Incident: Facebook Malware Scan Lockout Incident: System Failure and Frustration

Published Date: 2018-02-23

Postmortem Analysis
Timeline 1. The software failure incident happened in February 2018. [68625]
System 1. Facebook's anti-malware scan system [68625]
Responsible Organization 1. Facebook's anti-malware scan feature was responsible for causing the software failure incident reported in the article [68625].
Impacted Organization 1. Facebook users, including Charity and Anatol Ulrich, who were locked out of their accounts due to the mandatory malware scan [68625].
Software Causes 1. The software cause of the failure incident was Facebook's mandatory anti-malware scan feature, which locked out users like Charity and Anatol Ulrich from accessing their accounts due to issues with the scan not being compatible with their devices [68625].
Non-software Causes 1. Lack of transparency in Facebook's communication with users about malware scanning requirements and processes [68625]. 2. Inconsistencies in Facebook's malware scanning feature implementation, leading to confusion and frustration among users [68625]. 3. Potential encouragement of unsafe behavior on the web due to Facebook's malware-scanner notification [68625]. 4. Lack of clarity on how Facebook uses data collected from conducting malware checks [68625].
Impacts 1. Users like Charity were locked out of their Facebook accounts and unable to access them due to the mandatory malware scan, causing frustration and confusion [68625]. 2. The mandatory malware scan feature was poorly designed and inconsistently implemented, leading to further user inconvenience and dissatisfaction [68625]. 3. Users reported being prompted to download Windows files on Mac devices, indicating a lack of proper device recognition by the malware scan system [68625]. 4. The incident potentially encouraged unsafe behavior by training users to accept or install fake antivirus products, which could lead to ransomware attacks [68625]. 5. Running Facebook's malware detector caused at least one user's antivirus to disappear, possibly due to conflicts with other antivirus programs on the user's machine [68625].
Preventions 1. Improved compatibility testing to ensure that the malware scanner provided by Facebook works on different operating systems like Mac, not just Windows [68625]. 2. Enhanced user interface design and implementation to prevent confusion and frustration among users when dealing with the malware scan feature [68625]. 3. Regular updates and transparency regarding software partners supplying malware scans to ensure users are aware of the tools being used and their implications [68625].
Fixes 1. Improving the design and implementation of the malware scanning feature on Facebook to ensure consistency and effectiveness [68625]. 2. Allowing users more control over the scanning process, such as selecting the type of device they are using, to prevent issues like the one experienced by Charity [68625]. 3. Enhancing transparency by providing clear information about the software partners involved in supplying malware scans and how the data collected is used [68625]. 4. Addressing potential security risks associated with the malware scanning feature, such as the possibility of users being trained to accept fake antivirus products [68625].
References 1. Forums 2. Twitter 3. Reddit 4. Personal blogs 5. Facebook spokesperson Jay Nancarrow 6. Facebook users like Anatol Ulrich 7. Google’s Travis Ormandy 8. F-Secure 9. Trend Micro 10. ESET 11. Kaspersky Lab 12. Mohammad Mannan, a security researcher at Concordia University 13. New Zealand businessman Jack Yan 14. NSA employee

