Incident: Voice Recognition Breach at HSBC: Twin Bypasses Security System.

Published Date: 2017-05-19

Postmortem Analysis
Timeline 1. The software failure incident with HSBC's voice recognition ID system happened in 2017. - Estimation: - Step 1: The incident was reported in an article published on May 19, 2017. - Step 2: Article [59064] was published on 2017-05-19. - Step 3: The incident occurred in May 2017.
System 1. HSBC's voice recognition ID system [59064, 59638]
Responsible Organization 1. HSBC's voice recognition ID system was responsible for causing the software failure incident reported in the news articles [59064, 59638].
Impacted Organization 1. HSBC bank customers, specifically half a million customers using the voice recognition ID system [59064, 59638] 2. HSBC bank itself, as it had to review security on its voice-access systems and make changes to enhance security [59064, 59638]
Software Causes 1. The software failure incident in the HSBC voice recognition system was caused by a vulnerability that allowed a customer's twin to mimic his voice and gain unauthorized access to the bank account [59064, 59638]. 2. The system allowed multiple failed attempts for voice authentication, providing the opportunity for unauthorized access [59064, 59638]. 3. The incident highlighted a flaw in the biometric security system's design, as it failed to accurately distinguish between the voices of identical twins [59064, 59638]. 4. The software failure was due to the system's inability to detect synthetic voice characteristics, which could potentially be exploited by fraudsters [59064]. 5. The incident raised concerns about the security and effectiveness of the voice recognition technology implemented by HSBC, indicating a software flaw in the authentication process [59638].
Non-software Causes 1. Lack of robust authentication measures: The incident occurred due to the lack of robust authentication measures in the voice recognition system used by HSBC, allowing a twin to mimic the voice of the account holder and gain unauthorized access [59064, 59638]. 2. Over-reliance on biometric authentication: The failure was also attributed to the over-reliance on biometric authentication, specifically voice recognition, without additional factors for verification, leading to a breach in security [59638]. 3. Insufficient security testing: The system allowed multiple failed attempts for voice recognition without triggering a lockout, indicating insufficient security testing and validation of the system's response to unauthorized access attempts [59064, 59638].
Impacts 1. The software failure incident involving HSBC's voice recognition ID system allowed a customer's twin to mimic his voice and gain access to his bank account, accessing balances, recent transactions, and the ability to transfer money between accounts [59064, 59638]. 2. The breach raised concerns about the security of the voice recognition system, as it allowed multiple failed attempts to mimic the voice before granting access, potentially opening the door for hackers to exploit the system [59064, 59638]. 3. The incident highlighted the potential flaws in relying solely on biometric authentication methods like voice recognition, as demonstrated by the ease with which the twin was able to bypass the system [59064, 59638]. 4. Experts emphasized the need for stronger security measures and the incorporation of additional factors, such as a PIN, to enhance the security of biometric authentication systems like voice recognition [59638]. 5. The incident led to HSBC announcing a review of the security on its voice-access systems and implementing changes to make the system more secure, including limiting the number of attempts allowed before blocking access [59064].
Preventions 1. Implementing stricter authentication measures: The software failure incident involving the breach of HSBC's voice recognition ID system could have been prevented by implementing stricter authentication measures such as limiting the number of attempts allowed for voice recognition authentication [59064, 59638]. 2. Utilizing multi-factor authentication: To enhance security, HSBC could have implemented multi-factor authentication, combining voice recognition with additional factors like a PIN or password to further verify the user's identity and prevent unauthorized access [59064, 59638]. 3. Continuous monitoring and updates: Regularly monitoring the performance of the voice recognition system and promptly updating it to address any identified vulnerabilities or weaknesses could have helped prevent the incident [59064, 59638]. 4. Conducting thorough security testing: Prior to the widespread rollout of the voice recognition system, conducting thorough security testing, including simulated attacks like the one performed by the BBC Click reporter and his twin, could have revealed potential flaws and allowed for necessary improvements to be made before deployment [59064, 59638].
