Incident: Yahoo Advertising Servers Distributing Malware to Users - Dec 30-Jan 3

Published Date: 2014-01-04

Postmortem Analysis
Timeline 1. The software failure incident involving Yahoo's advertising servers distributing malware to users happened around December 30, as reported by Fox IT [24154]. 2. The incident was reported on January 4, 2014 [24154]. 3. Estimated timeline: The software failure incident occurred in December 2013.
System 1. Yahoo's advertising servers 2. Java programming environment 3. Yahoo's system for filtering out malicious submissions [24154]
Responsible Organization 1. Malicious parties who hijacked Yahoo's advertising network [24154] 2. Potentially hackers who submitted the malicious software as ordinary ads [24154]
Impacted Organization 1. Yahoo users [24154]
Software Causes 1. Exploitation of vulnerabilities in Java programming environment leading to the distribution of malware [24154].
Non-software Causes 1. Malicious parties hijacking Yahoo's advertising network for their own ends [24154] 2. Culprits possibly submitting the malicious software as ordinary ads, sneaking past Yahoo's system for filtering out malicious submissions [24154] 3. Financial motivation behind the attack, with the possibility of selling control over victims' computers to other online criminals [24154]
Impacts 1. Hundreds of thousands of Yahoo users were exposed to malware through the malicious advertisements distributed by Yahoo's advertising servers [24154]. 2. The malware exploited vulnerabilities in Java and installed various types of malware on users' devices [24154]. 3. Around 300,000 users per hour were receiving malicious payloads, with an estimated 27,000 users per hour getting infected [24154]. 4. The attackers behind the incident were financially motivated, potentially selling control over the victims' computers to other online criminals [24154].
Preventions 1. Implementing stricter ad approval processes to detect and filter out malicious submissions disguised as ordinary ads could have prevented the incident [24154]. 2. Regularly monitoring and auditing the advertising servers to detect any unusual activity or unauthorized access could have helped in identifying the attack earlier and preventing its widespread impact [24154]. 3. Enhancing the security measures on the advertising network, such as implementing stronger authentication mechanisms and access controls, could have made it more difficult for malicious parties to hijack the network [24154]. 4. Keeping software components like Java up to date with the latest security patches and updates could have reduced the likelihood of the exploit kit targeting known vulnerabilities in the programming environment [24154].
Fixes 1. Implement stricter ad approval processes to prevent malicious submissions from being served to users [24154]. 2. Enhance security measures to detect and block malware distribution through the advertising network [24154]. 3. Conduct a thorough review and update of the security protocols and systems to prevent future attacks [24154].
References 1. Fox IT, a security firm based in the Netherlands [24154] 2. Ashkan Soltani, a security researcher and Washington Post contributor [24154] 3. Mark Loman, a security researcher based in the Netherlands [24154] 4. Yahoo spokeswoman [24154]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to malware being distributed through Yahoo's advertising servers is not the first time such an incident has happened at Yahoo. The article mentions that Yahoo had identified an ad designed to spread malware to some users and had immediately removed it. This indicates a previous occurrence of a similar incident within the same organization [24154]. (b) The incident of malware being distributed through advertising servers has also happened at other organizations. The article mentions that attacks like these are often the result of hacking an existing ad network or submitting malicious software as ordinary ads, sneaking past the system for filtering out malicious submissions. This suggests that similar incidents have occurred at other organizations or with their products and services as well [24154].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be attributed to the exploitation of vulnerabilities in Java within Yahoo's advertising servers. The attackers hijacked Yahoo's advertising network and served malicious advertisements that exploited Java vulnerabilities to install malware on users' computers [24154]. (b) The software failure incident related to the operation phase is evident in the fact that Yahoo users were getting infected with malware through the malicious advertisements being served by Yahoo's servers. The attack was ongoing for several days, infecting hundreds of thousands of users, highlighting a failure in the operation and security measures of Yahoo's advertising network [24154].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident involving Yahoo's advertising servers distributing malware to users was due to malicious parties hijacking Yahoo's advertising network for their own ends. The attack involved serving users an "exploit kit" that exploits vulnerabilities in Java and installs malware [24154]. Yahoo took immediate action upon identifying the issue and removed the malicious ad [24154]. (b) outside_system: The software failure incident was caused by external malicious parties who hacked into Yahoo's advertising network to distribute malware to users. The attackers were financially motivated and may have been selling control over the victims' computers to other online criminals [24154].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurred due to non-human actions, specifically malicious parties hijacking Yahoo's advertising network to distribute malware to users [24154]. (b) The software failure incident could also be attributed to human actions, as the attackers may have submitted the malicious software as ordinary ads, potentially bypassing Yahoo's system for filtering out malicious submissions [24154].
