Incident: CVS App Privacy Flaw: Location Data Leak to Third Parties

Published Date: 2017-08-28

Postmortem Analysis
Timeline 1. The software failure incident with the CVS app sharing users' locations happened in August 2017 as per the article published on August 28, 2017 [62541].
System 1. CVS app store-locator feature 2. Android version of the CVS app [62541]
Responsible Organization 1. CVS app developers [62541]
Impacted Organization 1. Users of the CVS app [62541]
Software Causes 1. Coding error in the CVS app led to a privacy flaw where users' locations were shared with more than 40 web servers due to a mistake in the store-locator feature [62541].
Non-software Causes 1. Lack of proper data handling protocols by CVS app developers [62541] 2. Failure in privacy protection measures during app development and testing [62541]
Impacts 1. Users' locations were inadvertently shared with more than 40 web servers due to a coding error with the CVS app, leading to a privacy flaw [62541]. 2. The app was sending GPS coordinates to outside entities, including various third-party servers such as Google and Twitter, when the store-locator feature was used [62541]. 3. The flaw was found only in the Android version of the app, and despite being reported to CVS, it had not been fixed at the time of the article [62541].
Preventions 1. Implementing thorough code reviews and testing procedures before releasing the app to identify and rectify privacy flaws like the one in the CVS app could have prevented the incident [62541]. 2. Conducting regular security audits and assessments on the app's features, especially those involving sensitive user data, could have helped in identifying and addressing such privacy vulnerabilities proactively [62541].
Fixes 1. Implement a fix in the coding of the CVS app to ensure that the store-locator feature only sends location data to the company's own servers and not to external entities [62541].
References 1. Serge Egelman, director of security and privacy research at the International Computer Science Institute affiliated with the University of California at Berkeley [62541]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown (a) The software failure incident related to the CVS app sharing users' locations due to a coding error has not been reported to have happened again at the same organization (CVS) [62541].
Phase (Design/Operation) design, operation (a) The software failure incident in the CVS app can be attributed to a design flaw. The issue arose from a coding error in the store-locator feature of the app, which inadvertently shared users' locations with more than 40 web servers due to the way the location data was being sent to various servers that loaded on the page [62541]. This design flaw in the system development allowed for the unintended sharing of sensitive user information. (b) The software failure incident can also be linked to an operation failure. The flaw in the app's operation led to the GPS-sharing issue, where users' locations were being sent to external entities without their knowledge or consent during the app's normal functioning [62541]. This operation failure resulted in the unauthorized sharing of user data during the app's usage.
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident with the CVS app was due to a coding error within the app itself. The flaw in the store-locator feature caused the app to inadvertently share users' locations with more than 40 web servers, including third-party entities like Google, Facebook, and Twitter [62541]. This coding error within the app's functionality led to the privacy breach and data leakage issue.
Nature (Human/Non-human) non-human_actions (a) The software failure incident in Article 62541 occurred due to non-human_actions, specifically a coding error with the CVS app. The app's store-locator feature was designed to send users' locations to the company's servers to find nearby pharmacies. However, due to a flaw in the coding, the app was also sending this location data to over 40 external web servers, including advertising servers like Google and Twitter, without the users' knowledge or consent. This unintended behavior was a result of the coding error, not due to any deliberate human action [62541].
Dimension (Hardware/Software) software (a) The software failure incident in Article 62541 occurred due to contributing factors that originate in software. The failure was attributed to a coding error with the CVS app, specifically related to the store-locator feature. This error led to the app inadvertently sharing users' locations with more than 40 web servers, including third-party entities like Google, Facebook, and Twitter. The issue was identified as a privacy flaw in the software, where the location data was being sent to unintended recipients due to the way the code was implemented [62541].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident related to the CVS app sharing users' locations with more than 40 web servers was non-malicious. The article mentions that the issue was due to a coding error in the app's store-locator feature, which inadvertently sent GPS coordinates to outside entities without CVS actively trying to sell its users' location. The director of security and privacy research at the International Computer Science Institute, Serge Egelman, stated that the sharing of data with numerous third parties seemed to be a mistake and attributed the incident to bad coding [62541].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident: The incident involving the CVS app sharing users' locations with multiple web servers was likely due to poor_decisions, specifically a coding error. The article mentions that the flaw in the store-locator feature was a result of bad coding, indicating that it was not an intentional decision by CVS to share users' locations with numerous third parties [62541].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the CVS app can be attributed to development incompetence. The incident was caused by a coding error in the app that led to the inadvertent sharing of users' locations with more than 40 web servers. This flaw was identified by Serge Egelman, director of security and privacy research at the International Computer Science Institute, who mentioned that the way data was shared with numerous third parties seemed to be a mistake resulting from bad coding practices [62541]. (b) The software failure incident can also be categorized as accidental, as Egelman stated that he doesn't believe CVS was actively trying to sell its users' location data. He mentioned that the extensive sharing of user data with third parties appeared to be a mistake rather than a deliberate action by CVS [62541].
Duration temporary The software failure incident related to the CVS app sharing users' locations with multiple web servers due to a coding error can be categorized as a temporary failure. This is evident from the fact that the flaw was identified by privacy experts, including Serge Egelman, who highlighted the issue to CVS. Despite the flaw being reported to CVS, it was mentioned that the GPS-sharing flaw hasn't yet been fixed, indicating that the incident is ongoing and has not been permanently resolved [62541].
Behaviour value, other (a) crash: The software failure incident in the article is not related to a crash where the system loses state and does not perform any of its intended functions. The issue described involves the inadvertent sharing of users' locations due to a coding error in the CVS app [62541]. (b) omission: The software failure incident does not involve the system omitting to perform its intended functions at an instance(s). Instead, the flaw in the CVS app led to the unintended sharing of users' GPS coordinates with multiple web servers [62541]. (c) timing: The failure is not related to the system performing its intended functions correctly but too late or too early. The issue described in the article pertains to the unauthorized sharing of location data due to a privacy flaw in the app [62541]. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. The CVS app was sending users' locations to external entities due to a coding error, which was not the intended behavior of the application [62541]. (e) byzantine: The failure is not characterized by the system behaving erroneously with inconsistent responses and interactions. The issue with the CVS app was primarily related to the unintended sharing of location data with multiple web servers, indicating a flaw in data handling rather than erratic behavior [62541]. (f) other: The behavior of the software failure incident can be categorized as a privacy breach resulting from a coding error in the CVS app. This led to the unauthorized sharing of users' GPS coordinates with over 40 web servers, indicating a significant data privacy issue [62541].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (property) The software failure incident related to the CVS app resulted in a privacy flaw where users' locations were inadvertently shared with more than 40 web servers due to a coding error. This sharing of GPS coordinates to outside entities, including various ad servers like Google and Twitter, could potentially impact users' privacy and data security [62541].
Domain information, health (a) The failed system in the article is related to the information industry as it involves a coding error with the CVS app, which is used for obtaining information about nearby pharmacies, refilling prescriptions, and getting coupons [62541].

Sources

Back to List