Incident: Malware Triggering Endless Printouts on Print Servers.

Published Date: 2012-06-22

Postmortem Analysis
Timeline 1. The software failure incident of print servers emptying paper trays by printing endless pages of meaningless characters due to Trojan.Milicenso malware happened in 2010 [13033].
System 1. Print servers 2. Windows-based computers 3. Trojan.Milicenso malware 4. Adware.Eorezo payload 5. Networks
Responsible Organization 1. The entity responsible for causing the software failure incident was the malware dubbed Trojan.Milicenso, which targeted Windows-based computers and triggered massive print jobs leading to garbled printouts [13033].
Impacted Organization 1. Companies around the globe [13033]
Software Causes 1. The software cause of the failure incident was a malware named Trojan.Milicenso targeting Windows-based computers, spreading through malicious e-mail attachments or visiting malicious websites, and triggering massive print jobs leading to endless pages of meaningless characters [13033].
Non-software Causes 1. The malware, Trojan.Milicenso, spreading through malicious e-mail attachments or visiting websites hosting malicious scripts [13033]. 2. The payload associated with Trojan.Milicenso, Adware.Eorezo, targeting French-speaking users [13033].
Impacts 1. Print servers around the globe were affected, with paper trays being emptied by printing endless pages of meaningless characters [13033]. 2. The malware, Trojan.Milicenso, primarily targeted Windows-based computers and spread through malicious e-mail attachments or visiting malicious websites [13033]. 3. Infected computers were mainly located in the U.S., India, Brazil, the U.K., and other countries in Europe and South America [13033]. 4. The malware was initially designed as a malware delivery vehicle for hire, with the payload associated with Adware.Eorezo targeting French-speaking users [13033]. 5. The side effect of the malware infection was triggering massive print jobs, leading to garbled printouts in some networks [13033].
Preventions 1. Implementing robust email security measures to prevent malicious emails from delivering the malware [13033]. 2. Utilizing web filtering tools to block access to websites hosting malicious scripts [13033]. 3. Keeping operating systems and software up to date with the latest security patches to prevent vulnerabilities that malware can exploit [13033].
Fixes 1. Implementing robust antivirus software and keeping it up to date to detect and remove the Trojan.Milicenso malware [13033]. 2. Conducting thorough security audits and educating users on safe browsing habits to prevent the spread of malware through malicious email attachments or visiting compromised websites [13033]. 3. Regularly updating operating systems and software to patch vulnerabilities that malware like Trojan.Milicenso exploits [13033].
References 1. Symantec blog post [13033]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident has happened again at one_organization: The article mentions that Symantec encountered Trojan.Milicenso in 2010, indicating that the malware has resurfaced within Symantec's environment [13033]. (b) The software failure incident has happened again at multiple_organization: The article states that companies around the globe have been reporting the issue of print servers emptying paper trays due to the malware, indicating that multiple organizations have been affected by this software failure incident [13033].
Phase (Design/Operation) design (a) The software failure incident in Article 13033 can be attributed to the design phase. The incident was caused by a malware named Trojan.Milicenso, which was designed to spread through malicious e-mail attachments or visiting websites hosting malicious scripts. The malware was initially encountered in 2010 and was primarily a malware delivery vehicle for hire. The payload associated with this malware was Adware.Eorezo, targeting French-speaking users. The unintended consequence of this malware was triggering massive print jobs, which resulted in print servers emptying paper trays by printing endless pages of meaningless characters. This unintended consequence was a side effect of the infection vector rather than an intentional goal of the malware author [13033]. (b) The software failure incident in Article 13033 does not directly point to failure due to operation or misuse of the system.
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident of endless printing of meaningless characters from print servers was caused by a malware named Trojan.Milicenso. This malware targeted Windows-based computers and spread through malicious e-mail attachments or visiting websites hosting malicious scripts. The malware was designed to direct computers to pages with advertisements, but a side effect in some networks triggered massive print jobs, leading to the garbled printouts issue [13033]. (b) outside_system: The malware responsible for the software failure incident, Trojan.Milicenso, originated from outside the affected systems. It was spread through malicious e-mail attachments and visiting websites hosting malicious scripts, indicating an external source of the failure [13033].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case was primarily due to non-human actions, specifically the presence of malware named Trojan.Milicenso. The malware was responsible for triggering massive print jobs on affected computers, leading to the emptying of paper trays and printing meaningless characters [13033]. (b) Human actions were also involved in the software failure incident as the malware spread through malicious e-mail attachments or visiting websites hosting malicious scripts. This indicates that human actions, such as opening malicious attachments or visiting compromised websites, contributed to the introduction of the malware onto the affected systems [13033].
