| Recurring |
one_organization, multiple_organization |
(a) The software failure incident related to the iris-recognition feature being defeated by German hackers in Samsung's Galaxy S8 smartphone is not the first time such an incident has happened with Samsung's products. The article mentions that the ill-fated Note 7 also had the same infrared iris scanner as the Galaxy S8, indicating a similar incident within the same organization [59077].
(b) The article also mentions that the Chaos Computer Club (CCC) previously fooled Apple's TouchID fingerprint sensors shortly after the first iPhone 5s hit the market. This indicates that similar incidents have happened with other organizations' products as well, in this case, Apple's [59077]. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident related to the design phase can be seen in the article where the iris-recognition feature in Samsung's Galaxy S8 smartphone was defeated by German hackers. The security feature was fooled by a dummy eye created using a printer and a contact lens to match the curvature of the eye, based on pictures of the iris taken with a digital camera in night mode. This indicates a failure in the design of the iris-recognition feature, as it was vulnerable to being tricked by a dummy eye, highlighting a flaw in the system development of the security feature [59077].
(b) The software failure incident related to the operation phase can be observed in the article where the facial recognition feature of the Galaxy S8 was defeated even before the phone was on sale. The facial recognition feature could be tricked with something as simple as a printed-out picture of the owner, showcasing a failure in the operation or misuse of the system. Additionally, the article mentions that the iris-recognition feature could potentially be fooled with just a photo lifted from Facebook, a conventional laser printer, and a contact lens, further emphasizing the operational vulnerabilities of the biometric security features [59077]. |
| Boundary (Internal/External) |
within_system |
(a) within_system: The software failure incident related to the iris-recognition feature in Samsung's Galaxy S8 smartphone being defeated by German hackers is primarily within the system. The failure occurred due to vulnerabilities within the iris-recognition feature itself, allowing hackers to trick the system with a dummy eye and high-resolution images of irises [59077]. The failure was not caused by external factors but rather by flaws or weaknesses in the design and implementation of the security feature within the smartphone's software. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident related to non-human actions in this case is the defeat of the iris-recognition feature in Samsung's Galaxy S8 smartphone by German hackers using a dummy eye created with a printer and a contact lens [59077]. This incident highlights a vulnerability in the iris-recognition technology that allowed for the security feature to be fooled without direct human involvement in the authentication process.
(b) The software failure incident related to human actions in this case involves the actions of the hackers from the Chaos Computer Club who exploited the vulnerability in the iris-recognition feature of the Galaxy S8 smartphone. The hackers used human ingenuity and technical skills to create a dummy eye and manipulate the security system, demonstrating the potential risks associated with relying on biometric features for authentication [59077]. |
| Dimension (Hardware/Software) |
hardware, software |
(a) The software failure incident related to hardware:
The article mentions that the iris-recognition feature in Samsung's Galaxy S8 smartphone was defeated by German hackers using a dummy eye made with a printer and a contact lens to match the curvature of the eye [59077]. This indicates a hardware-related failure as the hackers were able to manipulate the hardware components of the smartphone to bypass the security feature.
(b) The software failure incident related to software:
The article also mentions that the facial recognition feature in the Galaxy S8 was defeated before the phone was even on sale by tricking it with a printed-out picture of the owner [59077]. This highlights a software-related failure as the facial recognition software was vulnerable to being tricked by a simple printed image, indicating a flaw or vulnerability in the software itself. |
| Objective (Malicious/Non-malicious) |
non-malicious |
(a) The software failure incident described in the articles is non-malicious. The failure of the iris-recognition feature in Samsung's Galaxy S8 smartphone was demonstrated by German hackers from the Chaos Computer Club (CCC) who were able to fool the security feature using a dummy eye created with a printer and a contact lens [Article 59077]. The hackers highlighted the security risk posed by using body features for authentication and emphasized the ease with which the iris recognition feature could be bypassed, indicating a non-malicious intent to expose vulnerabilities rather than harm the system. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
[a59077]
The software failure incident related to the iris-recognition feature in Samsung's Galaxy S8 smartphone can be attributed to poor_decisions. The incident occurred because the security feature was defeated by German hackers using a dummy eye and a high-resolution image of the smartphone owner's iris. Despite Samsung's claims about the uniqueness and security of iris authentication, the hackers were able to bypass the system with relatively simple tools like a printer and a contact lens. This highlights a poor decision in implementing the iris-recognition feature without considering the potential vulnerabilities and risks associated with it. |
| Capability (Incompetence/Accidental) |
development_incompetence, accidental |
(a) The software failure incident related to development incompetence is evident in the article where German hackers were able to defeat the iris-recognition feature in Samsung's Galaxy S8 smartphone. The hackers from the Chaos Computer Club were able to fool the security feature using a dummy eye created with a printer and a contact lens to match the curvature of the eye. This exploit highlights a lack of professional competence in the development of the iris-recognition feature, as it was easily bypassed by a relatively simple method [59077].
(b) The accidental software failure incident is demonstrated in the article where Samsung's facial recognition feature, which was supposed to provide additional security, was easily tricked with a printed-out picture of the owner. This accidental vulnerability in the facial recognition feature shows that contributing factors were introduced accidentally, leading to a significant security flaw in the smartphone [59077]. |
| Duration |
temporary |
The software failure incident related to the iris-recognition feature in Samsung's Galaxy S8 smartphone can be considered as a temporary failure. The incident occurred when German hackers were able to defeat the security feature using a dummy eye and a high-resolution image of the smartphone owner's iris [59077]. Samsung mentioned that the attack requires "a rare combination of circumstances" to pull off, including possession of the high-resolution image of the iris, an IR camera, a contact lens, and possession of the smartphone at the same time. The company conducted internal demonstrations under the same circumstances and found it extremely difficult to replicate such a result [59077]. This indicates that the failure was not permanent but rather temporary, as it required specific conditions to be met for the security feature to be bypassed. |
| Behaviour |
omission, other |
(a) crash: The software failure incident described in the articles does not involve a crash where the system loses state and stops performing its intended functions.
(b) omission: The incident involves an omission where the system omits to perform its intended functions at an instance(s). Specifically, the iris-recognition feature in Samsung's Galaxy S8 smartphone was defeated by German hackers using a dummy eye, fooling the security feature into thinking it was being unlocked by a legitimate owner [Article 59077].
(c) timing: The incident does not involve a timing failure where the system performs its intended functions correctly but too late or too early.
(d) value: The incident does not involve a value failure where the system performs its intended functions incorrectly.
(e) byzantine: The incident does not involve a byzantine failure where the system behaves erroneously with inconsistent responses and interactions.
(f) other: The behavior of the software failure incident is related to a security vulnerability in the iris-recognition feature of the Galaxy S8 smartphone, allowing it to be fooled by a dummy eye created using a printer and a contact lens. This behavior falls under the category of a security flaw or vulnerability in the system's authentication mechanism [Article 59077]. |