Fixes 1. Implement stricter authentication measures: HSBC should consider adding additional layers of authentication, such as requiring a PIN along with voice recognition, to enhance security [59064, 59638]. 2. Enhance voice recognition accuracy: The bank should improve the accuracy of its voice recognition system to prevent unauthorized access, possibly by reducing the number of allowed failed attempts or enhancing the technology to detect synthetic voice characteristics [59064, 59638]. 3. Regularly review and update security protocols: HSBC should continuously review and update its security protocols to stay ahead of potential vulnerabilities and ensure the safety of customer accounts [59064, 59638].
References 1. HSBC officials 2. BBC Click reporter Dan Simmons 3. Joe Simmons 4. Barclays 5. Mike McLaughin from Firstbase Technologies 6. Vladimiro Sassone, expert in cybersecurity from the University of Southampton 7. Alan Woodward, expert in security from the University of Surrey 8. José Sotelo, founder of the startup Lyrebird [Cited from: Article 59064, Article 59638]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the voice recognition system breach at HSBC has happened again within the same organization. The incident involved a customer's twin successfully mimicking his brother's voice to gain access to his bank account through the voice ID system. This breach raised concerns about the security of the voice recognition technology implemented by HSBC [59064, 59638]. (b) The software failure incident involving voice recognition technology has also occurred at other organizations. Barclays introduced voice recognition software for its clients, and it was later rolled out to millions of retail banking customers. This indicates that similar voice recognition systems are being adopted by other financial institutions, potentially facing similar security vulnerabilities [59064].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase: The incident with HSBC's voice recognition ID system being breached by a customer's twin mimicking his voice highlights a failure in the design phase of the system. The system was designed to authenticate users based on their voice prints, claiming it to be as unique as a fingerprint. However, the breach occurred when a non-identical twin was able to fool the system and gain access to his brother's account by mimicking his voice [59064, 59638]. (b) The software failure incident related to the operation phase: The failure in the operation phase of the system is evident in the fact that the system allowed the twin to make multiple attempts to mimic his brother's voice before gaining access. The system permitted seven attempts before granting access, which raises concerns about the operational security measures in place. Additionally, the system allowed access to balances, recent transactions, and the opportunity to transfer money between accounts, indicating a failure in operational security [59064, 59638].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident related to the breach of HSBC's voice recognition ID system was primarily due to contributing factors that originated from within the system itself. The incident occurred when a customer's twin was able to mimic his voice successfully, gaining unauthorized access to the bank account [59064, 59638]. This breach highlighted a flaw in the system's authentication process, allowing multiple attempts to mimic a voice before granting access, which ultimately led to the security breach. (b) outside_system: While the software failure incident primarily stemmed from within the system itself, there were also external factors at play. For example, the use of twins in the experiment to test the system's security was an external factor that influenced the outcome of the breach [59064, 59638]. Additionally, the incident raised concerns about the overall security of biometric authentication methods like voice recognition, indicating potential vulnerabilities that extend beyond the immediate system design.
Nature (Human/Non-human) human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident in the articles was not due to non-human actions. It was primarily caused by the vulnerability of the voice recognition system to mimicry by a human, specifically a twin brother [59064, 59638]. (b) The software failure incident occurring due to human actions: - The software failure incident in the articles was primarily due to human actions, specifically the ability of a twin brother to mimic his sibling's voice and gain unauthorized access to the bank account through the voice recognition system [59064, 59638].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - The incident reported in the articles does not indicate any hardware-related failure that contributed to the breach of the HSBC voice recognition ID system. The breach was primarily due to the ability of a customer's twin to mimic his voice successfully, highlighting a vulnerability in the software system itself [59064, 59638]. (b) The software failure incident occurring due to software: - The software failure incident in this case occurred due to contributing factors that originated in the software itself. The breach of the HSBC voice recognition ID system was a result of the system being fooled by a customer's twin mimicking his voice successfully, indicating a flaw or vulnerability in the software's voice recognition algorithm [59064, 59638].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident reported in the articles is non-malicious. The incident involved a breach in HSBC's voice recognition ID system where a customer's twin was able to mimic his voice and gain access to his brother's account. The breach was a result of the system allowing multiple attempts to mimic the voice before granting access, highlighting a flaw in the security system [59064, 59638]. The incident was a result of a vulnerability in the system rather than a deliberate attempt to harm the system.
