Forgot your password?
typodupeerror
Transportation Security Technology Hardware

Trojan-Infected Computer Linked To 2008 Spanair Crash 324

Posted by Soulskill
from the blue-screen-of-literal-death dept.
An anonymous reader writes "Two years ago, Spanair flight JK-5022 crashed shortly after takeoff in Madrid, killing 154 of its 172 passengers and crew. El Pais online newspaper reports that the ground computer responsible for triggering an alarm after three failures are reported in a plane failed to do so. The computer was infected with trojans (Google translation of Spanish original)."
This discussion has been archived. No new comments can be posted.

Trojan-Infected Computer Linked To 2008 Spanair Crash

Comments Filter:
  • Shit. (Score:5, Funny)

    by fuzzyfuzzyfungus (1223518) on Friday August 20, 2010 @08:54AM (#33312456) Journal
    Holy Safety-critical system running Windows and apparently not adequately air-gapped, batman!
  • Just wondering what operating system those computers used, and how they contracted a virus from the outside network (when they probably shouldn't have been connected at all)??
    • by TheKidWho (705796) on Friday August 20, 2010 @08:57AM (#33312478)

      I take it you've never worked with real people before?

    • by mseeger (40923) on Friday August 20, 2010 @09:00AM (#33312508)
      Because humans are humans. Possible chain of events: "Hmmm. I want to surf in the internet but have no PC. But wait, there is our maintenance PC. If i install iTunes on it and connect it to my iPhone, i may surf during work. Hurray! I can even download the hot pics of my favorite celebrity to which i received a link from these chinese guy."
    • Re: (Score:2, Insightful)

      by Buggz (1187173)
      The operating system really isn't the issue here, failure to isolate the system is. I've set up several windows systems inside a double firewall which in turn are set up with a VPN to whatever the systems needed to communicate with, and nothing else. Those did exactly what they needed to do because nothing else would get in or out. That a mission critical system gets infected at all points to a serious flaw somewhere, a goddamned alarm system shouldn't need any active usb-ports nor any access to the interne
    • Re: (Score:3, Insightful)

      by mcgrew (92797) *

      Are you new to computing? How many Mac or Linux or BSD users do you know who have ever gotten a trojan infection?

  • by GaryOlson (737642) <slashdot@@@garyolson...org> on Friday August 20, 2010 @08:58AM (#33312486) Journal
    At the bottom of the article, it states the computer system did not alarm when the pilots failed to use the flaps properly on takeoff. That pilot should have had his license revoked.
    • by Sockatume (732728)

      Undoubtedly, however there are meant to be safety nets against pilot incompetence. If such a system was compromised (as noted in a comment below, this is slightly dubious) then that error is partly responsibility for the incident.

    • by Pojut (1027544) on Friday August 20, 2010 @09:10AM (#33312622) Homepage

      From the Wikipedia page [wikipedia.org] (emphasis mine):

      "On 17 August 2009, CIAIAC released an interim report on the incident [21]. The interim report confirmed the preliminary report's conclusion that the crash was caused by an attempt to take off with the flaps and slats retracted, which constituted an improper configuration, and noted that safeguards that should have prevented the crash failed to do so. The cockpit recordings revealed that the pilots omitted the "set and check the flap/slat lever and lights" item in the After Start checklist. In the Takeoff Imminent verification checklist the copilot just repeats the flaps and slats correct values without actually checking them, as shown by the physical evidence."

      Daayum.

    • by Zocalo (252965) on Friday August 20, 2010 @09:10AM (#33312632) Homepage
      The pilots kind of revoked their own licenses. Permanently. All of the crew perished in the crash.

      The thing that bugs me is that flight systems on passenger jets are multiply redundant and their are strict rules about what can and can't be done when there is a system failure. For instance there are usually at least three autopilot systems, and if only one is indicating a fault then the flight crew has to perform all flight operations manually. WTF happened with regulatory control that didn't enforce that this kind of redundancy and human oversight applied to critical systems on the ground as well?
      • by Pojut (1027544)

        The pilots kind of revoked their own licenses. Permanently. All of the crew perished in the crash.

        "It's just been revoked!"
        "Peter, that line doesn't work here."
        "Oh. Uh...I'll have what she's having!"

      • by gstoddart (321705)

        WTF happened with regulatory control that didn't enforce that this kind of redundancy and human oversight applied to critical systems on the ground as well?

        If I understand the garbled translation, I think that the airline failed to enter into their computers in a timely manner that there had been existing problems ...

