Incident: Antivirus Update Mistakenly Blocks Facebook Access.

Published Date: 2011-10-13

Postmortem Analysis
Timeline 1. The software failure incident of Norton Antivirus blocking access to Facebook happened within a limited window of time as mentioned in the article [8606]. 2. Published on 2011-10-13 07:00:00+00:00. 3. Estimation: The incident likely occurred around October 2011 based on the published date of the article and the information provided in the article.
System 1. Norton Antivirus latest antivirus detection file update 2. Symantec's phishing detection system 3. Subset of Norton Internet Security and Norton 360 versions [8606]
Responsible Organization 1. Symantec [8606]
Impacted Organization 1. Norton Antivirus customers 2. Facebook users 3. Symantec (Norton's parent company) [8606]
Software Causes 1. The software cause of the failure incident was the latest antivirus detection file update of Norton Antivirus mistakenly blocking access to Facebook after mistaking it for a phishing site [8606].
Non-software Causes 1. The latest antivirus detection file update of Norton Antivirus mistakenly identified Facebook as a phishing site, leading to the blockage of access to the platform [8606].
Impacts 1. The software failure incident caused Norton Antivirus to block access to Facebook after mistaking it for a phishing site, impacting users who were unable to access the social media platform [8606].
Preventions To prevent the software failure incident where Norton Antivirus mistakenly blocked access to Facebook, the following measures could have been taken: 1. Implement Robust Testing Procedures: Conduct thorough testing of antivirus updates before deployment to ensure that false positives, like mistaking legitimate sites for phishing sites, are minimized or eliminated [8606]. 2. Enhance Detection Algorithms: Improve the detection algorithms within the antivirus software to reduce the likelihood of incorrectly flagging legitimate websites as security risks [8606]. 3. Increase User Feedback Mechanisms: Implement mechanisms for users to report false positives promptly so that corrective actions can be taken swiftly to rectify any erroneous blocking of legitimate websites [8606].
Fixes 1. The software failure incident of Norton Antivirus blocking access to Facebook due to mistaking it for a phishing site was fixed by Symantec within hours of it being noticed. Symantec delivered a fix via LiveUpdate, which would be downloaded automatically to resolve the issue. Customers could also manually run LiveUpdate from the main user interface of their Norton product to ensure they have the latest updates [8606].
References 1. Symantec statement to CNET [8606]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident of Norton Antivirus mistakenly blocking access to Facebook due to a false phishing risk detection is an example of a similar incident happening again within the same organization. Symantec, which acquired Norton and its antivirus software, had to address the issue promptly by releasing a fix via LiveUpdate to resolve the problem [8606].
Phase (Design/Operation) design (a) The software failure incident in Article 8606 was related to the design phase. Symantec mentioned that the issue occurred due to content within the Facebook site being falsely identified as a phishing risk, indicating a problem introduced during the system development or updates [8606].
Boundary (Internal/External) within_system (a) The software failure incident in this case was within the system. Symantec mentioned that the issue with the latest antivirus detection file update of Norton Antivirus blocking access to Facebook was due to content within the site being falsely identified as a phishing risk [8606]. This indicates that the problem originated from within the system itself, specifically related to how the antivirus software was interpreting the content of the Facebook site.
Nature (Human/Non-human) non-human_actions (a) The software failure incident occurred due to non-human actions. Symantec mentioned that the issue with the latest antivirus detection file update of Norton Antivirus blocking access to Facebook was caused by content within the site being falsely identified as a phishing risk. This indicates that the problem was a result of an automated process within the antivirus software misidentifying the content, rather than any direct human action [8606].
Dimension (Hardware/Software) software (a) The software failure incident did not occur due to hardware issues. There is no mention in the article of any hardware-related contributing factors that led to the Norton Antivirus blocking access to Facebook incident. (b) The software failure incident occurred due to contributing factors that originate in software. Symantec mentioned that the issue was caused by content within the Facebook site being falsely identified as a phishing risk by the antivirus software. This indicates that the root cause of the problem was a software issue within the Norton Antivirus program itself [8606].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident in Article 8606 was non-malicious. The issue occurred due to content within the Facebook site being falsely identified as a phishing risk by the latest antivirus detection file update of Norton Antivirus. Symantec mentioned that it was a mistake and not an intentional act to harm the system. The problem was fixed promptly once noticed, and a fix was delivered to customers to resolve the issue [8606].
Intent (Poor/Accidental Decisions) accidental_decisions (a) The software failure incident related to the Norton Antivirus blocking access to Facebook was not due to poor decisions but rather an accidental decision. Symantec mentioned that the issue occurred because content within the Facebook site was falsely identified as a phishing risk, leading to the blocking of access. This indicates that the failure was accidental and not a result of poor decisions [8606].
Capability (Incompetence/Accidental) accidental (a) The software failure incident related to development incompetence is not evident in the provided article. (b) The software failure incident was accidental, as it occurred due to content within the Facebook site being falsely identified as a phishing risk by the latest antivirus detection file update of Norton Antivirus [8606].
Duration temporary The software failure incident reported in Article 8606 was temporary. The issue with Norton Antivirus blocking access to Facebook was fixed within hours of being noticed by Symantec. Symantec mentioned that the problem affected a subset of Norton Internet Security and Norton 360 customers during a limited window of time, indicating that it was not a permanent issue [8606].
Behaviour value, other (a) crash: The software failure incident in Article 8606 did not involve a crash. The issue was related to Norton Antivirus mistakenly blocking access to Facebook, which was promptly fixed by Symantec. (b) omission: The software failure incident in Article 8606 did not involve omission. The issue was not about the system omitting to perform its intended functions but rather falsely identifying Facebook as a phishing site. (c) timing: The software failure incident in Article 8606 did not involve timing issues. The problem was fixed promptly within hours of being noticed by Symantec. (d) value: The software failure incident in Article 8606 aligns more with the value category. The failure occurred because the system incorrectly identified content within Facebook as a phishing risk, leading to the blocking of access for some Norton customers. (e) byzantine: The software failure incident in Article 8606 did not exhibit byzantine behavior. The issue was more straightforward, involving a misidentification of Facebook as a phishing site. (f) other: The behavior of the software failure incident in Article 8606 can be categorized as a misidentification or false positive, where the system incorrectly flagged Facebook as a phishing risk, leading to the blocking of access for some users.

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property The consequence of the software failure incident reported in Article 8606 was primarily categorized as (d) property. The software failure incident led to Norton Antivirus mistakenly blocking access to Facebook, impacting the material goods (access to the website) and data (user interaction on Facebook) of the affected users. There were no reports of physical harm, loss of life, impact on basic needs, or significant delays mentioned in the article. The incident was promptly addressed by Symantec, and the fix was delivered to the affected customers to resolve the issue [8606].
Domain information (a) The failed system in this incident was related to the information industry as it involved Norton Antivirus mistakenly blocking access to Facebook, a popular social media platform [8606].

Sources

Back to List