Incident: Facebook Cyber Attack Floods Users' Feeds with Pornographic Images

Published Date: 2011-11-15

Postmortem Analysis
Timeline 1. The software failure incident of the cyber attack on Facebook that deluged users in vile porn and horror images happened in November 2011. [Article 9045]
System 1. Browser software vulnerabilities [9045] 2. Facebook's sharing system [9045]
Responsible Organization 1. Hackers exploited vulnerabilities in browser software to cause the software failure incident on Facebook [9045].
Impacted Organization 1. Facebook users worldwide were impacted by the software failure incident reported in Article 9045. [9045]
Software Causes 1. The software failure incident on Facebook was caused by a cyber attack by hackers who exploited vulnerabilities in browser software, leading users to inadvertently paste malware into their browsers, resulting in the sharing of offensive content [9045].
Non-software Causes 1. Users being tricked into pasting malware into their browsers, resulting in the sharing of offensive content [9045] 2. Exploitation of vulnerabilities in browser software, not Facebook itself, making it difficult for the site to respond to the flood of spam [9045] 3. Facebook's 'anything-goes' approach to sharing leading users to believe they were safe to post computer script into their browsers [9045]
Impacts 1. Thousands of Facebook users had their news feeds flooded with violent and pornographic photographs, including doctored pictures of celebrities like Justin Bieber [9045]. 2. Users were tricked into pasting malware into their browsers, resulting in the sharing of offensive content [9045]. 3. The attack led to many users deactivating their Facebook accounts to prevent family and friends from being subjected to the graphic imagery [9045].
Preventions 1. Implementing stricter content filtering and monitoring mechanisms to detect and prevent malicious content from being shared on the platform [9045]. 2. Conducting regular security audits and vulnerability assessments to identify and patch browser vulnerabilities that could be exploited by attackers [9045]. 3. Educating users on safe browsing practices, such as not copying and pasting unknown code into their browsers, using up-to-date browsers, and reporting suspicious content promptly [9045]. 4. Enhancing user awareness about the risks of cyber attacks and the importance of maintaining privacy and security settings on social media platforms [9045].
Fixes 1. Improving browser security and patching vulnerabilities to prevent malware from being pasted into browsers [9045] 2. Enhancing Facebook's systems to better defend against similar attacks in the future [9045]
References 1. Facebook spokeswoman 2. Security company Sophos 3. Users affected by the attack 4. Anonymous group 5. Twitter account and YouTube video created by the Anonymous group 6. Facebook's official statement 7. Users who deactivated their accounts due to the incident [9045]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown (a) The software failure incident related to the cyber attack on Facebook, where users were flooded with vile porn and horror images, is not explicitly mentioned to have happened again within the same organization in the provided article [9045]. (b) The article does not mention any specific instances of similar software failure incidents happening at other organizations or with their products and services related to the cyber attack on Facebook [9045].
Phase (Design/Operation) design, operation (a) The software failure incident in the article can be attributed to the design phase. The incident occurred due to a cyber attack that exploited vulnerabilities in browser software, not Facebook itself. Users were tricked into pasting malware into their browsers, which then resulted in the sharing of offensive content [9045]. This indicates that contributing factors introduced by system development (vulnerabilities in browser software) played a role in the failure. (b) Additionally, the incident can also be linked to the operation phase. Users were misled by Facebook's 'anything-goes' approach to sharing, leading them to believe it was safe to post computer script into their browsers. This operation-related factor contributed to the spread of offensive content on the platform [9045].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident reported in the article was primarily due to users being tricked into pasting malware into their browsers, which then resulted in the sharing of offensive content on Facebook. This indicates that the failure originated from within the system, specifically through vulnerabilities in browser software that were exploited by hackers [9045]. (b) outside_system: The attack on Facebook, leading to the deluge of pornographic and violent images, was described as a cyber attack by hackers. The attack was considered purely malicious by security experts, suggesting that the contributing factors that originated from outside the system were the actions of external malicious actors targeting Facebook's platform [9045].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the article was primarily due to non-human actions. Hackers exploited vulnerabilities in browser software, not Facebook itself, to flood users' newsfeeds with offensive content. Users were tricked into pasting malware into their browsers, which then led to the sharing of pornographic and violent images [9045]. (b) Human actions also played a role in the software failure incident. Users were misled by Facebook's sharing system into posting code in their browsers, which ultimately facilitated the spread of offensive content. Additionally, the article mentions the importance of users not copying and pasting unknown code into their browsers, highlighting the potential impact of human actions on such incidents [9045].