        A deficiency of that computer is joined also by the fact that Spanair took about 24 hours to score in the computer failures of its planes , according to the judge admitted two mechanics from th

    • by Amouth (879122)

      i Think he died with a lot of the other people on the plane

    • Re: (Score:3, Funny)

      by nedlohs (1335013)

      Being dead does that automatically anyway.

    • Catch-22 (Score:3, Insightful)

      That pilot should have had his license revoked.

      Well, I think the crash took care of that.

      Unless the pilot was Captain Orr from Catch-22 . . . then he and all the other passengers would be frolicking in Sweden for the rest of the war . . .

  • Its an MD82 (Score:4, Informative)

    by MichaelSmith (789609) on Friday August 20, 2010 @09:00AM (#33312510) Homepage Journal

    wiki link [wikipedia.org]

    Beyond the translated Spanish article I can't find anything else about this idea of an alerting system being infected with malware. Typically such systems are simple, embedded and not interfaced in ways which could cause them to run software they are not meant to.

    This bit from wikipedia is interesting:

    The MD-80 Advanced was to incorporate the advanced flight deck of the MD-88, including a choice of reference systems, with an inertial reference system as standard fitting and optional attitude-heading equipment. It was to be equipped with an electronic flight instrument system (EFIS), an optional second flight management system (FMS), light emitting diode (LED) dot matrix electronic engine and system displays. A Honeywell windshear computer and provision for an optional traffic-alert and collision avoidance system (TCAS) were also to be included. A new interior would have a 12% increase in overhead baggage space and stowage compartment lights that come on when the door opens, as well as new video system featuring drop-down LCD monitors above.[4]

    link [wikipedia.org]

    Apparently this upgrade got dropped in 1991, so the system still in use must be pretty low tech.

    • by J-1000 (869558)
      Of course, as you know, there are plenty of viruses still floating around on floppy disks.
    • by Kupfernigk (1190345) on Friday August 20, 2010 @09:10AM (#33312624)
      This is an aggregating computer at SpanAir HQ which is supposed to record aircraft alerts and notify when too many of them happen too close together. Its only connection with the on-board computer is that somehow it receives the alerts from it. Its OS is unstated. It is not a mission-critical system, it is a decision-support system. Even so, someone looks to have been careless.

      Whoever modded up the above post - you've missed the point. There may have been a fault in the on-board management system - or human error failing to heed a warning - but nothing in TFA suggests that malware was in any way involved on the flight deck.

    • The summary is a bit misleading. The computer on the plane does not appear to be infected. What was infected was a warning control system computer at Spainair headquarters that monitored and recorded the planes. If I'm reading the article right, a component on the plane (it says "device" so it may not be a computer) failed at least twice before the flight took off. Since the central computer was infected with Trojans, it was not adequately recording nor triggering an alert that should have grounded that
  • What? (Score:5, Insightful)

    by miffo.swe (547642) <daniel DOT hedblom AT gmail DOT com> on Friday August 20, 2010 @09:04AM (#33312536) Homepage Journal

    Who puts Windows on anything even remotely mission critical? If you could blame someone, it should be the person deciding that.

    • by Yvanhoe (564877)
      Question : would you also hang the various salesmen who argue with "Microsoft(tm) Facts(tm)" that Windows is the most secure OS out there and that it is adequate for mission critical tasks ?
  • by vistapwns (1103935) on Friday August 20, 2010 @09:06AM (#33312570)
    Here is your complimentary guide to trolling this story: 1. Pretend only windows can get infected with trojans. 2. If you can't do 1. adequately, then pretend Windows is some how easier to infect with trojans than other OSes. 3. Accuse anyone who disagrees with you of being paid off. 4. Make thoughtless absolutists statements like Windows has no security model, and is not a networking OS. 5. Mention chair throwing as proof that MS personnel are unstable, but never mention wife murdering linux developers. 6. Repeat other MS bashers without researching what they're saying. 7. Mention "640k ought to be enough for anyone" as much as possible without giving thought to the brain dead simple idea that MS had nothing to do with the addressable memory limit of the 8086. Following this guide is sure to get you modded up and liked by many other slashdotters, so be sure to follow it closely!
  • The microcomputer world is an open sewer. Always has been, always will be.
  • When someone's malicious Trojan, Virus or other Malicious Coding will be used as evidence in a murder/manslaughter trial; however, what is needed, is a day when any seriously incompetent bit of code on a vital system should have the potential to be used in criminal court. I'm an Mechanical Engineer and I have to have a certification and insurance even as a contractor, why should I have to spend 1000's of dollars a year doing so I can work on building the mechanical systems of the plane when the programmers
  • by hessian (467078) on Friday August 20, 2010 @09:09AM (#33312610) Homepage Journal

    1970s:

    "I'm sorry, our computers are down." (Reality: our employees are playing NET TREK and DUNGEON on a Friday afternoon.)

