Incident: Square Payment System Vulnerable to Credit Card Data Theft.

Published Date: 2011-08-04

Postmortem Analysis
Timeline 1. The software failure incident involving the Square payment system happened in February (mentioned in the article). 2. The article was published on 2011-08-04. 3. Therefore, the software failure incident occurred in February 2011.
System 1. Square payment system 2. Square dongle
Responsible Organization 1. Researchers Adam Laurie and Zac Franken from Aperture Labs were responsible for causing the software failure incident reported in the news article [7290].
Impacted Organization 1. Credit card users 2. Square payment system 3. Merchants using Square for transactions 4. Financial institutions involved in processing credit card transactions 5. Square as a company 6. Potential impact on the reputation and trust of mobile payment systems in general [Cited Article: 7290]
Software Causes 1. Lack of encryption and authentication in the Square dongle, allowing for easy skimming of credit card data [7290] 2. Vulnerability in the Square system that enabled the transfer of money from stolen cards into the fraudsters' bank accounts without physical card swiping [7290]
Non-software Causes 1. Lack of encryption and authentication in the Square dongle device [7290] 2. Insufficient response from Square after being informed of the vulnerabilities [7290]
Impacts 1. The software failure incident allowed fraudsters to transfer money from stolen credit cards into their bank accounts associated with Square without physically swiping the card through the Square dongle card reader, enabling electronic-only transactions without the need for cloned cards or PINs [7290]. 2. The incident exposed a vulnerability where the Square dongle could be used to skim data from cards, facilitating the creation of cloned cards due to the lack of encryption or authentication in the devices [7290]. 3. The software failure incident lowered the technical barrier for committing credit card fraud by providing anyone with a mobile device and a Square dongle the ability to skim card data while appearing to conduct legitimate transactions, making it easier to cash out gift cards and potentially leading to increased fraudulent activities [7290].
Preventions 1. Implementing encryption and authentication mechanisms in the Square dongle to prevent unauthorized access to credit card data [7290]. 2. Conducting thorough security testing and vulnerability assessments on the Square payment system to identify and address potential weaknesses before they can be exploited by fraudsters [7290]. 3. Responding promptly to reports of potential security vulnerabilities by security researchers and taking proactive measures to address the identified issues before they can be exploited [7290].
Fixes 1. Implement encryption and authentication measures in the Square dongle to prevent data skimming and unauthorized access [7290]. 2. Regularly update the Square app and dongle to patch any vulnerabilities that could be exploited for fraud [7290]. 3. Enhance fraud detection mechanisms within the Square system to identify and prevent fraudulent transactions [7290]. 4. Conduct thorough security testing and audits on the Square system to identify and address potential weaknesses before they can be exploited [7290].
References 1. Black Hat security conference [7290] 2. Aperture Labs [7290] 3. Adam Laurie [7290] 4. Zac Franken [7290] 5. Square representatives [7290]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the Square payment system being vulnerable to fraud has happened again within the same organization. The article mentions that the researchers at the Black Hat security conference discovered two ways to exploit the Square system, indicating a recurring issue within the Square payment system [7290]. Additionally, the article mentions that Square was preparing to issue new dongles that encrypt the data, suggesting that the organization was taking steps to address the vulnerability within their product [7290]. (b) The software failure incident related to the Square payment system being vulnerable to fraud has also raised concerns about similar incidents potentially occurring at other organizations or with their products and services. The article highlights how the Square dongle can be used as a skimmer, turning any iPhone into a skimmer, which could potentially be a concern for other mobile payment processing systems as well [7290]. The ease with which credit card data can be skimmed using the Square dongle raises broader implications for the security of similar systems in the industry.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the discovery by researchers at the Black Hat security conference that the Square payment system could be used for fraud due to vulnerabilities in its design. Specifically, they found that the Square dongle could be used to skim data from cards without encryption or authentication, allowing for the creation of cloned cards [7290]. (b) The software failure incident related to the operation phase is evident in the demonstration by the researchers where they swiped a Visa gift card through a Square dongle to put money into their account, illustrating how the system could be misused for fraudulent activities [7290].
Boundary (Internal/External) within_system (a) The software failure incident described in the article is primarily within the system. The researchers at Aperture Labs discovered vulnerabilities within the Square payment system itself that allowed for fraudulent activities such as transferring money from stolen cards without swiping them through the Square dongle card reader and skimming data from cards to make cloned cards [7290]. These vulnerabilities were exploited by manipulating the system's functionality and using specialized code to convert and transmit data through the Square app and dongle [7290]. The lack of encryption and authentication in the Square dongle also contributed to the ease of exploiting the system [7290].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case is primarily due to non-human actions. The researchers at Aperture Labs discovered vulnerabilities in the Square payment system that allowed for fraudulent activities without the need for human intervention. They were able to transfer money from a stolen card into their bank account by feeding magnetic stripe data into a microphone and converting it into a sound file, which was then played into the Square device via a stereo cable [7290]. (b) However, human actions also played a role in this software failure incident. The researchers actively exploited the vulnerabilities they discovered in the Square system to demonstrate how credit card data could be stolen and used for fraudulent transactions. They developed code to convert stolen card data into a format that could be transmitted to the Square app, showing how the system could be manipulated for fraudulent purposes [7290].
