| Recurring |
one_organization, multiple_organization |
(a) The software failure incident related to data not being properly wiped from devices before resale has happened again at Tesco. The incident involved the Tesco Hudl tablet, where a bug in the Rockchip processor's firmware allowed personal data to be retrieved even after a factory reset [29268].
(b) The software failure incident related to data not being properly wiped from devices before resale has also happened at Amazon with its Echo Dot devices. Researchers found that even after a factory reset, sensitive data such as Wi-Fi credentials and Amazon account information remained on the devices, making it easy for someone with physical access to extract this information [116763]. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident related to the design phase can be seen in the incident involving the Tesco Hudl tablet [29268]. The vulnerability in the tablet was attributed to a bug in its Rockchip processor’s firmware, which allowed security experts to read and write data stored on the device, including sensitive information like unlock codes, Wi-Fi passwords, and browsing history. This design flaw in the processor's firmware contributed to the failure of securely wiping personal data from the device, even after a factory reset was performed.
(b) The software failure incident related to the operation phase can be observed in the incident involving Amazon's Echo Dot [116763]. Researchers found that even after performing a factory reset on the Echo Dot devices, digital bits that remained on the reset devices could be reassembled to retrieve sensitive data such as passwords, locations, authentication tokens, and more. This indicates a failure in the operation or misuse of the system, where users may not have been fully aware of the potential risks of data retention even after a reset, leading to the exposure of personal information. |
| Boundary (Internal/External) |
within_system |
(a) within_system: The software failure incident related to the Tesco Hudl tablet and Amazon's Echo Dot can be categorized as within_system failures. In the case of the Tesco Hudl tablet, the vulnerability was due to a bug in the tablet's Rockchip processor's firmware, which allowed security experts to read and write data stored on the device [29268]. Similarly, in the case of Amazon's Echo Dot, researchers found that even after a factory reset, sensitive data such as Wi-Fi credentials, previous owner's information, and connected devices' details remained on the device's flash memory, indicating a failure within the system to completely wipe out data [116763]. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident occurring due to non-human actions:
- In the incident involving the Tesco Hudl tablet [29268], a bug in the Rockchip processor’s firmware was identified as the vulnerability that allowed data retrieval from second-hand devices. This bug in the processor's firmware was a non-human factor that contributed to the software failure incident.
(b) The software failure incident occurring due to human actions:
- In the incident involving Amazon's Echo Dot [116763], researchers found that even after a factory reset, sensitive data remained on the reset devices, including passwords, locations, authentication tokens, and more. This indicates that the failure to completely wipe the data during the reset process was a contributing factor introduced by human actions. |
| Dimension (Hardware/Software) |
hardware, software |
(a) The software failure incident occurring due to hardware:
- In the incident involving the Tesco Hudl tablet, a bug in the Rockchip processor's firmware was identified as the vulnerability that allowed security experts to read and write data stored on the device [29268].
- Researchers examining Amazon Echo Dot devices found that even after a factory reset, sensitive data such as Wi-Fi credentials and previous owner information remained on the NAND flash memory of the devices, indicating a hardware-related issue in securely wiping data [116763].
(b) The software failure incident occurring due to software:
- The incident with the Tesco Hudl tablet highlighted a software bug in the Rockchip processor's firmware as the root cause of the vulnerability that allowed data retrieval [29268].
- Researchers discovered that the software reset process on Amazon Echo Dot devices did not completely erase sensitive data from the NAND flash memory, indicating a software-related failure in the reset mechanism [116763]. |
| Objective (Malicious/Non-malicious) |
malicious, non-malicious |
(a) The software failure incident reported in the articles is related to a malicious objective. The incidents involved security researchers discovering vulnerabilities in devices such as Tesco's Hudl tablet and Amazon's Echo Dot that allowed for the retrieval of sensitive data even after a factory reset. For example, in the case of the Tesco Hudl tablet, a bug in the Rockchip processor's firmware allowed for the extraction of data like unlock codes, Wi-Fi passwords, and browsing history [29268]. Similarly, researchers found that used Echo Dots could still contain sensitive information such as Wi-Fi credentials, Amazon account details, and information about connected devices even after a factory reset [116763].
