| Recurring |
unknown |
(a) The software failure incident having happened again at one_organization:
The article does not provide information about a similar incident happening before or again within the same organization (Cryptome.org).
(b) The software failure incident having happened again at multiple_organization:
The article does not provide information about a similar incident happening before or again at other organizations or with their products and services. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident in Article 10160 can be attributed to the design phase. The incident occurred when a malicious PHP file was added to the Cryptome.org site, along with the creation of a new directory that logged nearly 3,000 IP addresses. This indicates that the failure was due to contributing factors introduced during the system development or updates, allowing the malware to be injected into the site [10160].
(b) Additionally, the software failure incident in Article 10160 can also be linked to the operation phase. The contamination of thousands of HTML files with a malicious script that could download exploits from the Blackhole Toolkit suggests that the failure was influenced by the operation or misuse of the system. Users visiting the site were infected with malware, highlighting the impact of operational factors on the incident [10160]. |
| Boundary (Internal/External) |
within_system |
(a) The software failure incident at Cryptome.org was within_system. The failure was caused by someone compromising the site and adding a malicious PHP file, creating a new directory that logged IP addresses, and contaminating thousands of HTML files with a malicious script. This indicates that the contributing factors originated from within the system itself [10160]. |
| Nature (Human/Non-human) |
non-human_actions |
(a) The software failure incident at Cryptome.org was due to non-human actions. Specifically, someone compromised the website and hid malware on the site, infecting Web surfers. A malicious PHP file was added to the site, and a new directory was created that logged nearly 3,000 IP addresses. Thousands of HTML files on the site were contaminated with a malicious script that could download exploits from the Blackhole Toolkit, potentially compromising computers through various vendor vulnerabilities. Symantec offered to investigate the hack, indicating that the failure was not directly caused by human actions but rather by external malicious activities [10160]. |
| Dimension (Hardware/Software) |
software |
(a) The software failure incident reported in Article 10160 was not attributed to hardware issues. Instead, it was a case of a malicious PHP file being added to the Cryptome.org website, leading to the infection of Web surfers with malware. The compromise and contamination of the site with a malicious script were due to security vulnerabilities in the software rather than hardware-related factors [10160]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident described in Article 10160 was malicious in nature. The incident involved someone compromising the Cryptome.org website and hiding malware on the site with the intent to infect web surfers. A malicious PHP file was added to the site, and thousands of HTML files were contaminated with a malicious script that could compromise computers through various vulnerabilities [10160]. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
(a) The intent of the software failure incident related to poor_decisions:
The software failure incident at Cryptome.org was a result of someone compromising the site and hiding malware, which indicates a deliberate and malicious act rather than a failure due to accidental decisions or mistakes [10160]. |
| Capability (Incompetence/Accidental) |
accidental |
(a) The software failure incident reported in Article 10160 was not explicitly attributed to development incompetence. The incident was described as a compromise of the Cryptome.org website, where a malicious PHP file was added, leading to the infection of web surfers with malware. The presence of the malicious script and the creation of a new directory to log IP addresses indicate a deliberate act rather than a failure due to development incompetence.
(b) The software failure incident reported in Article 10160 was more aligned with an accidental failure. The compromise of Cryptome.org was described as someone hiding malware on the site, infecting web surfers over the weekend. The addition of the malicious PHP file and contamination of HTML files with a malicious script suggest that the incident was accidental in the sense that it was not intended by the legitimate operators of the website but rather caused by an external malicious actor. |
| Duration |
temporary |
The software failure incident reported in Article 10160 was temporary. The incident involved the compromise of Cryptome.org by adding a malicious PHP file and creating a new directory that logged nearly 3,000 IP addresses over a specific period from Wednesday to Sunday. Additionally, thousands of HTML files on the site were contaminated with a malicious script that could download exploits from the Blackhole Toolkit, affecting Windows platforms. Symantec offered to investigate the hack, and Cryptome.org mentioned that the site was expected to be cleaned up by the end of the day, indicating a temporary nature of the software failure incident. |
| Behaviour |
other |
(a) crash: The software failure incident in Article 10160 did not involve a crash where the system loses state and does not perform any of its intended functions. The incident involved the compromise of the Cryptome.org website and the insertion of malware, leading to the infection of web surfers.
(b) omission: The software failure incident in Article 10160 did not involve omission where the system omits to perform its intended functions at an instance(s). The incident was primarily focused on the insertion of malicious scripts and malware on the website.
(c) timing: The software failure incident in Article 10160 did not involve timing issues where the system performs its intended functions correctly but too late or too early. The focus of the incident was on the compromise of the website and the subsequent infection of visitors with malware.
(d) value: The software failure incident in Article 10160 did not involve a failure due to the system performing its intended functions incorrectly. The incident was related to the insertion of malicious code on the website.
(e) byzantine: The software failure incident in Article 10160 did not exhibit a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. The incident was more straightforward in terms of the insertion of malware on the website.
(f) other: The behavior of the software failure incident in Article 10160 can be categorized as a security breach or hack, where unauthorized individuals compromised the website and injected malicious code to infect visitors with malware. |