    2000s:

    "I'm sorry, our computer has a trojan." (Reality: our employees finally found an "unused" machine to surf porn, got loaded up with Russian malware, and now it's nobody's fault.)

  • So, when... (Score:5, Insightful)

    by Titan1080 (1328519) on Friday August 20, 2010 @09:10AM (#33312630)
    Does the 'War on Trojanists', begin? But seriously, someone wrote that virus. That means that someone, somewhere (probably Estonia), is guilty of killing 154 people.
  • by ptbarnett (159784) on Friday August 20, 2010 @09:11AM (#33312650)
    The infected computer was one being used by mechanics to enter maintenance log entries. According to the article, an alert is supposed to be raised if three failures in the same part or subsystem occurred. If I understand the broken English correctly, they would have taken the plane out of service had the maintenance log entry been completed before the plane attempted to take off.

    But, the problem that was supposed to be logged was reportedly an overheated pitot tube. That was not the cause of the crash: the report says that the pilots did not set the flaps correctly and a warning alarm did not go off. This was not related to the problem with the computer being used by mechanics.

    The article appears to be trying to link two independent events: a separate problem with the plane and an error by the pilots. Or maybe it's just the broken English translation.

    • by Anonymous Coward on Friday August 20, 2010 @09:40AM (#33312974)

      Spanish is my mother tongue, so maybe I can shed more light after reading the original article:

      The procedures of Spanair are to log incidences right away whenever they are detected. Three accumulated incidences and the plane is grounded.

      Two incidences had been found the day before the crash. One incidence was detected on the same day of the crash.

      However, the technicians did not enter the incidences into the system right away, because the system was too slow (assumedly due to the malware)

      The system did not trigger any alarm on the same day because the incidences had not been entered by the technicians. The plane was deemed airworthy, and then the accident happened due to the multiple causes described elsewhere.

      • This case is interesting because from the legal perspective it is of interest to find responsibilities for the accident. The malware did not cause the crash but it interfered with the logging protocols. The technicians will be probably held responsible for not taking measures such as manually checking printed logs, if the computer failed.
    • by Registered Coward v2 (447531) on Friday August 20, 2010 @09:48AM (#33313062)

      The infected computer was one being used by mechanics to enter maintenance log entries. According to the article, an alert is supposed to be raised if three failures in the same part or subsystem occurred. If I understand the broken English correctly, they would have taken the plane out of service had the maintenance log entry been completed before the plane attempted to take off.

      But, the problem that was supposed to be logged was reportedly an overheated pitot tube. That was not the cause of the crash: the report says that the pilots did not set the flaps correctly and a warning alarm did not go off. This was not related to the problem with the computer being used by mechanics.

      The article appears to be trying to link two independent events: a separate problem with the plane and an error by the pilots. Or maybe it's just the broken English translation.

      Very true - the accident appears to have been the result of a series of crew errors that lead to an improper takeoff condition:

      From Wikipedia: On 17 August 2009, CIAIAC released an interim report on the incident [21]. The interim report confirmed the preliminary report's conclusion that the crash was caused by an attempt to take off with the flaps and slats retracted, which constituted an improper configuration, and noted that safeguards that should have prevented the crash failed to do so. The cockpit recordings revealed that the pilots omitted the "set and check the flap/slat lever and lights" item in the After Start checklist. In the Takeoff Imminent verification checklist the copilot just repeats the flaps and slats correct values without actually checking them, as shown by the physical evidence. All three safety barriers provided to avoid the takeoff in an inappropriate configuration were defeated: the configuration checklist, the confirm and verify checklist, and aircraft warning system (TOWS).

      Had they not made a series of compounding errors the flight probably would have been uneventful; it appears the deactivated systems was not related to the crash. It may be that some other systems were improperly set - ground vs flight mode - which caused problems and may have contributed to the accident; but none are related to the maintenance computer. Should the plane have been grounded due to an early problem? Maybe; but that may not have prevented the errors that lead to the crash.

      We'll never know what the pilots were thinking; but having aborted one takeoff they may have assumed, intentionally or not, that they systems were set for takeoff and did a cursory check as a result; I've seen that happen in other industries where checklists are used. You interrupt the expected course of actions and people simply pick up where they left off, without assuring the systems were properly set for operation.

