Incident: Chinese National Arrested for Using Sakula Malware in U.S. Government Hack

Published Date: 2017-08-24

Postmortem Analysis
Timeline 1. The software failure incident involving the use of the Sakula malware to access sensitive U.S. records from the Office of Personnel Management (OPM) happened from 2012 to 2014 as per the charges filed against Yu Pingan [62252].
System The software failure incident mentioned in the article involves the use of the Sakula malware to access sensitive U.S. records from the Office of Personnel Management (OPM). The systems/components that failed in this incident are: 1. Sakula malware 2. Office of Personnel Management (OPM) database [Cited from Article 62252]
Responsible Organization 1. The Chinese government was responsible for causing the software failure incident mentioned in the article [62252].
Impacted Organization 1. U.S. Office of Personnel Management [62252] 2. Three U.S. companies (not specified) [62252]
Software Causes 1. The software cause of the failure incident was the use of a rare type of computer malware, including the malicious software tool known as 'Sakula' [62252].
Non-software Causes unknown
Impacts 1. The software failure incident resulted in the access of millions of sensitive U.S. records from the Office of Personnel Management, including security clearance forms filed by federal workers and contractors [62252]. 2. Approximately 22.1 million people, including federal employees, contractors, and their families and friends, had their sensitive information exposed due to the breach [62252].
Preventions 1. Implementing robust cybersecurity measures such as regular security audits, penetration testing, and network monitoring to detect and prevent unauthorized access to sensitive data [62252]. 2. Ensuring timely software updates and patches to address vulnerabilities that could be exploited by malware like Sakula [62252]. 3. Educating employees on cybersecurity best practices to prevent social engineering attacks and unauthorized access to systems [62252].
Fixes 1. Enhancing cybersecurity measures to prevent future malware attacks like Sakula [62252]
References 1. Court papers filed against Yu Pingan [62252] 2. U.S. officials [62252]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to the OPM hack involving the use of the Sakula malware has happened again at the Office of Personnel Management (OPM) [62252]. The Sakula malware was used in the OPM hack, which is considered one of the worst-ever computer breaches of U.S. government computer systems.
Phase (Design/Operation) design (a) The software failure incident in this case is related to the design phase. The article mentions that the suspect and other conspirators in China acquired and used malicious software tools, including a rare variant known as 'Sakula,' which was previously unidentified by the FBI and information security community. This indicates that the failure was due to contributing factors introduced during the development of the malicious software tools used in the cyber attacks [62252].
Boundary (Internal/External) outside_system The software failure incident mentioned in the article is related to a cyberattack involving the use of the Sakula malware to access sensitive U.S. records from the Office of Personnel Management (OPM) [62252]. (a) within_system: The article does not provide specific details indicating that the failure originated from within the system itself. (b) outside_system: The failure in this case is attributed to external factors, specifically the actions of the Chinese national and other conspirators in China who used the Sakula malware to carry out the cyberattack on the U.S. government systems [62252].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case is attributed to non-human actions, specifically the use of a rare type of computer malware known as 'Sakula' by the suspect and other conspirators in China. This malware was used to access sensitive U.S. records from the Office of Personnel Management and was considered a contributing factor to the breach of major databases containing information on millions of individuals [62252]. (b) Additionally, human actions are also implicated in this software failure incident as the suspect, Yu Pingan, along with other conspirators, were actively involved in acquiring and using malicious software tools, including the Sakula malware, to carry out the cyber attacks on U.S. government systems and companies. The charges filed against Yu specifically accuse him of conspiracy to commit computer hacking for incidents that occurred from 2012 to 2014, indicating human involvement in the software failure [62252].