(b) The incidents were non-malicious in the sense that the vulnerabilities were not intentionally introduced to harm the system but rather stemmed from flaws in the devices' design or firmware. For instance, the vulnerability in the Rockchip processor's firmware of the Tesco Hudl tablet was exploited by security researchers to access data, indicating a flaw in the device's security measures [29268]. Similarly, the researchers who examined the Echo Dot devices found that the data remaining on reset devices was due to the way NAND-based flash memory handles deleted data, highlighting a design issue rather than a deliberate act to compromise security [116763]. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
(a) The software failure incident related to the Tesco Hudl tablet and Amazon's Echo Dot can be attributed to poor decisions made in the design and implementation of the devices' factory reset processes. In both cases, researchers discovered that even after performing a factory reset on the devices, sensitive data such as passwords, Wi-Fi credentials, and personal information remained accessible to potential attackers [29268, 116763]. This indicates that the decision to not completely wipe the data during a factory reset, leaving behind remnants that could be exploited, was a poor decision that led to the software failure incidents. |
| Capability (Incompetence/Accidental) |
development_incompetence |
(a) The software failure incident related to development incompetence can be seen in the case of the Tesco Hudl tablet. The incident was caused by a bug in the tablet's Rockchip processor's firmware, which allowed security researchers to retrieve sensitive data even after a factory reset was performed. This bug in the firmware was a result of a lack of professional competence in ensuring data security and proper data wiping procedures [29268].
(b) The software failure incident related to accidental factors can be observed in the case of Amazon's Echo Dot devices. Researchers found that even after performing a factory reset on these devices, digital bits that remained on the reset devices could be reassembled to retrieve sensitive data accidentally left behind by the previous owners. This accidental oversight in data wiping procedures led to the exposure of passwords, locations, authentication tokens, and other sensitive information [116763]. |
| Duration |
permanent |
(a) The software failure incident described in the articles is more aligned with a permanent failure. In both articles, it is highlighted that even after performing a factory reset on devices such as Tesco's Hudl tablet and Amazon's Echo Dot, sensitive data including passwords, Wi-Fi credentials, and other personal information remained accessible to researchers who were able to extract this data from the devices [29268, 116763]. This indicates a fundamental flaw in the software or firmware of these devices that allows data to persist even after supposed data wiping procedures, making the failure more permanent in nature. |
| Behaviour |
omission, value, other |
(a) crash: The articles do not mention any instances of a crash where the system loses state and does not perform any of its intended functions.
(b) omission: The software failure incident related to omission is evident in both articles. In Article 29268, it is mentioned that a bug in the processor of Tesco's Hudl tablet left private data at risk, and even after a factory reset, deleted data could still be retrieved, indicating an omission in fully wiping out the data. In Article 116763, researchers found that 61% of used Amazon Echo Dot devices bought had not been factory reset, leading to the omission of removing sensitive data like Wi-Fi passwords, account credentials, and device information.
(c) timing: The articles do not mention any instances of a timing failure where the system performs its intended functions too late or too early.
(d) value: The software failure incident related to value is seen in both articles. In Article 29268, it is highlighted that personal data was not fully wiped from second-hand Tesco Hudl tablets, indicating a failure in performing the intended function of data deletion. In Article 116763, researchers were able to extract sensitive data like Wi-Fi credentials, account information, and device details from reset Amazon Echo Dot devices, showcasing a failure in maintaining the value of user privacy and security.
(e) byzantine: The articles do not mention any instances of a byzantine failure where the system behaves erroneously with inconsistent responses and interactions.
(f) other: The other behavior observed in the software failure incidents is related to security vulnerabilities. Both articles discuss how security flaws in the devices' processors or firmware led to the exposure of sensitive data, indicating a failure in ensuring robust security measures to protect user information. |