Incident: 'Here you have' Trojan Virus Causes Email System Failures

Published Date: 2010-09-10

Postmortem Analysis
Timeline 1. The software failure incident of the 'Here you have' virus happened around September 2010. [2944]
System The software failure incident described in the article was caused by a trojan virus known as the 'Here you have' virus. The systems that failed in this software failure incident were: 1. Corporate email systems at various businesses, including Nasa, Comcast, AIG, Disney, and Proctor & Gamble, were brought down by the sheer weight of messages from the virus [2944]. 2. Anti-virus software that was installed on the infected machines was targeted by the virus, as it attempted to shut down any anti-virus software present [2944].
Responsible Organization 1. The 'Here you have' virus, specifically the trojan worm called VBMania, was responsible for causing the software failure incident [2944].
Impacted Organization 1. Firms including Nasa, Comcast, AIG, Disney, and Proctor & Gamble were impacted by the 'Here you have' virus incident as it caused havoc in their corporate email systems [2944].
Software Causes 1. The software cause of the failure incident was a trojan virus known as VBMania, which spread through email attachments and infected users' machines, causing havoc by sending out multiple emails and potentially shutting down anti-virus software [2944].
Non-software Causes 1. The 'Here you have' virus was spread through email, specifically through users clicking on a link in the email which then downloaded the trojan onto their machines [2944].
Impacts 1. The 'Here you have' virus caused havoc by infecting users' address books and filling inboxes with multiple emails, leading to the disruption of corporate email systems at major businesses like Nasa, Comcast, AIG, Disney, and Proctor & Gamble [2944]. 2. The virus spread rapidly by tricking users into clicking on a link that promised free sex downloads or a PDF, resulting in the download of the trojan onto their machines and further spreading to all contacts in their email accounts [2944]. 3. Comcast was forced to shut down its servers due to the attack, highlighting the severity of the impact on businesses [2944]. 4. The virus attempted to shut down anti-virus software installed on infected machines, compromising their security measures [2944]. 5. The incident led to a significant increase in internet searches for the term 'Here you have virus' and prompted security firms like Kaspersky Lab to raise their global threat level, indicating the widespread concern and impact of the software failure incident [2944].
Preventions 1. Keeping anti-virus software up to date and ensuring it is installed on all machines could have prevented the software failure incident [2944]. 2. Deleting any emails with suspicious subject lines, such as 'Here you have', even if they appear to be from known contacts, could have prevented the spread of the virus [2944]. 3. Educating users about the risks of clicking on unknown links or downloading suspicious files could have prevented the software failure incident [2944].
Fixes 1. Installing and keeping anti-virus software up to date can help prevent the 'Here you have' virus from infecting systems and spreading [2944]. 2. Deleting any emails with the subject line 'Here you have' even if they appear to be from known contacts can prevent users from clicking on the malicious links [2944]. 3. Ensuring that internet security packages are installed and regularly updated can provide an additional layer of protection against trojan viruses like the 'Here you have' worm [2944]. 4. Keeping operating software and other programs such as browsers updated can also help protect against vulnerabilities that trojan viruses may exploit [2944].
References 1. Security researcher Ram Herkanaidu at Kaspersky Lab [2944]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the 'Here you have' virus has similarities to the 'I love you' virus that caused havoc about ten years ago. Ram Herkanaidu, a security researcher at Kaspersky Lab, mentioned that the email closely resembles the 'I love you' virus, indicating a similarity in the nature of the incidents within the same context [2944]. (b) The 'Here you have' virus incident affected multiple organizations, including Nasa, Comcast, AIG, Disney, and Proctor & Gamble. These organizations were among those impacted by the trojan virus, with some having to shut down their servers due to the attack. The widespread nature of the incident across various organizations highlights the impact on multiple entities [2944].
Phase (Design/Operation) design, operation (a) The software failure incident described in the article is related to the design phase. The incident involves a trojan virus spread via emails with enticing subject lines like 'Here you have' and promises of free sex films or PDF links. The virus hides inside seemingly harmless computer files and infects users' address books, spreading to all contacts and causing havoc by overwhelming corporate email systems. The email worm, named VBMania, utilizes old tactics to propagate itself through email address books, reminiscent of the 'I love you' virus from about ten years ago. The incident highlights the importance of having a good internet security package installed and up to date to prevent such design-related failures [2944]. (b) The software failure incident is also related to the operation phase. The trojan virus, once clicked on by users, is downloaded onto their machines and spreads to all contacts in their email accounts, sending them the same infected email. The incident led to the shutdown of servers at companies like Comcast, affecting their operations. Additionally, the virus attempts to shut down any anti-virus software installed on the machines, further disrupting the operation of the systems. Users are advised to delete any emails with the subject 'Here you have' to prevent further spread of the virus and to alert their IT offices, emphasizing the operational impact of such malware attacks [2944].
