Incident: Malware-laced Advertisements Infect Computers via AOL's Network

Published Date: 2015-01-08

Postmortem Analysis
Timeline 1. The software failure incident of malware-laced advertisements affecting computers and locking them down happened between December 31 and January 5 [32679]. 2. The incident occurred in December 2014 to January 2015.
System 1. Outdated browsers, specifically Internet Explorer 8, were susceptible to the malware attack [32679]. 2. Third-party advertising networks that deliver ads to screens were exploited by criminals to deliver malvertisements [32679].
Responsible Organization 1. Hackers responsible for the malware-laced advertisements that infected computers and locked them down [32679].
Impacted Organization 1. Computers running Windows PCs using outdated browsers, including Internet Explorer 8 [32679] 2. Users visiting websites such as The Huffington Post, FHM, LA Weekly, Houston Press, GameZone, and others [32679]
Software Causes 1. Outdated browsers, specifically Internet Explorer 8, were susceptible to the malware, while modern and updated browsers like Internet Explorer 11, Google Chrome, and Mozilla Firefox were not affected [32679]. 2. Malvertising, a technique where malware is delivered through online advertisements, was used to infect computers [32679]. 3. The malicious software involved in the incident was a strain of ransomware called Kovter, which blocked access to the keyboard and mouse, displaying a fake message claiming to be from law enforcement and demanding a fine [32679]. 4. The malware exploited vulnerabilities in the ad delivery process of third-party advertising networks, allowing criminals to pose as legitimate customers and deliver malware-laced ads [32679].
Non-software Causes 1. The cyberattack and extortion campaign was caused by hackers who infected computers with malware through malicious advertisements [32679]. 2. The malware-laced advertisements were served by AOL's network, indicating a vulnerability in the ad delivery system [32679]. 3. The attack targeted people using outdated browsers, particularly Internet Explorer 8, which suggests a lack of browser security updates [32679]. 4. The malware demanded a ransom payment via hard-to-trace, pre-paid Mastercard and Visa cards, indicating a financial motivation behind the attack [32679]. 5. The malvertisement campaign exploited the automated and complex nature of online ad networks, allowing criminals to pose as legitimate customers and deliver malware-laced ads [32679].
Impacts 1. Computers running Windows PCs with outdated browsers, such as Internet Explorer 8, were infected with malware that locked them down, demanding money to unlock them [32679]. 2. The malware affected users who visited websites displaying the malicious ads, including The Huffington Post, FHM, LA Weekly, Houston Press, GameZone, and others [32679]. 3. The malware strain called Kovter acted as ransomware, blocking access to the keyboard and mouse, displaying fake messages claiming the user viewed illegal content, and demanding a $300 "fine" [32679]. 4. The malware tailored its messages based on the computer's location, showing fake messages from law enforcement agencies relevant to the country of the infected computer [32679]. 5. The malvertising incident highlighted the vulnerability of online advertising networks to malicious actors who can easily inject malware into ads, posing a significant threat to users' security [32679].
Preventions 1. Keeping software and browsers up to date with the latest security patches and versions could have prevented the malware attack on outdated browsers like Internet Explorer 8 [32679]. 2. Implementing stricter ad network security measures to detect and prevent malvertising attacks could have helped in preventing the distribution of malware-laced advertisements [32679]. 3. Conducting regular security audits and monitoring of third-party advertising networks to ensure the legitimacy of ads being served to users could have potentially identified and mitigated the malvertising campaign [32679].
Fixes 1. Updating browsers to the latest versions such as Internet Explorer 11, Google Chrome, and Mozilla Firefox to prevent susceptibility to the malware [32679]. 2. Implementing stricter security measures in the advertising process to ensure ads uphold quality standards and create positive consumer experiences [32679]. 3. Enhancing monitoring and detection capabilities to identify malvertising activities and take prompt action to shut down malicious advertisements [32679].
References 1. Researchers at cybersecurity firm Cyphort [32679] 2. FHM's publisher, Bauer Media UK [32679] 3. AOL spokesman Gerasimos Manolatos [32679] 4. AOL [32679] 5. MalwareBytes [32679] 6. Nick Bilogorskiy, Cyphort's security research director [32679] 7. Google [32679]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to malware-laced advertisements infecting computers and locking them down has happened again at AOL. The incident involved malicious ads served by AOL's network, affecting various websites including The Huffington Post, FHM, LA Weekly, Houston Press, GameZone, and others [32679]. (b) The software failure incident of malvertising, specifically the distribution of malware through online ads, has also affected multiple organizations beyond AOL. This incident is a form of malvertising that is becoming a growing problem in the online advertising industry, with criminals using legitimate-looking ads to distribute malware to unsuspecting users [32679].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be attributed to the malvertising attack that infected computers through malicious advertisements served by AOL's network. The malware-laced ads were able to bypass security measures and infect computers running outdated browsers like Internet Explorer 8. The attack exploited vulnerabilities in the ad delivery system, allowing the malware to be distributed to unsuspecting users simply by visiting websites with the infected ads [32679]. (b) The software failure incident related to the operation phase can be linked to the users' interaction with the infected ads. Users did not have to click on the ads for their computers to get infected; the malware was able to silently infiltrate computers when the ads appeared on the screen. This highlights the impact of user interaction with the system in triggering the malware infection, showcasing how the operation of the system (in this case, browsing websites with the infected ads) led to the failure incident [32679].