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to Facebook's mandatory malware scan has happened again within the same organization. Users have reported being locked out of their accounts by the scan, facing confusion and frustration due to the poorly designed and inconsistently implemented feature [68625]. (b) The software failure incident related to Facebook's mandatory malware scan has also happened at multiple organizations. Users globally have experienced similar issues with the malware scan, leading to widespread confusion and frustration across different continents [68625].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the case of Facebook's mandatory malware scan feature. Users like Charity and Anatol Ulrich were locked out of their accounts due to the system's design flaws. Charity, a Mac user, was asked to download a Windows file for the scan, which she couldn't run, leading to her inability to access her account [68625]. Similarly, Anatol Ulrich faced account lockout after sharing Google docs on Facebook and was prompted to download a Windows file on a Mac device, showcasing a design flaw in the system's malware scanning process [68625]. (b) The software failure incident related to the operation phase is evident in how the mandatory malware scan feature on Facebook caused confusion and frustration among users. Users reported being locked out of their accounts or baffled by the scan, indicating issues with the operation or implementation of the feature. Some users found that the malware message disappeared when switching browsers or using a different account on the same device, highlighting inconsistencies in the operation of the scan [68625].
Boundary (Internal/External) within_system (a) within_system: The software failure incident described in the articles is primarily within the system. The failure was related to Facebook's mandatory malware scan feature that locked out users from their accounts, prompting them to download software that was not compatible with their devices. This issue originated from within Facebook's system design and implementation, causing frustration and confusion among users [68625].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The software failure incident in the article was primarily due to the mandatory malware scan implemented by Facebook. Users like Charity and Anatol Ulrich were locked out of their accounts and prompted to download software that was incompatible with their devices, leading to their inability to access Facebook [68625]. (b) The software failure incident occurring due to human actions: The failure due to human actions can be attributed to Facebook's decision to make the malware scan mandatory and the way it was implemented. Users reported frustration with the poorly designed and inconsistently implemented feature, causing confusion and account lockouts. Additionally, the lack of transparency in Facebook's communication about the partners supplying the malware scans and the potential risks associated with running the scan also contributed to the software failure incident [68625].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware can be seen in the article where a Facebook user named Charity was locked out of her account and asked to download Facebook's malware scanner, but the file provided was for a Windows device while Charity used a Mac. This hardware incompatibility issue prevented Charity from running the software and accessing her account [68625]. (b) The software failure incident related to software can be observed in the article where Facebook's mandatory malware scan feature caused widespread confusion and frustration among users. Users reported that the feature was poorly designed and inconsistently implemented, with some users being locked out of their accounts while others were not. Additionally, the article highlighted concerns about the potential risks associated with antivirus software, as it can access a significant amount of data on a user's computer [68625].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident described in the articles is non-malicious. The incident involved Facebook's mandatory malware scan causing frustration and confusion among users, leading to account lockouts and difficulties in accessing accounts. Users reported issues with the design and implementation of the feature, as well as inconsistencies in how the scan was triggered and resolved. Additionally, concerns were raised about the potential risks associated with granting Facebook and its cybersecurity partners access to users' devices for scanning purposes [68625]. (b) The software failure incident was not malicious but rather stemmed from the implementation and design of Facebook's malware scanning feature, which led to unintended consequences for users such as being locked out of their accounts or facing difficulties in accessing their accounts [68625].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident related to poor decisions can be seen in the case of Facebook's mandatory malware scan. Despite user frustration and confusion, Facebook continued to require the scan if a device was flagged for malware. This decision led to widespread confusion, frustration, and impacted users globally [68625]. (b) The software failure incident related to accidental decisions is evident in the case of Facebook's malware scanner prompting users to download the wrong software for their devices. Users like Charity and Anatol Ulrich were asked to download Windows files on Mac devices, leading to their inability to access their accounts. This unintended consequence of the malware scan process caused inconvenience and frustration for users [68625].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the case of Facebook's mandatory malware scan. Users like Charity and Anatol Ulrich were locked out of their accounts due to the flawed implementation of the malware scan. Charity, a Mac user, was asked to download Windows software, which she couldn't run, leading to her inability to access her account [68625]. Similarly, Anatol Ulrich faced account lockout after sharing Google docs on Facebook and was prompted to download a Windows file on a Mac device, showcasing the lack of proper account-device association in the malware scanning process [68625]. (b) The accidental aspect of the software failure incident is highlighted by the unintended consequences of Facebook's malware scan. Users reported being locked out of their accounts or experiencing confusion and frustration due to the inconsistent implementation of the feature. For instance, different users on the same device or switching browsers sometimes resulted in the malware message disappearing, indicating accidental inconsistencies in the scanning process [68625]. Additionally, running Facebook's malware detector caused one user's antivirus to disappear, possibly due to conflicts with the Kaspersky Lab software mandated by Facebook, leading to unintended consequences for users [68625].
Duration temporary The software failure incident described in the articles can be categorized as a temporary failure. Users like Charity and Anatol Ulrich experienced temporary account lockouts due to Facebook's mandatory malware scan, which was triggered by certain circumstances such as sharing Google docs in comment threads on Facebook or being flagged for malware [68625]. The issue was not permanent as users could sometimes bypass the scan prompt by switching browsers or using a different account on the same device [68625].
Behaviour crash, omission, value, byzantine (a) crash: The article describes a situation where Facebook users were locked out of their accounts due to a mandatory malware scan, which caused widespread confusion and frustration. Users reported being unable to access their accounts even after multiple attempts from different devices and browsers, indicating a system crash where the system lost state and did not perform its intended function of allowing users to log in [68625]. (b) omission: The article mentions instances where the malware scan feature on Facebook was inconsistently implemented. For example, if a different user logged onto Facebook from the same device, they sometimes weren't prompted to run the malware scan. Similarly, switching browsers sometimes made the malware message disappear. This inconsistency in the system's behavior indicates an omission of performing the intended function consistently [68625]. (c) timing: There is no specific mention of a timing-related failure in the articles provided. (d) value: The mandatory malware scan feature on Facebook was reported to be poorly designed and inconsistently implemented. Users expressed frustration with the system's behavior, indicating a failure in performing its intended functions correctly [68625]. (e) byzantine: The behavior of the malware scan feature on Facebook showed inconsistencies in responses and interactions. For example, users were prompted to download Windows files on Mac devices, and the system did not accurately detect infected accounts, leading to users being locked out of their accounts. This erratic behavior points towards a byzantine failure with inconsistent responses and interactions [68625]. (f) other: The articles do not provide information on a specific "other" behavior of the software failure incident.

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident described in the articles led to people being locked out of their Facebook accounts due to the mandatory malware scan. This resulted in users losing access to their accounts, causing frustration and confusion. Additionally, the incident highlighted concerns about the potential risks associated with antivirus software, as users might not want to give Facebook and its cybersecurity partners access to their devices [68625].
Domain information, finance (a) The failed system in the article is related to the information industry, specifically social media platforms like Facebook that deal with the production and distribution of information. The incident involved Facebook's mandatory malware scan causing issues for users trying to access their accounts, highlighting the challenges faced by users in dealing with malware threats on the platform [68625]. (h) The incident also touches upon the finance industry indirectly as it discusses concerns about the potential risks associated with antivirus software, which is a powerful tool capable of accessing nearly everything on a computer. Users may be hesitant to grant such extensive access to Facebook and its cybersecurity partners, raising questions about data security and privacy in the context of financial transactions and sensitive information [68625]. (m) Additionally, the article briefly mentions the potential impact of Facebook's malware scanner on users' antivirus software, with one user reporting that running Facebook's malware detector caused his own antivirus to disappear. This incident highlights the interconnected nature of software systems and the potential consequences of conflicts between different security tools, which could affect users across various industries beyond those explicitly mentioned in the article [68625].

Sources

Back to List