Boundary (Internal/External) within_system (a) within_system: The software failure incident described in the article is primarily within the system. The 'Here you have' virus is a trojan virus that spreads through email attachments and infects users' machines, subsequently sending out emails to all contacts in the address book. The virus also attempts to shut down any anti-virus software installed on the infected machines, indicating that the failure originates from within the system itself [2944]. (b) outside_system: The software failure incident does not have significant contributing factors originating from outside the system. The virus spreads through email attachments and relies on users clicking on malicious links within the emails. While the virus may enter the system from external sources like emails, the core failure and impact are within the system itself [2944].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in Article 2944 was due to non-human actions, specifically a trojan virus named 'Here you have'. The virus spread through emails containing links to free sex films or PDFs, infecting users' machines and spreading to all contacts in their email accounts automatically. The virus also attempted to shut down anti-virus software installed on the machines. This incident highlights how non-human actions, such as the propagation of malware, can lead to software failures [2944]. (b) Human actions also played a role in this software failure incident. Users were required to click on the malicious links in the emails to download the trojan onto their machines. Additionally, the article mentions that users should delete any emails with the subject line 'Here you have', even if they are from someone known, indicating the importance of human vigilance in preventing such incidents. Furthermore, the article advises users to have good internet security packages installed and up to date, emphasizing the role of human actions in maintaining cybersecurity [2944].
Dimension (Hardware/Software) software (a) The software failure incident reported in Article 2944 was not due to hardware issues but rather a trojan virus that spread through email systems. The virus, known as the 'Here you have' virus, was a malicious program hidden in seemingly harmless email attachments. It infected users' address books and caused havoc by sending out multiple emails, overwhelming corporate email systems. The virus also attempted to shut down any anti-virus software installed on the affected machines. This incident was primarily caused by the software-based trojan virus rather than hardware issues. (b) The software failure incident in Article 2944 was directly related to software issues. The 'Here you have' virus was a trojan virus that spread through email systems by tricking users into clicking on a link that downloaded the virus onto their machines. The virus then propagated by sending out emails to all contacts in the infected users' address books. Additionally, the virus attempted to disable anti-virus software on the affected machines. This incident highlights a software failure caused by the malicious software itself rather than any hardware-related factors.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. It involves a trojan virus known as the 'Here you have' virus, which is spreading through emails with the intent to harm computer systems by infecting users' machines and spreading to all contacts in their email accounts [2944]. The virus is designed to deceive users with promises of free sex films or PDF links, ultimately causing havoc by overwhelming corporate email systems and attempting to shut down anti-virus software installed on the machines. The malicious nature of the incident is further emphasized by the fact that it is compared to the infamous 'I love you' virus from about ten years ago, indicating a deliberate attempt to cause disruption and harm [2944].
Intent (Poor/Accidental Decisions) unknown (a) The intent of the software failure incident was not due to poor decisions but rather a deliberate malicious act. The incident involved a trojan virus spread through emails with enticing subject lines like 'Here you have' and promises of free sex films or downloads. Users were tricked into clicking on links that downloaded the virus onto their machines, which then spread to their contacts [2944]. This was a case of a cyber attack rather than a failure stemming from poor decisions within the software development process.
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in Article 2944 can be attributed to development incompetence. The incident involved a trojan virus spread via email with the subject line 'Here you have', promising free sex films. The virus was able to infect users' address books, spread to all contacts, and even attempt to shut down anti-virus software. This indicates a lack of professional competence in terms of ensuring email security and preventing the spread of malicious software [2944]. (b) Additionally, the incident can also be categorized as accidental. The spread of the trojan virus through emails promising free sex films was likely unintentional on the part of the recipients who clicked on the links. The virus was downloaded onto their machines without their explicit knowledge or intent, leading to the inadvertent spread of the malware to their contacts. This accidental action contributed to the widespread impact of the software failure incident [2944].
Duration temporary (a) The software failure incident described in the article is temporary. The incident involves a trojan virus known as the 'Here you have' virus that spreads through email, promising links to free sex films. The virus infects users' address books, fills inboxes with multiple emails, and can bring down corporate email systems. It also attempts to shut down anti-virus software on infected machines. Companies like Nasa, Comcast, AIG, Disney, and Proctor & Gamble were affected by this virus, with Comcast even having to shut down its servers due to the attack. Security experts recommend deleting any emails with the subject 'Here you have' and ensuring that internet security packages are up to date to prevent infection [2944].
Behaviour crash, value (a) crash: The software failure incident described in the article can be categorized as a crash. The 'Here you have' virus was causing havoc by filling inboxes with multiple emails, bringing down corporate email systems, and even attempting to shut down anti-virus software installed on machines. These actions indicate a failure of the system to maintain its state and perform its intended functions [2944].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence theoretical_consequence, other (a) unknown (b) unknown (c) unknown (d) unknown (e) unknown (f) unknown (g) harm was not mentioned as a consequence of the software failure incident [2944] (h) theoretical_consequence: The potential consequence of cybertheft due to trojan attacks was discussed as a threat, but specific incidents of harm or property loss were not mentioned [2944] (i) other: The software failure incident led to the disruption of corporate email systems at various big businesses, including Nasa, Comcast, AIG, Disney, and Proctor & Gamble, causing significant inconvenience and potentially financial losses [2944].
Domain information, knowledge (a) The software failure incident reported in Article 2944 affected various industries related to the production and distribution of information. Businesses such as Nasa, Comcast, AIG, Disney, and Proctor & Gamble were impacted by the 'Here you have' virus, which spread through email systems, causing disruptions and forcing companies to take measures like shutting down servers [2944]. (b) Unknown (c) Unknown (d) Unknown (e) Unknown (f) Unknown (g) Unknown (h) Unknown (i) Unknown (j) Unknown (k) Unknown (l) Unknown (m) The software failure incident did not specifically mention an industry outside of the ones described in options (a) to (l).

Sources

Back to List