Dimension (Hardware/Software) software (a) The software failure incident in this case is not directly attributed to hardware issues. The incident is caused by a malware named Trojan.Milicenso that targets Windows-based computers and spreads through malicious email attachments or visiting websites with malicious scripts. The malware triggers massive print jobs leading to the emptying of paper trays and printing meaningless characters [13033]. (b) The software failure incident is directly linked to software issues. The malware, Trojan.Milicenso, is the root cause of the problem, as it infects computers and causes them to print endless pages of meaningless characters. The malware is designed to direct computers to pages with advertisements, but a side effect is the triggering of massive print jobs, which is the main issue in this case [13033].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case is malicious. The incident was caused by a malware named Trojan.Milicenso, which was designed to target Windows-based computers and spread through malicious e-mail attachments or visiting websites hosting malicious scripts. The malware triggered massive print jobs on infected computers, emptying paper trays by printing endless pages of meaningless characters. Symantec mentioned that the malware was primarily affecting computers in the U.S. and India, as well as in other countries in Europe and South America. The payload associated with this malware was Adware.Eorezo, which targeted French-speaking users. Symantec concluded that the garbled printouts were a side effect of the infection vector rather than an intentional goal of the author [13033].
Intent (Poor/Accidental Decisions) accidental_decisions (a) The intent of the software failure incident related to poor_decisions: - The software failure incident involving the Trojan.Milicenso malware causing print servers to empty paper trays by printing endless pages of meaningless characters was not an intentional goal of the author. Symantec mentioned that the garbled printouts were a side effect of the infection vector rather than an intentional goal of the author [13033]. This indicates that the failure was not due to poor decisions but rather an unintended consequence of the malware's behavior.
Capability (Incompetence/Accidental) accidental (a) The software failure incident in Article 13033 was not attributed to development incompetence. Instead, it was caused by malware known as Trojan.Milicenso, which targeted Windows-based computers and spread through malicious e-mail attachments or visiting malicious websites. The malware's primary purpose was to deliver adware, with a side effect being the triggering of massive print jobs on infected computers. Symantec mentioned that the garbled printouts were a side effect of the infection vector rather than an intentional goal of the malware author. (b) The software failure incident in Article 13033 was accidental in nature. The malware, Trojan.Milicenso, was designed as a malware delivery vehicle for hire, primarily delivering adware targeting French-speaking users. The unintended consequence of triggering massive print jobs with garbled printouts was not the intentional goal of the malware author but rather a side effect of the infection vector.
Duration temporary (a) The software failure incident described in the article is temporary. The incident of print servers emptying paper trays by printing endless pages of meaningless characters was caused by the malware Trojan.Milicenso. This malware was designed to trigger massive print jobs as a side effect of the infection vector, rather than being the intentional goal of the author. The article mentions that the malware can spread through malicious e-mail attachments or visiting websites hosting malicious scripts, indicating that the failure was temporary and not a permanent issue introduced by all circumstances [13033].
Behaviour other (a) crash: The software failure incident described in the article is not a crash where the system loses state and stops performing its intended functions. Instead, it involves the system triggering massive print jobs of meaningless characters as a side effect of the malware infection [13033]. (b) omission: The software failure incident is not due to the system omitting to perform its intended functions at an instance(s). The incident involves the system printing endless pages of meaningless characters, which is an unintended consequence of the malware infection [13033]. (c) timing: The software failure incident is not related to the system performing its intended functions correctly but at the wrong time. The issue described in the article involves the system printing garbled printouts as a side effect of the malware infection, rather than a timing issue [13033]. (d) value: The software failure incident is not caused by the system performing its intended functions incorrectly in terms of the expected output or value. The incident involves the system printing meaningless characters as a side effect of the malware infection, rather than producing incorrect results [13033]. (e) byzantine: The software failure incident does not exhibit a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. The incident is primarily about triggering massive print jobs of meaningless characters due to the malware infection, which is a specific and consistent behavior [13033]. (f) other: The software failure incident involves the system printing endless pages of meaningless characters as a side effect of the malware infection. This behavior does not fit into the crash, omission, timing, value, or byzantine categories. The "other" behavior in this case is the unintended consequence of the malware causing the system to print continuously without meaningful content [13033].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident described in Article 13033 resulted in the unintended consequence of triggering massive print jobs on affected networks. This led to paper trays being emptied by printing endless pages of meaningless characters, which can be considered a waste of resources such as paper and ink. Additionally, the malware responsible for the incident, Trojan.Milicenso, was designed as a malware delivery vehicle for hire, with the payload commonly associated with the latest version being Adware.Eorezo targeting French-speaking users. This indicates that the software failure incident not only caused disruptions in printing but also potentially exposed users to unwanted advertisements and adware, impacting their digital experience and potentially their data security and privacy [13033].
Domain information (a) The failed system was intended to support the information industry. The incident involved print servers being affected by malware, causing them to print endless pages of meaningless characters [13033]. This disruption in the printing process directly impacts the production and distribution of information within organizations using the affected print servers.

Sources

Back to List