Incident: Starbucks Cafe's Wi-Fi Hijacked for Crypto-Currency Mining Incident

Published Date: 2017-12-13

Postmortem Analysis
Timeline 1. The software failure incident at Starbucks cafe's Buenos Aires outlet where computers were hijacked to mine cryptocurrency happened last week before the article was published on December 13, 2017 [66222]. Therefore, the incident likely occurred in early December 2017.
System 1. Starbucks cafe's wi-fi system [66222]
Responsible Organization 1. Unknown
Impacted Organization 1. Customers visiting the Starbucks branch in Buenos Aires [66222]
Software Causes 1. The software cause of the failure incident was the presence of malware in the wi-fi service provided by Starbucks' Buenos Aires outlet, which hijacked connected computers to mine cryptocurrency [66222].
Non-software Causes 1. The wi-fi service provided by Starbucks' Buenos Aires outlet was hijacked to mine cryptocurrency, indicating a security vulnerability in the wi-fi network [66222].
Impacts 1. Visitors to a Starbucks branch in Buenos Aires were unwittingly recruited into a crypto-currency mining operation due to the wi-fi service hijacking connected computers to use their processing power to mine digital cash [66222]. 2. The incident highlighted the risks of using public wi-fi, as victims' computers were targeted in a relatively unusual manner through a wi-fi hotspot [66222]. 3. The malware involved in the incident was active for an unknown duration, and it is unclear how many customers were affected [66222]. 4. The software failure incident led to the need for Starbucks to take swift action to address the problem and ensure the safety of their customers using wi-fi in their stores [66222].
Preventions 1. Regular security audits and monitoring of the wi-fi network to detect any unauthorized activities [66222]. 2. Implementing strong network security measures such as firewalls and intrusion detection systems to prevent unauthorized access and activities [66222]. 3. Educating customers about the risks of using public wi-fi and advising them to ensure their software is up-to-date and to be vigilant for suspicious activities [66222].
Fixes 1. Implementing robust security measures on public wi-fi networks to prevent unauthorized activities like crypto-currency mining [66222]. 2. Regularly monitoring network activity for any unusual behavior or unauthorized access [66222]. 3. Educating users about the risks associated with connecting to untrusted networks and advising them to use up-to-date software to minimize vulnerabilities [66222].
References 1. Noah Dinkin, the chief executive of a New York-based technology company [66222]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown (a) The software failure incident of Starbucks cafe's wi-fi being used to mine cryptocurrency has not been reported to have happened again within the same organization [66222]. (b) The incident of using public wi-fi to hijack connected computers for cryptocurrency mining has not been specifically mentioned to have occurred at other organizations in the articles provided [66222].
Phase (Design/Operation) design, operation (a) The software failure incident in the Starbucks cafe's wi-fi mining operation can be attributed to the design phase. The incident involved the wi-fi service provided by one of the coffee chain's outlets in Buenos Aires surreptitiously hijacking connected computers to mine cryptocurrency. This indicates a failure in the design of the wi-fi service, allowing for the exploitation of customers' processing power without their knowledge [66222]. (b) The software failure incident can also be linked to the operation phase. Users connecting to the compromised wi-fi hotspot were unknowingly subjected to their computers being used for mining cryptocurrency. This highlights a failure in the operation of the wi-fi service, as customers were exposed to the malicious activity while using the network [66222].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident at Starbucks cafe's wi-fi in Buenos Aires was due to the wi-fi service provided by the coffee chain's outlet surreptitiously hijacking connected computers to mine cryptocurrency. This malicious activity was happening within the system provided by Starbucks, indicating a failure originating from within the system itself [66222]. (b) outside_system: The incident involved the exploitation of public wi-fi to infect customers' computers with mining code. This highlights the risks associated with using public wi-fi networks, which are external to the system provided by Starbucks. Users connecting to untrusted networks, like public wi-fi hotspots, need to be cautious about potential threats originating from outside the system [66222].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The software failure incident at Starbucks cafe's Buenos Aires outlet occurred due to the wi-fi service hijacking connected computers to mine cryptocurrency without the knowledge or participation of the customers [66222]. (b) The software failure incident occurring due to human actions: The incident was identified by the chief executive of a New York-based technology company, Noah Dinkin, who noticed the problem when he logged into the service and experienced a delay before being able to start using the internet. He then posted his discovery on Twitter, bringing attention to the issue [66222].