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident in this case was primarily due to malvertising, where malware-laced advertisements were served through AOL's network, affecting multiple websites including The Huffington Post, FHM, LA Weekly, Houston Press, and GameZone [32679]. The malware, named Kovter, infected computers and locked them down, demanding a ransom to unlock them. The malicious software exploited vulnerabilities in outdated browsers like Internet Explorer 8, affecting users who were running these older versions [32679]. (b) outside_system: The contributing factors that originated from outside the system include the cyberattack orchestrated by hackers who injected the malware into the ads served by AOL's network. The malware-laced advertisements were designed to appear as normal ads but contained malicious code that infected computers when displayed on websites, targeting visitors without requiring them to click on the ads [32679]. Additionally, the malvertisement campaign involved redirecting the ad sources multiple times, ultimately leading to a shady Polish website's server, which helped evade detection by AOL's security measures [32679].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the article was primarily due to non-human actions. The incident involved malvertising, where malware-laced advertisements were served through AOL's network, infecting computers without the need for users to click on the ads. The malware, named Kovter, locked down computers and demanded ransom payments to unlock them. The malicious software exploited vulnerabilities in outdated browsers like Internet Explorer 8, affecting users who visited websites displaying the poisoned ads [32679]. (b) Human actions also played a role in this software failure incident. The malvertising campaign was orchestrated by hackers who injected the malware into the ads served by AOL's network. Additionally, the article mentions that FHM's publisher, Bauer Media UK, requested their advertising partner, The Rubicon Project, to investigate the matter, indicating human intervention in addressing the aftermath of the incident [32679].
Dimension (Hardware/Software) software (a) The software failure incident reported in the article was not due to hardware issues but rather due to malware-laced advertisements that infected computers and locked them down. The incident was a result of malvertising, where normal-looking ads were actually laced with malware, affecting users running Windows PCs with outdated browsers like Internet Explorer 8 [32679]. (b) The software failure incident was primarily caused by malicious software known as Kovter, a strain of ransomware that blocked access to the keyboard and mouse, displaying a fake message claiming to be from law enforcement and demanding a fine. The malware did not encrypt files but blocked access, and users could regain control by rebooting in safe mode and using antivirus software like MalwareBytes to clean the computer [32679].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. It involved a cyberattack where malware-laced advertisements were displayed on various websites, infecting computers and locking them down. The hackers behind the attack demanded money to unlock the infected computers, indicating a clear intent to harm the systems [32679].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was related to poor_decisions. The incident involved malvertising, where malware-laced advertisements were displayed on various websites, infecting computers and locking them down. The malicious software, Kovter, was a strain of ransomware that demanded money to unlock infected computers. The malware was distributed through ads served by AOL's network, affecting users running outdated browsers like Internet Explorer 8. The criminals behind the attack posed as legitimate customers with normal-looking ads that were actually laced with malware, taking advantage of the automated and complex nature of online ad delivery [32679]. AOL's alarms did not go off because the ad redirected its source multiple times, making it difficult to detect the malicious content [32679].
Capability (Incompetence/Accidental) accidental (a) The software failure incident reported in the article was not due to development incompetence. It was primarily a result of a cyberattack involving malvertising, where malware-laced advertisements were displayed on various websites, infecting computers and locking them down [32679]. (b) The software failure incident was accidental in nature. The malware-laced advertisements that caused the incident were served by AOL's network and were not initially detected due to the complex nature of malvertising, where ads can be manipulated to deliver malware without being easily caught. The incident was described as a malvertisement that targeted every single visitor to The Huffington Post website, indicating the accidental nature of the attack [32679].
Duration temporary (a) The software failure incident described in the article was temporary. The malware-laced advertisements that infected computers and locked them down were active for a specific period, running on ads served by AOL's network between Dec. 31 until Jan. 5 [32679]. The malicious software, Kovter, did not permanently damage the files on the infected computers but rather blocked access to the keyboard and mouse, displaying a message demanding a "fine" [32679]. The incident was resolved when AOL shut down the malvertisements two days after being alerted by Cyphort on Jan. 3 [32679].
Behaviour crash (a) crash: The software failure incident described in the article can be categorized as a crash. The malware-laced advertisements caused computers to be infected and locked down, cutting off access to the keyboard and mouse, essentially rendering the system inoperable and not performing its intended functions [32679].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident described in the article involved malware-laced advertisements that infected computers and locked them down. The malware, known as Kovter, was a strain of ransomware that blocked access to the keyboard and mouse on infected computers. The screen displayed a message claiming to be from law enforcement, demanding a $300 "fine" payable only via hard-to-trace, pre-paid Mastercard and Visa cards from MoneyPak. This indicates that people's material goods (money) were impacted by the software failure incident [32679].
Domain information, finance, other (a) The software failure incident reported in the article is related to the information industry, specifically online advertising networks like AOL and Google delivering malware-laced advertisements on various websites such as The Huffington Post, FHM, LA Weekly, GameZone, etc. This incident affected users' computers by infecting them with ransomware called Kovter, which locked down their systems and demanded payment to unlock them [32679]. (h) Additionally, the incident is related to the finance industry as the ransomware demanded a $300 "fine" payable only via hard-to-trace, pre-paid Mastercard and Visa cards from MoneyPak. The malware claimed to be from law enforcement agencies and accused users of viewing child pornography, indicating a financial extortion scheme [32679]. (m) The incident can also be categorized under the "other" industry as it involves cybersecurity and malware attacks, which are not limited to a specific industry but have implications for various sectors and individuals using the internet [32679].

Sources

Back to List