| Recurring |
one_organization |
(a) The software failure incident has happened again at one_organization:
The Oak Ridge National Laboratory experienced a similar software failure incident in 2007 when hackers accessed a nonclassified database at the lab, compromising sensitive information of thousands of individuals who had visited the lab between 1990 and 2004. The attack in 2007 also involved spear phishing, malicious attachments, and malware installation on employee computers, resulting in the exfiltration of gigabytes of data [5151].
(b) The software failure incident has happened again at multiple_organization:
There is no information in the provided article about the software failure incident happening again at other organizations or with their products and services. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident related to the design phase can be attributed to the exploitation of a zero-day vulnerability in Internet Explorer that allowed attackers to breach the Oak Ridge National Laboratory's network. The attackers used a spear-phishing email that contained a link to a malicious website, which then exploited the vulnerability to install malware on users' machines [5151].
(b) The software failure incident related to the operation phase occurred when the attackers were able to exfiltrate data from the lab's servers after successfully infecting a server with malware. Despite efforts to block the malicious emails and clean up the infected system, the malware was able to spread to other servers within the network, prompting the lab to block internet access to prevent further data exfiltration [5151]. |
| Boundary (Internal/External) |
within_system |
(a) within_system: The software failure incident at the Oak Ridge National Laboratory was primarily caused by a sophisticated cyber attack that originated from within the system. The attackers exploited a zero-day vulnerability in Internet Explorer to breach the lab's network through a spear-phishing email sent to lab employees [5151]. The malware then spread within the system, laying dormant on servers before becoming active and prompting the lab to block internet access to prevent further exfiltration [5151].
(b) outside_system: The incident involved external factors such as the attackers who initiated the cyber attack from outside the system. The attackers used social engineering tactics like spear phishing to target lab employees and gain access to the network [5151]. Additionally, the vulnerability in Internet Explorer that was exploited was a known external factor that Microsoft had patched, indicating a weakness originating from outside the lab's system [5151]. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident at the Oak Ridge National Laboratory was primarily due to non-human actions, specifically a sophisticated cyberattack that exploited a zero-day vulnerability in Internet Explorer. The attackers used a spear-phishing email to target lab employees, leading to the installation of malware on two computers within the network. The malware then spread to other servers, prompting the lab to disconnect internet access to prevent further exfiltration of data. The malware was designed to erase itself if unsuccessful in compromising a system, and the exfiltrated data was encrypted, with investigations ongoing to determine its destination [5151].
(b) However, human actions also played a role in the software failure incident. Employees at the lab were targeted through a spear-phishing email that contained a link to a malicious website. Despite efforts to block the malicious emails, 57 people clicked on the link, resulting in two machines getting infected with the malware. This highlights the importance of human vigilance and cybersecurity awareness in preventing such incidents [5151]. |
| Dimension (Hardware/Software) |
hardware, software |
(a) The software failure incident at the Oak Ridge National Laboratory was primarily due to a hardware-related contributing factor. The breach occurred when attackers exploited a critical remote-code execution vulnerability in Internet Explorer, which allowed them to install malware on users' machines [5151].
(b) Additionally, the software failure incident was also influenced by contributing factors originating in software. The attackers used a spear-phishing email as the initial vector to deliver the malware, which exploited the IE vulnerability to download additional code to users' machines [5151]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident at the Oak Ridge National Laboratory was malicious in nature. The incident involved a sophisticated cyberattack where attackers used a zero-day vulnerability in Internet Explorer to breach the lab's network. The attack was initiated through a spear-phishing email that contained a link to a malicious website, leading to the installation of malware on users' machines. The attackers managed to exfiltrate data from the lab's servers, and the malware was designed to erase itself if unsuccessful in compromising a system. This incident was part of a targeted attack aimed at stealing sensitive data from the lab [5151].
(b) There is no information in the articles to suggest that the software failure incident was non-malicious. |
| Intent (Poor/Accidental Decisions) |
poor_decisions, accidental_decisions |
(a) The software failure incident at the Oak Ridge National Laboratory was primarily due to poor decisions made by employees who fell victim to a sophisticated spear-phishing attack. The attackers sent a spear-phishing email to lab employees, pretending to be from the human resources department discussing employee benefits, which included a link to a malicious website exploiting an Internet Explorer zero-day vulnerability [5151].
(b) The software failure incident can also be attributed to accidental decisions made by employees who clicked on the malicious link in the spear-phishing email, leading to the installation of malware on their machines. This accidental decision ultimately allowed the attackers to breach the lab's network and exfiltrate data [5151]. |
| Capability (Incompetence/Accidental) |
accidental |
(a) The software failure incident at the Oak Ridge National Laboratory was not due to development incompetence but rather due to a sophisticated cyberattack. The attackers exploited a zero-day vulnerability in Internet Explorer to breach the lab's network through a spear-phishing email campaign [5151].
(b) The software failure incident at the Oak Ridge National Laboratory was accidental in the sense that the breach occurred due to employees clicking on a malicious link in a spear-phishing email, which led to the installation of malware on their machines. This accidental action by employees allowed the attackers to gain access to the lab's network and exfiltrate data [5151]. |
| Duration |
temporary |
(a) The software failure incident in this case was temporary. The incident involved a hack where data was being siphoned from a server at the Oak Ridge National Laboratory. The breach was discovered, and internet access for workers was cut off to prevent further exfiltration. The attackers used a zero-day vulnerability in Internet Explorer to breach the network through a spear-phishing email sent to lab employees. The malware laid dormant for a week before becoming active on other servers, prompting the lab to block internet access. The incident was actively managed, with efforts to fully characterize and eradicate the malware ongoing [5151]. |
| Behaviour |
crash, other |
(a) crash: The software failure incident described in the article can be categorized as a crash. The incident involved the intrusion of malware through a spear-phishing email, leading to the compromise of servers and the exfiltration of data. The malware was designed to erase itself if unsuccessful in compromising a system, and it eventually caused multiple servers to become active with the malware, prompting the lab to block internet access to prevent further damage [5151].
(b) omission: The incident does not specifically mention a failure due to the system omitting to perform its intended functions at an instance(s).
(c) timing: The incident does not involve a failure due to the system performing its intended functions correctly, but too late or too early.
(d) value: The software failure incident does not involve a failure due to the system performing its intended functions incorrectly.
(e) byzantine: The incident does not describe a failure due to the system behaving erroneously with inconsistent responses and interactions.
(f) other: The behavior of the software failure incident can be categorized as a targeted cyberattack involving the exploitation of a zero-day vulnerability in Internet Explorer through a spear-phishing email. The attackers' actions were described as sophisticated, and the incident resulted in the exfiltration of data from the lab's servers [5151]. |