Dimension (Hardware/Software) software (a) The software failure incident reported in the article was not due to hardware issues but rather due to a cyber attack by hackers exploiting vulnerabilities in browser software [9045]. The attack involved users being tricked into pasting malware into their browsers, resulting in the sharing of offensive content on Facebook. The attack was described as a purely malicious act that exploited browser vulnerabilities, not Facebook itself. Facebook mentioned that they are working to improve their systems to better defend against similar attacks in the future, indicating that the root cause of the incident was related to software vulnerabilities rather than hardware issues.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in the article is malicious in nature. Hackers launched a cyber attack on Facebook, flooding users' news feeds with violent and pornographic images. Security experts described the attack as "purely malicious" and highlighted that users were tricked into pasting malware into their browsers, resulting in the sharing of offensive content [9045]. The attack exploited vulnerabilities in browser software, not Facebook itself, making it difficult for the site to respond to the spam. Additionally, there were suggestions that the hacktivist group Anonymous might be behind the attack, although no one claimed responsibility [9045].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident: - The incident was a cyber attack by hackers that flooded thousands of Facebook users' news feeds with violent and pornographic images, including doctored pictures of celebrities like Justin Bieber [Article 9045]. - Users were tricked into pasting malware into their browsers, which then resulted in the sharing of offensive content, indicating a failure due to poor decisions in terms of users being misled into executing harmful actions [Article 9045].
Capability (Incompetence/Accidental) accidental (a) The software failure incident reported in the article was not due to development incompetence. It was primarily a cyber attack by hackers who exploited vulnerabilities in browser software, not Facebook itself. The attack involved tricking users into pasting malware into their browsers, resulting in the sharing of offensive content [9045]. (b) The software failure incident was accidental in nature as it was a cyber attack that was described as a "purely malicious act" by security experts. The attack flooded the news feeds of thousands of Facebook users with violent and pornographic images, including doctored pictures of celebrities like Justin Bieber. The attack exploited vulnerabilities in browser software, not Facebook itself, making it difficult for the site to respond to the spam. Facebook mentioned that the attack was under control and they were working to improve their systems to defend against similar attacks in the future [9045].
Duration temporary The software failure incident reported in the article was temporary. It was a cyber attack on Facebook that resulted in the flooding of users' news feeds with violent and pornographic images. The attack was described as a spam attack that exploited a browser vulnerability, not a Facebook vulnerability itself. Facebook responded quickly to eliminate most of the spam caused by the attack and mentioned that they are working to improve their systems to defend against similar attacks in the future [9045].
Behaviour omission, value, other (a) crash: The incident reported in the article does not specifically mention a crash of the system where it loses state and stops performing its intended functions. (b) omission: The software failure incident in the article can be related to omission as users were tricked into pasting malware into their browsers, resulting in the sharing of offensive content. This omission led to the system not performing its intended functions correctly, allowing the spread of malicious content [9045]. (c) timing: The incident does not relate to a timing failure where the system performs its intended functions but at the wrong time. (d) value: The software failure incident can be associated with a value failure as the system allowed the sharing of pornographic and violent content, which is not the intended function of a family-friendly platform like Facebook [9045]. (e) byzantine: The article does not describe the software failure incident as exhibiting byzantine behavior with inconsistent responses and interactions. (f) other: The behavior of the software failure incident can be categorized as a security breach due to a cyber attack that exploited vulnerabilities in browser software, leading to the dissemination of offensive content on users' newsfeeds. This security breach resulted in the system failing to maintain a safe and family-friendly environment as expected by users [9045].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence no_consequence (a) death: People lost their lives due to the software failure - There is no mention of any deaths resulting from the software failure incident reported in the articles [9045].
Domain information [a] The software failure incident reported in the news article is related to the information industry. The incident involved a cyber attack on Facebook that flooded users' news feeds with vile porn and horror images, impacting the production and distribution of information on the social networking site [9045].

Sources

Back to List