Earlier quoted context omitted.
The correct answer to that is very simple, and very expensive: just make correct software. Such malware are only possible because the targeted system has vulnerabilities to begin with. One just has to ensure the absence of such vulnerabilities, possibly using machine checked proofs. One obvious approach is to properly isolate the driving software and sensors from external input.
> The correct answer to that is very simple, and very expensive: just make correct software. I used to think that was unlikely. Then I had a few discussions with people about the state of C, and things that could be done to make it default to a slightly more deterministic case by changing how undefined behavior is dealt with in regards to optimization. Now I think it's impossible, because nobody is willing to give up…
Correct software is expensive. But if we make sure incorrect software is even more expensive, we'll get correct software.
Once the industry is forced to get serious about correctness, they will move away from the C/C++ minefield real quick —or at least come up with safe ways of using C and C++.