Malware potentially caused plane crash

Discussion in 'Weapons, Equipment & Rations' started by Yeoman_dai, Aug 23, 2010.

Welcome to the Army Rumour Service, ARRSE

The UK's largest and busiest UNofficial military website.

The heart of the site is the forum area, including:

  1. http://defensetech.org/2010/08/23/malware-potentially-implicated-in-2008-fatal-plane-crash-in-spain/#idc-container


    Considering how this airliner is technically a "closed system" so is very hard to target by outside cyber attack - like we are being told with regards to UAV and even the Typhoons fly by wire computer systems, what does such an situation as this potentially is men for the military?

    Especially in light of recent comments about which service should take the lead over cyber attacks
     
  2. seaweed

    seaweed LE Book Reviewer

    The report pins the AIRLINE's computer so perhaps this downloads to the aircraft for some functions? 1998 crash when the IT world was a whole heap simpler.
     
  3. msr

    msr LE

  4. Although this, as has been pointed out, had nothing to do with the aircraft, remember the Conficker / Rafale issue?

    I'm told that for Typhoon, you get the flight data by pulling the memory module out of the plane and sticking it on to your ground terminal. Which is, of course, then connected to the Airframe Maintenance Management system, which probably connects into your stores system and then on into your suppliers systems. So not a "closed system" by any stretch of the imagination.

    Yes, like any air-gapped system, you'll have problems attacking it directly, so malicious code (ideally a trojan) is the way to go.

    I'll note that the Torygraph report says that 24 RAF bases (and the Ark and 75% of the Fleet - which is what now? 3 Chevertons?) were also infected - but we know that can't be true because the RAF are so good at information security ...
     
  5. Will we see more of this then? If a terrorist cannot get onto a plane with a Semtex shoe, then can they instead get some viral nasties (I have less than no idea about cyber-warfare and attacks so I apologise for the simple language) into the aircraft this way?
     
  6. ...so, who's going to write this malicious code? In what language, for what operating system? How's it going to persuade the aircraft to upload a program to anything safety-critical?

    The airframe isn't loaded with some central computer running windows - it's a distributed system across multiple and separate networks where most of the computers require removal to upload a software upgrade. It's checksummed to a fare-thee-well (because the RAF or Luftwaffe would be a bit miffed about having to return key components to a remote factory to be unlocked), and much of it doesn't even have an operating system, but is coded onto bare silicon. Not to mention that each of the major systems was completely separately developed, running different languages on different processors. The tranche 1 radar processor alone had over 20 CPUs of three different types, programmed in at least three different languages, and two utterly non-standard kernels.

    And of course, no-one ever thought about any of this stuff in the twenty years that people have been developing safety-critical and mission-critical software for the aircraft. Assuming that "you can hack a Typhoon" is right up there with believing all those films where a 17-year-old breaks into a system in 47 keystrokes, or where the good guys "call up plans of a building". It's Hollywood.

    If you could get physical access, you wouldn't muck about with malware, you'd chuck sugar into the fuel tank, take scissors to the cabling, or just blow up the nosewheel. Far more damaging to the aircraft.
     
  7. The airline had a maintenance system where if the same fault was recorded three times for a particular aircraft then it would highlight the fact and the aircraft would be grounded for more intensive investigation. The computer that was infected with the malware had nothing to do with the actual aircraft.

    Further, the third occurrence of the particular fault was on the day of the fatal crash so even if it hadn't been infected it still wouldn't have produced the necessary warning that the aircraft should be grounded. For your information the fault was a microswitch on the nose leg of the undercarriage. It senses the nose leg oleo extending as the aircraft rotates on takeoff and allows heating elements in an air sensor probe to turn on. If the probe heater elements are working on the ground the probe overheats and will fail. This is what happened on the first attempt to depart, the probe overheated because the sensor thought the nose leg was in the extended position so the pilots returned to the gate to have the problem fixed. IIRC the decision was made to depart with the probe heat off and it would be turned on in flight where the airstream would keep it cool.

    When they attempted a second departure they rushed their cockpit checks and failed to deploy takeoff flaps. This should have been picked up by the takeoff configuration warning system (a very loud warning horn in the cockpit) but the nose leg sensor had failed again so the warning system thought the aircraft was airborne and this disconnects the configuration warning. Without flaps the aircraft was never going to fly causing the subsequent crash.
     
  8. msr

    msr LE

    Which part of 'it was nothing to do with the aircraft' don't you understand?
     
  9. I knew I should have quit the computer business....