| Recurring |
one_organization, multiple_organization |
(a) The software failure incident related to malvertising using a vulnerability in Adobe Flash has happened again at Yahoo. In the past, Yahoo experienced a similar incident where attackers used a flaw in Java to install software [38971, 39160].
(b) The incident involving malvertising exploiting a vulnerability in Adobe Flash has also occurred at other organizations. The weakness in Adobe Flash has been exploited in the past by attackers targeting major websites through multisite ad networks [39160]. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident reported in the articles can be attributed to the design phase. The incident was caused by a bug in Adobe Flash, a graphics program with a history of security problems. The attackers leveraged this bug to send malicious code through Yahoo's ad network to visitors of legitimate sites, including Yahoo's sports, news, and finance sites [38971, 39160].
(b) Additionally, the failure incident can also be linked to the operation phase. The attack involved malvertising, where the attackers bought digital ad space on Yahoo's websites to serve up malicious software to visitors. Users did not have to interact with the ads; simply browsing the affected pages was enough to potentially infect their computers. This highlights the risk associated with the operation of online advertising systems and the vulnerability of users while browsing websites with ads [38971, 39160]. |
| Boundary (Internal/External) |
within_system, outside_system |
(a) within_system: The software failure incident involving Yahoo's ad network sending malware to users' computers was primarily due to a bug in Adobe Flash, a component within the system that had a history of security problems [38971, 39160]. The attack leveraged this vulnerability within the system to deliver malicious software to visitors of legitimate sites, including Yahoo's own sites.
(b) outside_system: The attack was initiated by malicious actors who bought up digital ad space to serve up the malicious software, taking advantage of the online advertising system that supports much of the Web [38971, 39160]. This external factor of malicious actors exploiting the ad network system contributed to the software failure incident. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident in the articles was primarily due to non-human actions. The incident was caused by a malvertising campaign that exploited a vulnerability in Adobe Flash to deliver malicious software to visitors of Yahoo's websites [38971, 39160]. The attack leveraged a bug in Adobe Flash, a graphics program with a history of security problems, to send malicious code to users' computers without requiring any action from the users themselves [38971]. This type of attack, known as "malvertising," takes advantage of the online advertising system to serve up malware to visitors of legitimate sites [38971].
(b) While human actions were involved in the sense that the attackers intentionally purchased advertising space on Yahoo's websites to deliver the malicious ads, the root cause of the software failure was the exploitation of a vulnerability in Adobe Flash, which is a non-human factor [38971, 39160]. The attackers used the weakness in Adobe Flash to attempt to install malware on users' computers, highlighting the importance of addressing software vulnerabilities to prevent such incidents [39160]. |
| Dimension (Hardware/Software) |
software |
(a) The software failure incident related to hardware:
- The incident involved a malvertising attack that leveraged a bug in Adobe Flash, a software program [38971].
- The attack sent malicious code to Windows computers through infected ads, exploiting an out-of-date version of Flash to potentially hijack the computer [38971].
- The attack did not require users to do anything other than browse to a page featuring the malicious advertisements, indicating that the hardware itself was not the direct cause of the failure [38971].
(b) The software failure incident related to software:
- The malvertising campaign targeted Yahoo users by delivering malicious adverts through the company's websites [39160].
- The attack attempted to exploit a vulnerability in Adobe Flash to install malware on users' computers, highlighting the weakness of multisite ad networks in filtering out malware before reaching end-users [39160].
- The incident underscores the importance of addressing software vulnerabilities, such as those in Adobe Flash, to prevent similar attacks in the future [39160]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident in the articles is malicious in nature. Malware was sent to users' computers through Yahoo's ad network as part of a malvertising attack orchestrated by a malware company [38971, 39160]. The attack aimed to install malicious software on users' computers without requiring any user interaction, highlighting the malicious intent behind the incident. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
(a) The intent of the software failure incident:
- The software failure incident involving Yahoo's ad network sending malware to users' computers was not due to accidental decisions but rather poor decisions. The incident was a result of malicious actors buying up digital ad space on Yahoo's websites to serve up malicious software to visitors [38971, 39160].
- The attackers leveraged a bug in Adobe Flash, a known program with a history of security problems, to exploit users' computers [38971, 39160].
- The attack was a deliberate malvertising campaign aimed at installing malware on users' computers without requiring any user interaction [39160].
- Yahoo's response to the incident included blocking the advertiser from their network and emphasizing the need for a secure advertising experience [38971].
- The incident highlighted the weakness of multisite ad networks and the challenges in filtering out malware before it reaches end-users [39160]. |
| Capability (Incompetence/Accidental) |
development_incompetence |
(a) The software failure incident reported in the news articles can be attributed to development incompetence. The incident involved a malvertising attack on Yahoo's ad network, which sent malware to users' computers through malicious ads on Yahoo's popular sites. The attack leveraged a bug in Adobe Flash, a program with a history of security problems. The attackers took advantage of the online advertising system to serve up malicious software to visitors of legitimate sites, including Yahoo's sports, news, and finance sites [38971, 39160].
The incident highlights the risks associated with vulnerabilities in software programs like Adobe Flash and the potential consequences of not addressing known security issues. It also underscores the importance of maintaining professional competence in software development to prevent such attacks and protect users from malicious activities. |
| Duration |
temporary |
(a) The software failure incident in the articles was temporary. The incident involving Yahoo's ad network sending malware to users' computers lasted for about a week before it was resolved [38971]. Malwarebytes, the company that discovered the malvertising attack, alerted Yahoo about the malicious adverts, and Yahoo promptly pulled them from their websites [39160]. The attack leveraged a bug in Adobe Flash, which was exploited by the attackers to deliver the malware to users [38971]. |
| Behaviour |
value, other |
(a) crash: The software failure incident in the articles did not involve a crash where the system loses state and does not perform any of its intended functions [38971, 39160].
(b) omission: The incident did not involve the system omitting to perform its intended functions at an instance(s) [38971, 39160].
(c) timing: The incident did not involve the system performing its intended functions correctly, but too late or too early [38971, 39160].
(d) value: The software failure incident in the articles involved the system performing its intended functions incorrectly, as it allowed malicious ads to deliver malware to users' computers [38971, 39160].
(e) byzantine: The incident did not involve the system behaving erroneously with inconsistent responses and interactions [38971, 39160].
(f) other: The software failure incident involved the system being exploited by malicious actors who used malvertising to deliver malware to users' computers through vulnerabilities in Adobe Flash [38971, 39160]. |