Incident: Timehop Security Breach Exposes Data of 21 Million Users

Published Date: 2018-07-09

Postmortem Analysis
Timeline 1. The software failure incident of the Timehop security breach happened on July 4, as mentioned in the article [73654]. Therefore, the incident occurred in July 2018.
System 1. Timehop's security system [73654]
Responsible Organization 1. The software failure incident at Timehop, where the data of 21 million users was compromised, was caused by a network intrusion leading to a security breach [73654].
Impacted Organization 1. Users of Timehop - 21 million users had their data compromised [73654] 2. Social media sites such as Facebook, Twitter, and Instagram - Access tokens that link with these sites were compromised [73654]
Software Causes 1. Lack of multifactor authentication for the access credential to Timehop's cloud computing environment [73654]
Non-software Causes 1. Lack of multifactor authentication for access credentials to Timehop's cloud computing environment [73654]
Impacts 1. Data of 21 million Timehop users, including names, email addresses, and some phone numbers, was compromised [73654]. 2. Access tokens linking Timehop with social media sites like Facebook, Twitter, and Instagram were compromised, potentially allowing unauthorized viewing of social media posts [73654]. 3. Users had to log back into Timehop, reauthenticate each service, and take extra steps to secure their accounts, especially if a phone number was attached [73654]. 4. The security breach was possible due to the lack of multifactor authentication for an access credential to Timehop's cloud computing environment [73654]. 5. Timehop notified all EU users in compliance with the General Data Protection Regulation (GDPR) [73654].
Preventions 1. Implementing multifactor authentication to protect access credentials to the cloud computing environment could have prevented the security breach at Timehop [73654]. 2. Regularly updating and maintaining security measures and protocols to ensure the protection of user data and access tokens. 3. Conducting regular security audits and assessments to identify and address any vulnerabilities in the system. 4. Promptly responding to security incidents and breaches to mitigate potential damages and inform users about the situation.
Fixes 1. Implementing multifactor authentication to protect access credentials to the cloud computing environment [73654].
References 1. Timehop company statement 2. General Data Protection Regulation (GDPR) 3. Lack of multifactor authentication for Timehop's cloud computing environment

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization <Article 73654> The software failure incident at Timehop where a security breach led to the compromise of data for 21 million users is an example of a software failure incident that happened at one organization. This incident involved a network intrusion that compromised user data, highlighting the importance of implementing robust security measures to protect user information [73654].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be attributed to the lack of multifactor authentication protecting an access credential to Timehop's cloud computing environment. This design flaw allowed for the security breach to occur, resulting in the compromise of data for 21 million users [73654]. (b) The software failure incident related to the operation phase can be linked to the misuse of the compromised access tokens by potential thieves. These compromised tokens, which allow the app to link with social media sites, could have been used to view social media posts of users. The company had to deauthorize all compromised tokens, requiring users to log back in and reauthenticate each service they want to use with the app [73654].
Boundary (Internal/External) within_system (a) The software failure incident reported in Article 73654 falls under the within_system category. The breach occurred due to an access credential to Timehop's cloud computing environment not being protected by multifactor authentication, which is an internal system vulnerability [73654].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurred due to non-human actions, specifically a "network intrusion" that led to the breach and compromise of data of 21 million Timehop users [73654]. The breach was possible because an access credential to Timehop's cloud computing environment hadn't been protected by multifactor authentication, indicating a vulnerability in the system that was exploited by the non-human actors. (b) The software failure incident also involved human actions as the company behind Timehop had not implemented multifactor authentication to protect the access credential to their cloud computing environment, which was a contributing factor to the security breach [73654]. Additionally, the company's response to the breach, such as deauthorizing compromised tokens and recommending users to take extra steps to secure their accounts, involved human actions in mitigating the consequences of the incident.
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The security breach at Timehop was possible because an access credential to Timehop's cloud computing environment hadn't been protected by multifactor authentication, indicating a failure in the security measures related to hardware [73654]. (b) The software failure incident related to software: - The breach at Timehop was primarily a software failure incident where the access tokens linking the app with social media sites were compromised, potentially allowing unauthorized access to social media posts [73654].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in Article 73654 was malicious in nature. Timehop revealed that its security was breached due to a "network intrusion" where the data of 21 million users was compromised. The breach involved unauthorized access to user data, including names, email addresses, and phone numbers, by individuals with the intent to steal information. The compromised access tokens could potentially allow the thieves to view social media posts, indicating a malicious intent behind the breach [73654].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident related to the Timehop security breach was primarily due to poor decisions. The breach was possible because an access credential to Timehop's cloud computing environment hadn't been protected by multifactor authentication, which is considered a poor decision in terms of security measures [73654].
Capability (Incompetence/Accidental) development_incompetence, unknown (a) The software failure incident related to development incompetence is evident in the article as it mentions that the security breach was possible because an access credential to Timehop's cloud computing environment hadn't been protected by multifactor authentication. This lack of proper security measures indicates a failure in professional competence by the development organization [73654]. (b) The software failure incident related to accidental factors is not explicitly mentioned in the article.
Duration temporary The software failure incident reported in Article 73654 was temporary. The breach occurred due to a network intrusion on July 4, compromising the data of 21 million users. The breach was a result of an access credential to Timehop's cloud computing environment not being protected by multifactor authentication. The company took immediate steps to address the breach, such as deauthorizing compromised tokens, requiring users to log back in and reauthenticate services, and notifying EU users in compliance with GDPR. Additionally, Timehop recommended users take extra steps to secure their accounts, such as adding a PIN to prevent unauthorized access to bank accounts [73654].
Behaviour value, other (a) crash: The software failure incident in the article does not involve a crash where the system loses state and does not perform any of its intended functions. (b) omission: The incident does not involve the system omitting to perform its intended functions at an instance(s). (c) timing: The incident does not involve the system performing its intended functions correctly, but too late or too early. (d) value: The software failure incident in the article is related to the system performing its intended functions incorrectly. The breach led to the compromise of user data, including names, email addresses, and phone numbers, indicating a failure in protecting user information [73654]. (e) byzantine: The incident does not involve the system behaving erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident in the article is related to a security breach where unauthorized access led to the compromise of user data, specifically names, email addresses, and phone numbers. This unauthorized access resulted in the system performing its intended functions incorrectly by failing to protect user information adequately [73654].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving Timehop resulted in the compromise of data belonging to 21 million users. The breach led to the theft of names, email addresses, and some phone numbers of the users. Additionally, access tokens that allow the app to link with social media sites like Facebook, Twitter, and Instagram were compromised, potentially allowing the thieves to view social media posts. As a precautionary measure, all compromised tokens were deauthorized, and users were required to log back into Timehop and reauthenticate each service they wanted to use with the app. The stolen data, including phone numbers, could potentially be misused by hackers to access bank accounts, highlighting the impact on people's material goods and data [73654].
Domain information (a) The software failure incident reported in Article 73654 is related to the information industry. Timehop, the company affected by the security breach, is an app that allows users to see their past social media posts and photos [73654]. The breach involved the compromise of user data, including names, email addresses, and phone numbers, as well as access tokens that link the app with social media sites like Facebook, Twitter, and Instagram. The incident highlights the importance of data security in the information industry.

Sources

Back to List