Failure of controls...Spanair crash caused by a Trojan

[Bugbatter]

Several readers have pointed us to an article about the preliminary report of the Spanair flight that crashed on takeoff in 2008 killing 154. The article suggests that a Trojan infected a Spanair computer and this prevented the detection of a number of technical issues with the airplane. The article speculates that if these issues had been detected the plane would not have been permitted to attempt take off.

There is still a lot that is conjecture and unknowns at this point in the investigation and I will try not to add to the speculation, but it made me think about the parallels to information security.
In information security we often speak of controls. There are three types of controls; preventive, detective, and corrective. Predominantly in information security we deal with preventive and detective controls.


Continued here:
http://isc.sans.edu/diary.html?storyid=9433

[1972vet]

If it all turns out to be true then following logic to bring about a remedy, one would think it should be patterned after what is already in place for a criminal act of violence that kills throngs of innocent people.

...And, if it DOES come to that, then malicious software authors should be advised, the "Death Penalty" may just be in store for some of you!

Don't think this can't happen saying, "aww hogwash"...Leave room for some back pedalling. There are other places on the globe already that don't require much in order to bring about an execution for crimes of a certain nature.

[Hoov]

As the author of this article states, I am not a pilot either. But I am a trained and highly experienced Avionics Technician. While I have not worked on every kind of airplane, I have worked on a large spectrum of them ranging from old dumb analog airplanes to some with fairly new glass cockpits.

I will come out and say it in plain English. It is impossible for a virus or Trojan to infect the control systems of an airplane. Those computers have custom software running in them. They are not based on windows, any flavor of the MAC OS, or even any flavor of Linux.

Any malware that would run on these systems would have to be custom written to take the place of the software that actually ran the airplane, and once it was installed in the system, it would not be able to get out to replicate itself. It would have to be done either at the manufacturers or at a repair shop. But even then it would have to pass a rigorous testing procedure.

I wrote about this a bit more here, http://spywarehammer.com/simplemachinesforum/index.php?topic=8681.msg67717#msg67717

But rest at ease. If this airplane was brought down by a problem in a computer, it was a failure of the computer, not a malware infection. But it is my experience that even a computer failure will just cause the pilot to have to fly the airplane by hand, and not rely on the computer. To the best of my knowledge ALL commercially flown airplanes in the World (for sure in all western countries) have to be landable with all electrical power out. In fact if you take away all electrical power and leave 50% of the engines running, airplanes are capable of maintaining altitude and landing safely. But even by killing all the engines, airplanes have to have backup systems that allow flap deployment, and gear deployment, which means the plane is landable. It may not be a pretty landing, and it may hurt some people a bit, but it will land, and most everyone should walk away.

[Bugbatter]

There are more comments here, but I figured it was old news so I did not update:
http://www.zdnet.com/blog/bott/fact-check-malware-did-not-bring-down-a-passenger-jet/2354

[1972vet]

Your original linked article has updates to it as time went by. Users posted comments similar to what is posted here. Some very good points made including:
"...there was never any mention of an onboard computer being infected. Other newsstories refer to details from the original spanish articles that also specify that it wasn't. The MSNBC story hints at it ("central computer system"). "

Likewise:
"Just as a point of clarification, the news articles out there do not say there was any malware on any system on the aircraft. What was infected was a server back in the data center that tracked all the maintenance issues reported by pilots and notified the maintenance ..."

[Hoov]

I think it is a matter of one reporter making up something, and then you have an instant urban legend.  I wonder how long it will be before someone writes an article about a pacemaker being infected with a Trojan.

[1972vet]

Those computers have custom software running in them. They are not based on windows, any flavor of the MAC OS, or even any flavor of Linux...

Good point Hoov. I think we can also assume there are no life support systems anywhere on the globe, being run by any Windows system (or any other) having internet access (Thank God!).

There is an article Here making roughly the same claim although it ends up with a note that there is a report due in December from this alleged "independent investigative commission". Guess that means this story doesn't want to die from any lack of oxygen.

[1972vet]

Funny you should mention "urban legend". A search on snopes returns absolutely nothing regarding this story. Not even the famous "Urban Legend" web site wants anything to do with it. 

[Hoov]

  Not surprised. To many people don't understand how OS's are different, or that malware is not as globally fatal as it is to windows.

[1972vet]

According to the MSNBC article, the head threat researcher at Trend Micro had been consulted...and stated:
"The malware on the Spanair computer has been identified as a type of Trojan horse"

Then...O. Sami Saydjari, president of Cyber Defense Agency has also weighed in and said:
 "Standards have not been set to protect critical infrastructure.
...An incident like this could happen again, and most likely will"

...So, I can understand how this story has become an internet sensation. I'm actually surprised to see it still up there on the web. I would think they would have archived it by now with all the flack.