Dimension (Hardware/Software) software (a) The software failure incident in this case is primarily related to software rather than hardware. The incident involves the use of a rare type of computer malware, specifically the Sakula malware, by the suspect and other conspirators in China to access sensitive U.S. records from the Office of Personnel Management [62252]. The criminal complaint filed against the suspect does not mention hardware-related issues but focuses on the acquisition and use of malicious software tools for hacking purposes.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident mentioned in the article is malicious in nature. The Chinese national, Yu Pingan, along with other conspirators in China, used a rare type of computer malware, including the Sakula malware, to access sensitive U.S. records from the Office of Personnel Management (OPM) and breach major databases. The criminal complaint suggests a connection between Yu and the OPM hack, which is considered one of the worst-ever computer breaches of U.S. government computer systems. The charges filed against Yu concern alleged computer breaches of three U.S. companies, indicating a deliberate intent to harm the systems [62252].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident in this case seems to be related to poor decisions. The article mentions that the suspect and other conspirators in China acquired and used malicious software tools, including a rare variant known as 'Sakula,' which was previously unidentified by the FBI and information security community. This indicates a deliberate choice to use sophisticated malware for hacking purposes, suggesting a planned and intentional action rather than an accidental decision [62252].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident related to development incompetence is evident in the article as it mentions that the suspect and other conspirators in China acquired and used malicious software tools, including a rare variant known as 'Sakula,' which was previously unidentified by the FBI and information security community [62252]. This indicates a level of professional competence in developing and utilizing sophisticated malware tools for hacking purposes. (b) The software failure incident related to accidental factors is not explicitly mentioned in the article.
Duration permanent, temporary The software failure incident mentioned in the article is related to a hack involving the use of the Sakula malware to access sensitive U.S. records from the Office of Personnel Management (OPM) [62252]. (a) The software failure incident can be considered permanent as it resulted in a significant breach of U.S. government computer systems, allowing hackers to access a huge volume of information from security clearance forms filed by federal workers and contractors. This breach is described as one of the worst-ever computer breaches of U.S. government computer systems [62252]. (b) The software failure incident can also be considered temporary in the sense that the specific incidents related to the charges filed against Yu concern earlier alleged computer breaches of three U.S. companies, which took place from 2012 to 2014. These incidents are mentioned separately from the OPM hack, indicating that they were temporary breaches that occurred within a specific timeframe [62252].
Behaviour byzantine, other (a) crash: The software failure incident mentioned in the article does not specifically describe a crash where the system loses state and does not perform any of its intended functions [62252]. (b) omission: The incident does not mention a failure due to the system omitting to perform its intended functions at an instance(s) [62252]. (c) timing: The incident does not relate to a failure due to the system performing its intended functions correctly, but too late or too early [62252]. (d) value: The software failure incident does not involve a failure due to the system performing its intended functions incorrectly [62252]. (e) byzantine: The behavior of the software failure incident is more aligned with a byzantine failure, where the system behaves erroneously with inconsistent responses and interactions. The incident involves the use of a rare type of computer malware, Sakula, by a Chinese national to access sensitive U.S. records from the Office of Personnel Management, indicating a deliberate and deceptive action [62252]. (f) other: The software failure incident could also be categorized as a security breach or cyber attack, where unauthorized access to sensitive information occurred through the deployment of malicious software [62252].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident mentioned in the article involves the use of a rare type of computer malware by a Chinese national, Yu Pingan, which was deployed to access millions of sensitive U.S. records from the Office of Personnel Management (OPM). This breach resulted in the exposure of sensitive information of about 22.1 million people, including federal employees, contractors, and their families and friends. Additionally, the criminal complaint filed against Yu concerns alleged computer breaches of three U.S. companies, indicating that data and information of these companies were impacted by the software failure incident [62252].
Domain government (a) The failed system was intended to support the government industry. The software failure incident mentioned in the articles is related to the breach of sensitive U.S. records from the Office of Personnel Management (OPM), which is a government agency responsible for managing the civil service of the federal government [62252]. The OPM hack, considered one of the worst-ever computer breaches of U.S. government computer systems, involved accessing a huge volume of information from security clearance forms filed by federal workers and contractors [62252]. The charges filed against the suspect, Yu Pingan, concern alleged computer breaches of three U.S. companies, indicating a focus on government-related systems [62252].

Sources

Back to List