  • Maybe the computer was infested with trojans, although no evidence is offered to support this, not even the names. If it was, that still doesn't say that the trojans caused the problem. After all, the computer must have been running well enough even with the infestation to seem to be working. I'm inclined to think that trojans may just be a way to not really address the real problem.
  • This opens a new legal can of worms - if a trojan or virus is found to be resposible (at least partially) of a plane crash, can the creator fo this virus be held legally liable for the crew and passenger deaths?
    • This opens a new legal can of worms - if a trojan or virus is found to be resposible (at least partially) of a plane crash, can the creator fo this virus be held legally liable for the crew and passenger deaths?

      I don't see why not. It might be hard to prove murder, but negligent homicide should be fairly easy to show. Reckless endangerment should be damned near an automatic conviction if you can prove that the person released the virus even if it DIDN'T hurt anyone.

      The same way you can be cited for unsafe

  • Swiss cheese (Score:5, Interesting)

    by Fzz (153115) on Friday August 20, 2010 @09:20AM (#33312766)
    The crash of an airliner these days is rarely due to a single cause. There's a saying in the industry that a crash occurs when the holes in the Swiss cheese happen to line up. This appears to have been the case with this particular crash.
    • The direct cause was that the pilots attempted to take off without setting take-off flaps.
    • They were rushing because they'd had a technical issue, and returned to the terminal after previously taxiing to the runway and completing the take-off checks. So they accidentally skipped the critical check that the flaps were deployed when they lined up to take off the second time.
    • There's a take-off configuration alarm that is supposed to alert the pilots, but it wasn't working.
    • It wasn't working because the engineer removed the circuit breaker that powered it, in order to turn off a stuck heater on a pitot tube that was due to a malfunctioning switch.
    • This particular fault had been noted on previous flights, so should have flagged a warning on the airline's fault monitoring system.
    • The fault monitoring system had a trojan.

    Yup, the holes in the cheese certainly lined up that day. None of these, by itself, would have caused the crash.

  • and they want to have networked auto drive cars some day as well.

    I hope that the windows based car navigation and sound system is not hooked to the drive part at all or even better no windows at all.

    • Re: (Score:2, Funny)

      and they want to have networked auto drive cars some day as well.

      I hope that the windows based car navigation and sound system is not hooked to the drive part at all or even better no windows at all.

      I would find it very difficult to navigate in a car lacking windows.

      • and they want to have networked auto drive cars some day as well.

        I hope that the windows based car navigation and sound system is not hooked to the drive part at all or even better no windows at all.

        I would find it very difficult to navigate in a car lacking windows.

        no windows based os not the car windows

  • by anorlunda (311253) on Friday August 20, 2010 @09:26AM (#33312834) Homepage

    The Spanish article cited in the summary does not allege any cause-and-effect relationship between the computer, the trojans, and the crash.

    Nearly all crash investigations reveal factoids that cause suspicion and which invite people to jump to conclusions. Sometimes, the premature public debate on such issues cause emotional harm to victims, their families and other people involved.

    I realize that I'm pissing into the wind to raise this topic. I's human nature to gossip. Slashdot is no different than any other public forum in this regard. It just frustrates me to see this happen again and again.

    • You are right, this is never alleged. But it is implied and they clearly want people to take the false impression by what is said and not said. Otherwise, it is a completely pointless thing to say. I would be like going out of your way to point out that the computer had a CRT screen and not an LCD screen. If there is no cause and effect (and I also believe there is not in this case), why make the statement?
  • by Archtech (159117)

    This news puts Trojans in a new light. Taking over PCs to run scams is one thing; causing the deaths of 154 people is entirely different. Every top law enforcement agency and intelligence organization should be working to track down all of those responsible - from the guys who wrote the Trojans to the managers who allowed them to contaminate their computers, and very possibly those who wrote the vulnerable software and those who sold it for such a safety-critical application.

    I shall be interested to see whe

  • by jav1231 (539129)
    Between this and hospital computers rebooting themselves after auto-updating how can people defend Windows in critical operations? At the very least run embedded WIndows or something more specialized. Though, yes, I admit I'd rather see them not run Windows at all.
    • Even better would be if people didn't half ass engineer their system. Hospital computers autorebooting causes a problem? Disable it and manage reboots for updates some other way. Relatively critical system? Lock it down. No web surfing access, no external drives, no unapproved binaries etc.

How many QA engineers does it take to screw in a lightbulb? 3: 1 to screw it in and 2 to say "I told you so" when it doesn't work.

Working...