Incident: Exploitation of Internet Explorer Flaws for Cyber Attacks.

Published Date: 2014-07-25

Postmortem Analysis
Timeline 1. The software failure incident happened in July 2014.
System The system that failed in the software failure incident described in the article is: 1. Microsoft's Internet Explorer [28463]
Responsible Organization 1. Hackers and cybercriminals [28463]
Impacted Organization 1. Users of Microsoft's Internet Explorer were impacted by the software failure incident as hackers were able to exploit flaws in the browser to gather information on security software and vulnerabilities, potentially leading to unauthorized access to their computers and data [Article 28463].
Software Causes 1. The software cause of the failure incident was the exploitation of flaws in Microsoft's Internet Explorer by hackers and cybercriminals to search computers, discover security software vulnerabilities, and take control of vulnerable machines [28463].
Non-software Causes 1. Lack of awareness and vigilance among users regarding cybersecurity threats and the importance of using secure browsers like Chrome [28463].
Impacts 1. The software failure incident involving flaws in Microsoft's Internet Explorer allowed hackers and cybercriminals to conduct digital reconnaissance on a massive scale, exposing security vulnerabilities in computers, web servers, and users without their knowledge [28463]. 2. The incident enabled hackers to determine what security software was installed on targeted machines, allowing them to intelligently attack vulnerable systems and avoid detection by security companies [28463]. 3. Cybercriminals were able to probe systems to identify vulnerable software, such as PDF readers and other user applications, which could be exploited to take control of computers [28463]. 4. The software failure incident impacted companies by allowing cybercriminals to surveil users, identify specific vulnerabilities, and gain access to sensitive data and systems within the company network [28463]. 5. The incident highlighted the importance of using secure browsers like Google Chrome over Internet Explorer to mitigate the risks associated with software vulnerabilities and cyber attacks [28463].
Preventions 1. Regularly updating and patching software vulnerabilities: Microsoft could have prevented the software failure incident by promptly addressing and patching the vulnerabilities in Internet Explorer that were being exploited by hackers [28463]. 2. Using a more secure browser: Users could have prevented the incident by using a more secure browser like Google Chrome, which is designed with security features that make it harder for attackers to exploit vulnerabilities [28463].
Fixes 1. Upgrading to the latest modern browser, Internet Explorer 11, which contains new and improved security features to protect customers [28463]. 2. Ditching Internet Explorer and using a third-party browser like Google's Chrome, which is designed with security in mind and has a suite of security features in place to mitigate vulnerabilities [28463].
References 1. Security researchers at AlienVault Labs [28463]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the exploitation of vulnerabilities in Microsoft's Internet Explorer has happened again within the same organization. The article mentions that Microsoft is aware of the vulnerabilities in Internet Explorer and has patched some of them, but some vulnerabilities have remained open for more than a year after being reported [28463]. (b) The software failure incident has also occurred at multiple organizations. The article highlights that cybercriminals are using flaws in Internet Explorer to conduct digital reconnaissance on a massive scale, targeting whole companies, computers, web servers, and users to exploit security software and other vulnerable applications. This technique has been observed in attacks targeting the US defense department and government employees, indicating that this method is being adopted by various cybercriminal groups [28463].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be attributed to the vulnerabilities in Microsoft's Internet Explorer that hackers and cybercriminals exploited. The tight integration of Internet Explorer into the Windows software allowed hackers to search computers, determine security software vulnerabilities, and collect information on software running on machines to plan future attacks [28463]. (b) The software failure incident related to the operation phase can be linked to the misuse of Internet Explorer by cybercriminals. They used the browser to surveil company users, check for vulnerabilities, set up traps for unsuspecting users, and gain access to data and systems within a company [28463].
Boundary (Internal/External) within_system (a) within_system: The software failure incident described in the articles is primarily within the system. The vulnerability exploited by hackers and cybercriminals is related to flaws in Microsoft's Internet Explorer, which is tightly integrated into the Windows software. This integration allows the attackers to gather information about security software, vulnerabilities in other software, and even set up traps for unsuspecting users within the system [28463]. The failure originates from within the system due to the design and integration of Internet Explorer with Windows, making it susceptible to exploitation by cybercriminals.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The software failure incident in this case is primarily due to vulnerabilities in Microsoft's Internet Explorer that are being exploited by hackers and cybercriminals. These vulnerabilities allow for digital reconnaissance to be conducted on a massive scale without the users' knowledge, exposing security holes and enabling intelligent attacks on vulnerable machines [28463]. (b) The software failure incident occurring due to human actions: The software failure incident also involves human actions, specifically the actions of hackers and cybercriminals who are actively exploiting the flaws in Internet Explorer to gather information on security software, software vulnerabilities, and user applications. These cybercriminals are using the collected data to set up traps for unsuspecting users and gain access to sensitive data and systems within companies [28463].