes but rather to the inherent insecurity in the design and implementation of control software for critical systems [55145]. - The vulnerabilities and flaws in the software controlling drones and other systems are a result of systemic issues in the way these programs are developed, rather than isolated accidental decisions [55145].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The article discusses the pervasive vulnerability in the control algorithms of drones and other crucial systems due to the insecure manner in which they are written. Dr. Kathleen Fisher highlights the challenges faced by programmers in checking for vulnerabilities as they develop software for drones, trucks, pacemakers, and other devices [55145]. (b) The article mentions incidents where drones have been infected by viruses, leaked classified video streams, and been remotely accessed by hackers. These incidents highlight failures that have occurred accidentally, leading to vulnerabilities in the systems [55145].
Duration unknown The articles do not provide information about a specific software failure incident related to the duration of the failure being permanent or temporary.
Behaviour omission, byzantine (a) crash: The articles do not specifically mention a software failure incident related to a crash where the system loses state and does not perform any of its intended functions. (b) omission: The articles discuss vulnerabilities in the control software of drones and other systems, highlighting the omission of security measures that could lead to failures in performing intended functions. For example, the article mentions how updating the control software on a drone requires practically re-certifying the entire aircraft, and security programs often introduce new vulnerabilities [55145]. (c) timing: The articles do not mention a software failure incident related to timing, where the system performs its intended functions but at incorrect times. (d) value: The articles do not specifically mention a software failure incident related to the system performing its intended functions incorrectly. (e) byzantine: The articles discuss the vulnerability of drones and other systems to cyber attacks, malware infections, and remote access by hackers, leading to inconsistent responses and interactions. This behavior is exemplified by incidents such as viruses infecting drone cockpits, leaking classified video streams, and hackers remotely accessing pacemakers and insulin pumps [55145]. (f) other: The articles do not describe a specific software failure incident that falls under a behavior not covered by options (a) to (e).

IoT System Layer

Layer Option Rationale
Perception sensor, actuator, processing_unit, embedded_software (a) sensor: The article mentions incidents where drones began leaking classified video streams, which could be related to sensor errors [55145]. (b) actuator: The article discusses incidents where hackers were able to remotely access pacemakers and insulin pumps, which could be related to actuator errors [55145]. (c) processing_unit: The article highlights vulnerabilities in the control algorithms of crucial machines like drones, trucks, and pacemakers, indicating potential failures introduced by processing errors [55145]. (d) network_communication: The article mentions incidents where viruses infected drone cockpits, which could be related to network communication errors [55145]. (e) embedded_software: The article discusses the need for a new, secure way of coding for drones and ground robots, indicating potential failures introduced by embedded software errors [55145].
Communication unknown The articles do not provide information about a specific software failure incident related to the communication layer of the cyber physical system that failed. Therefore, it is unknown whether the failure was at the link_level or connectivity_level.
Application FALSE The software failure incident described in the articles is not related to the application layer of the cyber physical system. The failure discussed pertains to the fundamental insecurity in the control algorithms of crucial machines like drones, trucks, and pacemakers due to the inability of programmers to systematically check for vulnerabilities during software development [55145]. This failure is more about the overall security and design flaws in the software rather than specific application layer issues.

Other Details

Category Option Rationale
Consequence no_consequence (a) death: The articles do not mention any incidents of people losing their lives due to the software failure. [55145]
Domain finance, health, government, other (a) The failed system mentioned in the article is related to the defense industry, specifically the use of drones for military purposes. The article discusses vulnerabilities in the control software of drones used in the U.S. campaign to take out extremists globally [Article 55145]. (h) The article also touches upon the finance industry indirectly by mentioning the vulnerabilities in software used in medical devices like pacemakers and insulin pumps, which are critical for health and could potentially be hacked [Article 55145]. (m) Additionally, the article mentions the software vulnerabilities in various other industries such as cars, power plants, and medical devices, which fall under the category of "other" industries not explicitly listed in the options [Article 55145].

Sources

Back to List