Dimension (Hardware/Software) software (a) The software failure incident in the Starbucks cafe's wi-fi mining operation was not due to hardware issues but rather due to the software aspect. The wi-fi service at one of the coffee chain's branches in Buenos Aires was hijacked by malware to use connected computers' processing power for crypto-currency mining [66222]. This indicates that the failure originated in the software aspect of the wi-fi service, allowing the unauthorized mining operation to take place.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case was malicious. The Starbucks cafe's wi-fi was used to hijack connected computers to mine cryptocurrency without the users' knowledge or consent. This was done surreptitiously, indicating malicious intent to exploit the processing power of the connected devices for financial gain [66222].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was poor_decisions as the Starbucks cafe's wi-fi service in Buenos Aires was hijacking connected computers to mine cryptocurrency without the customers' knowledge or consent. This action was not a result of accidental decisions but a deliberate attempt to exploit customers' processing power for financial gain [66222].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the Starbucks cafe where computers were made to mine cryptocurrency through the cafe's wi-fi can be attributed to development incompetence. The incident involved the wi-fi service provided by one of the coffee chain's Buenos Aires outlets surreptitiously hijacking connected computers to use their processing power for mining digital cash [66222]. This unauthorized use of customers' computing resources for cryptocurrency mining indicates a lack of professional competence in ensuring the security and integrity of the wi-fi service provided by Starbucks. (b) The accidental aspect of the software failure incident can be seen in how the issue was identified. The problem was only noticed when the chief executive of a New York-based technology company logged into the service and experienced a delay before being able to start using the internet. This delay led to the discovery of the crypto-mining operation, indicating that the incident was accidental in nature [66222].
Duration temporary (a) The software failure incident in the Starbucks cafe where the wi-fi was used to mine cryptocurrency was temporary. The issue was identified when the chief executive of a technology company logged into the service and noticed the problem, indicating that it was not a permanent failure [66222]. The incident was addressed swiftly by Starbucks, and the necessary changes were made to ensure the customers could use wi-fi safely in the store [66222].
Behaviour crash, omission, value, other (a) crash: The software failure incident in the Starbucks cafe's wi-fi involved a crash where the connected computers were hijacked to mine cryptocurrency, causing them to lose their intended function of providing internet access without being used for mining [66222]. (b) omission: The incident can also be categorized as an omission failure as the wi-fi service omitted to perform its intended function of providing internet access without engaging in crypto-currency mining, thereby unknowingly recruiting visitors' computers for mining operations [66222]. (c) timing: There is no specific mention of a timing-related failure in the incident reported in the article. (d) value: The software failure incident can be linked to a value failure as the system performed its intended functions incorrectly by using the connected computers' processing power for mining digital currency instead of providing regular wi-fi services [66222]. (e) byzantine: The incident does not align with a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. (f) other: The other behavior exhibited in this software failure incident is unauthorized utilization of computing resources for cryptocurrency mining, which can be considered a form of exploitation or abuse of the system's capabilities [66222].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident at a Starbucks cafe in Buenos Aires involved the cafe's wi-fi service hijacking connected computers to use their processing power to mine cryptocurrency without the users' knowledge [66222]. This resulted in the affected customers' computers being used to create digital cash, impacting their devices and potentially their data security. Additionally, the incident could have led to increased electricity consumption on the users' devices, potentially impacting their energy bills.
Domain information (a) The failed system in this incident was related to the information industry as it involved the hijacking of computers to mine cryptocurrency at a Starbucks cafe in Buenos Aires [66222]. The incident affected customers using the cafe's wi-fi service, highlighting the risks associated with using public wi-fi networks for information-related activities.

Sources

Back to List