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident related to the HSBC voice recognition ID system breach can be attributed to poor_decisions. The incident occurred when a BBC Click reporter and his non-identical twin were able to fool the system by mimicking the voice of the reporter's twin [59064, 59638]. This breach highlighted a flaw in the system's security, as the twin was able to access balances, recent transactions, and even offered the chance to transfer money between accounts. The fact that the system allowed multiple failed attempts before granting access raised concerns about the effectiveness of the voice recognition technology. Additionally, experts mentioned in the articles emphasized the risks associated with relying solely on biometric features like voice recognition for authentication, suggesting the need for additional security measures such as a PIN [59638].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the articles. The incident occurred due to a lack of professional competence in the development of HSBC's voice recognition ID system. The system, which was claimed to be secure and unique, was breached by a customer's twin mimicking his voice [59064]. The failure was highlighted when a BBC Click reporter and his non-identical twin were able to fool the system easily, gaining access to the bank account by mimicking the voice of the account holder [59064]. This breach exposed a significant flaw in the system's design and implementation, indicating a failure in ensuring the system's security and integrity during development. (b) The software failure incident related to accidental factors is also apparent in the articles. The breach of HSBC's voice recognition ID system was not intentional but occurred accidentally due to the system's vulnerability to voice mimicry. The incident was a result of accidental factors such as the system allowing multiple attempts to mimic a user's voice before blocking access, which was exploited by the twin to gain unauthorized access [59064]. Additionally, the ease with which the system was bypassed by the twin and the BBC Click reporter highlights accidental weaknesses in the system's design and functionality, leading to unintended access to sensitive account information [59064].
Duration temporary The software failure incident related to the HSBC voice recognition ID system breach can be categorized as a temporary failure. The breach occurred when a customer's twin was able to mimic his voice and gain unauthorized access to the account. HSBC acknowledged the breach and mentioned that they would review security on their voice-access systems to make it more secure [59064, 59638]. This incident was due to specific circumstances, such as the ability of a twin to mimic the voice, rather than a permanent failure caused by inherent flaws in the system.
Behaviour value, other (a) crash: The software failure incident in the articles does not involve a crash where the system loses state and does not perform any of its intended functions. The incident is more related to security vulnerabilities in the voice recognition system used by HSBC, allowing unauthorized access to accounts [59064, 59638]. (b) omission: The software failure incident does not involve the system omitting to perform its intended functions at an instance(s). Instead, the issue lies in the system allowing unauthorized access due to flaws in the voice recognition technology [59064, 59638]. (c) timing: The software failure incident is not related to the system performing its intended functions correctly but too late or too early. The focus is on the security vulnerabilities in the voice recognition system that allowed unauthorized access to accounts [59064, 59638]. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. Specifically, the flaw in the voice recognition system allowed unauthorized access to account balances and transactions, as well as the opportunity to transfer money between accounts [59064, 59638]. (e) byzantine: The software failure incident does not involve the system behaving erroneously with inconsistent responses and interactions. The issue is more about the security vulnerability in the voice recognition system that allowed unauthorized access to accounts [59064, 59638]. (f) other: The behavior of the software failure incident can be categorized as a security vulnerability in the voice recognition system, leading to unauthorized access to account information and potential transfers between accounts. The incident highlights a flaw in the authentication process rather than a traditional software failure like a crash or timing issue [59064, 59638].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence unknown (a) death: People lost their lives due to the software failure (b) harm: People were physically harmed due to the software failure (c) basic: People's access to food or shelter was impacted because of the software failure (d) property: People's material goods, money, or data was impacted due to the software failure (e) delay: People had to postpone an activity due to the software failure (f) non-human: Non-human entities were impacted due to the software failure (g) no_consequence: There were no real observed consequences of the software failure (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? The software failure incident described in the articles did not result in any of the consequences mentioned above. The incident primarily focused on the breach of security in HSBC's voice recognition ID system, where a twin was able to mimic his brother's voice to gain access to the account but did not result in any physical harm, death, impact on basic needs, property loss, or delays. The articles did not mention any non-human entities being impacted, and there were no theoretical consequences discussed beyond the breach itself.
Domain finance (a) The failed system was intended to support the finance industry. The incident involved HSBC's voice recognition ID system used by half a million customers for secure access to their bank accounts [Article 59064]. (h) The failed system was related to the finance industry, specifically banking, as it involved HSBC's voice recognition ID system for secure access to bank accounts [Article 59064].

Sources

Back to List