Dimension (Hardware/Software) software (a) The software failure incident reported in the articles is primarily due to contributing factors that originate in software. The incident involved Yahoo's advertising servers distributing malware to users through malicious advertisements served by ads.yahoo.com. The attack exploited vulnerabilities in Java and installed various malware on users' computers [24154]. (b) The software failure incident is not attributed to hardware issues but rather to software vulnerabilities and malicious activities exploiting those vulnerabilities.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident related to the distribution of malware through Yahoo's advertising servers was malicious in nature. The attack was carried out by malicious parties who hijacked Yahoo's advertising network to distribute malicious advertisements that exploited vulnerabilities in Java and installed various types of malware on users' computers [24154]. The attackers were financially motivated and potentially selling control over the victims' computers to other online criminals [24154]. Yahoo took immediate action to remove the malicious ad and stated that they take the safety and privacy of their users seriously [24154].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident involving Yahoo's advertising servers distributing malware was likely due to poor decisions made by Yahoo in terms of their ad network security. The incident was described as malicious parties hijacking Yahoo's advertising network for their own ends, exploiting vulnerabilities in Java, and sneaking past Yahoo's system for filtering out malicious submissions [24154]. These actions indicate a failure in decision-making related to security measures and oversight within Yahoo's advertising network.
Capability (Incompetence/Accidental) accidental (a) The software failure incident reported in the articles is more aligned with the accidental category rather than development incompetence. The incident involved Yahoo's advertising servers distributing malware to users after being hijacked by malicious parties [24154]. This indicates that the failure was not due to a lack of professional competence in the development process but rather an accidental compromise of the advertising network leading to the distribution of malicious software.
Duration temporary (a) The software failure incident in this case was temporary. The incident involving Yahoo's advertising servers distributing malware lasted for a few days, with users being infected since at least Dec. 30 and the issue being discovered on Friday [24154]. Yahoo took immediate action to remove the malicious ad and continued to monitor and block any ads being used for this activity [24154]. Additionally, the volume of infections tapered off more recently, possibly due to efforts by Yahoo's security team [24154].
Behaviour crash, omission, value, other (a) crash: The software failure incident in the article can be categorized as a crash. The incident involved Yahoo's advertising servers distributing malware to users, causing the system to fail in its intended function of serving legitimate ads. This resulted in users receiving malicious content instead of the expected advertisements, indicating a crash in the system's functionality [24154]. (b) omission: The software failure incident can also be linked to omission. The system omitted to perform its intended function of filtering out malicious submissions, allowing the malicious software to be delivered to users as ordinary ads. This omission led to the spread of malware to hundreds of thousands of users [24154]. (c) timing: The timing of the software failure incident is not directly related to the failure itself. The incident does not involve the system performing its intended functions too late or too early; instead, it focuses on the system's failure to prevent the distribution of malware through its advertising network [24154]. (d) value: The software failure incident can be associated with a failure in value. The system performed its intended function of serving ads, but it did so incorrectly by delivering malicious content instead of legitimate advertisements. This incorrect behavior led to users being infected with malware [24154]. (e) byzantine: The software failure incident does not exhibit characteristics of a byzantine failure. The system's behavior, although maliciously manipulated, does not show inconsistent responses or interactions that would classify it as a byzantine failure [24154]. (f) other: The other behavior exhibited by the software failure incident is the exploitation of vulnerabilities in the Java programming environment. The attackers targeted flaws in Java to deliver the malware, highlighting the system's susceptibility to security threats due to outdated technologies like Java [24154].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence unknown (a) death: People lost their lives due to the software failure (b) harm: People were physically harmed due to the software failure (c) basic: People's access to food or shelter was impacted because of the software failure (d) property: People's material goods, money, or data was impacted due to the software failure (e) delay: People had to postpone an activity due to the software failure (f) non-human: Non-human entities were impacted due to the software failure (g) no_consequence: There were no real observed consequences of the software failure (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? The articles do not mention any direct consequences such as death, physical harm, impact on basic needs, property loss, or delays caused by the software failure incident. The primary consequence discussed is the distribution of malware to users through Yahoo's advertising servers, leading to potential infections and security risks for users' computers [24154].
Domain information (a) The failed system was related to the information industry as it involved Yahoo's advertising servers distributing malware to users [24154]. The incident impacted the production and distribution of information online.

Sources

Back to List