Malware Potentially Implicated in 2008 Fatal Plane Crash

unixfool · 08-25-2010, 10:20 AM

Malware Potentially Implicated in 2008 Fatal Plane Crash in Spain

Quote:

Investigators looking into the crash of Spanair Flight 5022 at Madrid International Airport on August 20, 2008, killing 154, found that the airline’s central computer system used to monitor technical problems in its fleet was infected with malware, according to this news report. The central computer system should have warned the airline that Flight 5022, an MD-82 aircraft, was having repeat mechanical problems.

http://defensetech.org/2010/08/23/ma...rash-in-spain/

Other articles:
http://www.msnbc.msn.com/id/38790670...ity/?gt1=43001
http://isc.sans.edu/diary.html?storyid=9433
http://zd.net/bi7Lkm <== this one is titled, "Fact check: malware did not bring down a passenger jet"

win32sux · 08-25-2010, 01:10 PM

FWIW, I read the original article (it's in Spanish), and I must say that it's probably a good idea to take everything with a huge grain of salt (at least at this point). Whether or not one considers it to be sensationalist, I think we could agree that a lot is being left to the reader's imagination. That said, I do look forward to reading some official conclusions once the smoke clears (no pun intended).

Hangdog42 · 08-25-2010, 02:04 PM

I haven't seen a lot on this, but what I have seen suggests a fairly large number of variables had to align for this crash to happen. Unfortunately they did. Yeah, the plane would have been pulled from service if the infected maintenance system hadn't prevented data entry, but it also wouldn't have crashed if the pilots hadn't goofed the pre-flight checklist.

unixfool · 08-26-2010, 10:26 AM

Fact check: malware did not bring down a passenger jet

http://zd.net/bi7Lkm

The article appears to support Hangdog42's thoughts of the pilots not conducting good pre-flight checks.

win32sux · 08-26-2010, 12:02 PM

Hopefully, the Spaniards will release the final report in December (as planned) and we'll get some closure. At this point, even the author of the fact-checking article seems eager to jump to conclusions, IMHO.

unixfool · 08-26-2010, 02:23 PM

I understand that some are jumping to conclusions regarding the details (or lack thereof) of this, but I don't see a problem with at least using this as a mental exercise in assessment. Some things are worth at least discussing while we wait.

The bottom line for me in this is that some things will always require human attention. Whether or not the machine(s) contained malware is beside the point...human checks (typical pre-flight checks) could've prevented this crash from happening. There's not going to be much data (if any) that will refute that.

win32sux · 08-27-2010, 05:18 AM

Quote:

Originally Posted by unixfool

I understand that some are jumping to conclusions regarding the details (or lack thereof) of this, but I don't see a problem with at least using this as a mental exercise in assessment. Some things are worth at least discussing while we wait.

I agree.

Quote:

[...] some things will always require human attention.

I agree.

Quote:

[...] human checks (typical pre-flight checks) could've prevented this crash from happening.

I agree that's what it seems like thus far.

Quote:

There's not going to be much data (if any) that will refute that

I can't agree or disagree with this, as I have no way of seeing the future, or the non-released data. While I do agree with the potential for interesting discussion; the need for human attention; and the risk-reduction value which the checklist represents, I find it difficult to reach this type of conclusion. I'm not saying you're mistaken, I'm just not as convinced as you are (at this point).

Hangdog42 · 08-27-2010, 07:15 AM

Quote:

The bottom line for me in this is that some things will always require human attention. Whether or not the machine(s) contained malware is beside the point...human checks (typical pre-flight checks) could've prevented this crash from happening. There's not going to be much data (if any) that will refute that.

I agree completely, and from what I've read, there was a checklist being used. However, they skipped/missed the step about checking that the flaps were down and neither of them noticed the error. Unfortunately, the system that was supposed to warn them of the error had malfunctioned (as it had on previous occasions) so their redundancy was gone.

I suspect the report will fault the pilots because it is their job to make sure they don't screw up things like a checklist and the warning system is there for backup.