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - The article does not mention any software failure incident occurring due to contributing factors originating in hardware. Therefore, it is unknown. (b) The software failure incident occurring due to software: - The software failure incident mentioned in the article is related to vulnerabilities in Microsoft's Internet Explorer being exploited by hackers and cybercriminals to perform digital reconnaissance, determine security software installed on computers, and identify potential vulnerabilities in other software applications [28463].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the articles is malicious in nature. It involves hackers and cybercriminals exploiting flaws in Microsoft's Internet Explorer to conduct digital reconnaissance on computers and web servers, with the intent to take control of vulnerable machines and systems [28463]. The hackers are using the information gathered to intelligently attack vulnerable machines, avoid alerting security companies, and gain access to data and systems within companies. This malicious activity is aimed at compromising security and exploiting vulnerabilities for personal gain or harm.
Intent (Poor/Accidental Decisions) poor_decisions (a) poor_decisions: The software failure incident related to the exploitation of flaws in Microsoft's Internet Explorer by hackers can be attributed to poor decisions made in the design and integration of Internet Explorer with Windows software. The tight integration of Internet Explorer into Windows software allowed hackers to exploit vulnerabilities and gather information about security software and potential vulnerabilities in other applications [28463]. (b) accidental_decisions: The software failure incident does not seem to be primarily attributed to accidental decisions or unintended mistakes. Instead, it is more focused on the deliberate actions of hackers and cybercriminals exploiting known vulnerabilities in Internet Explorer for malicious purposes [28463].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident in the articles can be attributed to development incompetence. The incident involved hackers exploiting flaws in Microsoft's Internet Explorer to gather information on security software and vulnerabilities in order to intelligently attack vulnerable machines [28463]. The vulnerabilities in Internet Explorer, which allowed for this reconnaissance and potential attacks, were due to its tight integration into Windows software, giving it access to other software features. Despite Microsoft being aware of these vulnerabilities and patching some, some security holes remained open for more than a year after being reported [28463]. This showcases a lack of professional competence in addressing and mitigating these security flaws promptly and effectively.
Duration temporary The software failure incident described in the articles is more aligned with a temporary failure rather than a permanent one. This is evident from the fact that the incident is related to hackers exploiting vulnerabilities in Microsoft's Internet Explorer to gather information on security software and potential vulnerabilities in user applications [28463]. The article mentions that Microsoft is aware of the vulnerabilities and has patched some of them, indicating that the issue is not permanent and can be addressed through software updates and patches. Additionally, the recommendation to switch to a third-party browser like Google Chrome, which is considered more secure, implies that the vulnerability is not inherent and can be mitigated by using alternative software solutions [28463].
Behaviour value, other (a) crash: The articles do not mention any specific instance of a crash where the system loses state and does not perform any of its intended functions. (b) omission: The articles do not mention any specific instance of omission where the system omits to perform its intended functions at an instance(s). (c) timing: The articles do not mention any specific instance of timing failure where the system performs its intended functions correctly, but too late or too early. (d) value: The software failure incident described in the articles is related to a value failure. Hackers are exploiting flaws in Microsoft's Internet Explorer to search computers, determine what security software is running, and take control of vulnerable machines [28463]. (e) byzantine: The articles do not mention any specific instance of a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident described in the articles can be categorized as a security vulnerability exploit by hackers to gain unauthorized access and control over systems, rather than a traditional software failure like a crash or omission.

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident described in the article relates to hackers exploiting flaws in Microsoft's Internet Explorer to gather information about security software and vulnerabilities on computers. This breach of security could potentially lead to the compromise of sensitive data and systems within a company, impacting people's material goods, money, or data [28463].
Domain information (a) The software failure incident reported in the articles is related to the information industry. The incident involves hackers exploiting flaws in Microsoft's Internet Explorer to gather information about security software, vulnerabilities in user applications, and conducting digital reconnaissance on computers and web servers [28463].

Sources

Back to List