Dimension (Hardware/Software) hardware, software (a) The software failure incident in the article is related to hardware. The researchers at the Black Hat security conference demonstrated how the Square dongle, a hardware device used for processing credit cards on mobile devices, could be used to skim data from cards and make cloned cards due to the lack of encryption or authentication in the device [7290]. (b) The software failure incident in the article is also related to software. The researchers used code written by Laurie to convert magnetic stripe data from a stolen card into a sound file, which they then played into the Square device via a stereo cable to transmit the data directly into the Square app. This manipulation of software allowed them to transfer money from a stolen card into their bank account without swiping a physical card through the Square dongle card reader [7290].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. The researchers at the Black Hat security conference demonstrated two ways in which the Square payment system could be used for fraud. They were able to transfer money from a stolen card into their bank account associated with Square without swiping a card through the Square dongle card reader by using code written by Laurie to feed magnetic stripe data from a stolen card into a microphone and convert it into a sound file. They then played that file into the Square device via a stereo cable, effectively turning a merchant system designed for physical cards into one for electronic-only transactions [7290]. Additionally, the researchers discovered that the Square dongle could be used to skim data from cards to make cloned cards because the devices do not use encryption or authentication. This allowed for the grabbing of magnetic stripe card data by plugging the Square dongle into the audio input of a mobile device, enabling the conversion of audio into human-readable credit card data [7290].
Intent (Poor/Accidental Decisions) accidental_decisions (a) The intent of the software failure incident was not due to poor decisions. The incident was a result of researchers at the Black Hat security conference discovering vulnerabilities in the Square payment system, specifically related to the Square dongle allowing for credit card data theft and fraudulent transactions. The researchers demonstrated how the Square system could be exploited for fraud by transferring money from stolen cards without swiping them and by skimming data to create cloned cards [7290].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the article can be attributed to development incompetence. The researchers at Aperture Labs discovered two ways to steal credit card data using the Square payment system due to vulnerabilities in the system. They were able to transfer money from a stolen card into their bank account associated with Square without swiping a card through the Square dongle card reader by feeding magnetic stripe data into a microphone and converting it into a sound file [7290]. (b) Additionally, the incident can also be categorized as accidental as the vulnerabilities in the Square system that allowed for the theft of credit card data were not intentional but rather accidental flaws in the design and implementation of the system. The lack of encryption and authentication in the Square dongle made it susceptible to being used as a skimming device, allowing for the cloning of credit cards [7290].
Duration temporary The software failure incident described in the article is more of a temporary nature. The incident involved researchers discovering vulnerabilities in the Square payment system that allowed for fraudulent activities such as transferring money from stolen cards without swiping them through the Square dongle card reader and skimming data from cards to create cloned cards. These vulnerabilities were specific to the Square system and the methods used by the researchers to exploit them, indicating that the failure was due to contributing factors introduced by certain circumstances but not all [7290].
Behaviour crash, omission, other (a) crash: The software failure incident related to the Square payment system involved a crash where the system lost its intended state and did not perform its functions as expected. The researchers were able to manipulate the Square device to transfer money from a stolen card into their bank account without swiping a physical card through the Square dongle card reader, effectively turning the system into one that could be used for electronic-only transactions [7290]. (b) omission: The software failure incident also involved an omission where the system omitted to perform its intended functions at an instance. The Square dongle was found to lack encryption or authentication, allowing the researchers to easily skim data from cards and make cloned cards using Laurie's special code to convert the audio into human-readable credit card data [7290]. (c) timing: The software failure incident did not involve a timing-related failure as the system was not reported to perform its intended functions too late or too early. (d) value: The software failure incident did not involve a value-related failure as the system was not reported to perform its intended functions incorrectly. (e) byzantine: The software failure incident did not involve a byzantine-related failure as the system was not reported to behave erroneously with inconsistent responses and interactions. (f) other: The software failure incident also exhibited behavior where the Square dongle was described as a skimmer, turning any iPhone into a skimmer, and allowing individuals with a mobile device and a Square dongle to skim a card while pretending to perform a legitimate transaction. This behavior was highlighted as lowering the bar for committing credit card fraud [7290].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incident involving the Square payment system allowed fraudsters to steal credit card data and transfer money from stolen cards into their bank accounts without the need to physically swipe a card through the Square dongle card reader [7290]. - The incident enabled fraudsters to use stolen card data for transactions without having to create cloned cards or know PINs, impacting the security of individuals' financial information [7290]. - The Square dongle was found to be vulnerable to skimming data from cards, allowing for the creation of cloned cards, which could potentially lead to financial losses for individuals [7290].
Domain finance (a) The failed system was related to the finance industry as it involved credit card processing and fraudulent activities associated with stealing credit card data [7290].

Sources

Back to List