Incident: Employee Turns ESEA Software into Bitcoin-Mining Trojan, Impacting Users

Published Date: 2013-07-09

Postmortem Analysis
Timeline 1. The software failure incident where the ESEA software was altered to secretly mine Bitcoins happened in April [20559]. Estimation: Step 1: The article mentions that the incident happened in April. Step 2: The article was published on 2013-07-09. Step 3: The incident occurred in April 2013.
System 1. ESEA gaming network software 2. Counter-Strike anti-cheating modes 3. Bitcoin-mining code added by a rogue employee 4. Graphics processing chips on gaming machines 5. Peer-to-peer Bitcoin network
Responsible Organization 1. An unidentified staffer at the ESEA gaming network was responsible for causing the software failure incident by turning the company's software into a secret Bitcoin-mining Trojan [20559].
Impacted Organization 1. Customers of the ESEA gaming network who had the unauthorized Bitcoin-mining software installed on their computers [20559].
Software Causes 1. The software failure incident was caused by an unidentified staffer at ESEA gaming network who altered the company's software to secretly mine Bitcoins [20559].
Non-software Causes 1. The unauthorized action of an unidentified staffer who turned the company's software into a secret Bitcoin-mining Trojan for personal gain [20559].
Impacts 1. The software failure incident led to the unauthorized mining of Bitcoins on approximately 14,000 computers, causing financial losses to the users [20559]. 2. Users reported damages to their systems and increased electricity bills as a result of the mining software [20559]. 3. The incident resulted in a class action lawsuit being filed against ESEA in San Francisco Superior Court [20559]. 4. ESEA had to set up a claims process to reimburse qualified individuals for damages caused by the mining software, resolving 275 claims so far [20559].
Preventions 1. Implementing strict code review processes to detect unauthorized changes in the software [20559]. 2. Enforcing access controls and monitoring mechanisms to prevent rogue employees from making unauthorized modifications to the software [20559]. 3. Conducting regular security audits to identify any potential vulnerabilities or suspicious activities within the software [20559]. 4. Educating employees on the importance of ethical behavior and the consequences of engaging in malicious activities within the software systems [20559].
Fixes 1. Implement stricter code review processes to prevent unauthorized code changes like the Bitcoin-mining code from being added to the software [20559]. 2. Enhance monitoring and auditing mechanisms to detect any unauthorized or malicious activities within the software [20559]. 3. Conduct thorough background checks and regular security training for employees to prevent insider threats and unauthorized actions [20559].
References 1. ESEA co-founder Craig Levine [20559]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident of unauthorized Bitcoin mining within the ESEA gaming network happened within the same organization again. An unidentified staffer at ESEA was fired for turning the company's software into a secret Bitcoin-mining Trojan. The incident involved altering the software to secretly mine Bitcoins, leading to a class action lawsuit and damages to customers' systems and electricity bills [20559]. (b) There is no information provided in the articles about a similar software failure incident happening at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident in Article 20559 was related to the design phase. An unidentified staffer at the ESEA gaming network altered the company's software to secretly mine Bitcoins, which was not part of the intended design of the software used by serious Counter-Strike players for anti-cheating modes. The unauthorized Bitcoin mining code was added by a rogue employee for personal gain, introducing a contributing factor during the system development phase [20559]. (b) The software failure incident in Article 20559 was also related to the operation phase. The unauthorized Bitcoin mining code added to the software by the rogue employee led to damaging client systems and spiking their electricity bills when the software was operational on their computers. This misuse of the system by the employee during its operation caused harm to the users [20559].
Boundary (Internal/External) within_system, outside_system The software failure incident at ESEA involving the secret Bitcoin-mining Trojan can be categorized as both within_system and outside_system: (a) within_system: The failure originated from within the system as an unidentified staffer within ESEA altered the company's software to secretly mine Bitcoins [20559]. (b) outside_system: The failure was also influenced by factors outside the system, such as the impact on clients' systems and electricity bills due to the unauthorized mining software, leading to a class action lawsuit against ESEA [20559].
Nature (Human/Non-human) human_actions (a) The software failure incident in this case was due to human actions. An unidentified staffer at the ESEA gaming network was fired for allegedly turning the company's software into a secret Bitcoin-mining Trojan [20559]. The rogue employee added the Bitcoin mining code for his own personal gain, which led to the unauthorized mining on as many as 14,000 computers, causing damage to clients' systems and spiking their electricity bills. The incident was not a result of non-human actions but rather a deliberate act by a human employee.
Dimension (Hardware/Software) hardware, software (a) The software failure incident in Article 20559 occurred due to contributing factors that originate in hardware. The incident involved a staffer at the ESEA gaming network altering the company's software to secretly mine Bitcoins, which led to damage to clients' systems and spiked electricity bills [20559]. The unauthorized Bitcoin mining code was added to the software by a rogue employee for personal gain, utilizing the processing power of the computers' graphics chips for mining activities [20559]. (b) The software failure incident in Article 20559 also had contributing factors that originate in software. The alteration of the ESEA software to include the secret Bitcoin-mining code was a direct software-related issue that led to the incident [20559]. The software modification was unauthorized and introduced into the system by an employee, causing harm to clients and resulting in the need for the company to take steps to prevent such incidents from happening again [20559].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident at the ESEA gaming network was malicious in nature. An unidentified staffer was fired for allegedly turning the company's software into a secret Bitcoin-mining Trojan, which was done for his own personal gain. The rogue employee added the unauthorized Bitcoin mining code to secretly mine Bitcoins using the company's software, causing damage to clients' systems and spiking their electricity bills [20559].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was related to poor_decisions. The incident involved an unidentified staffer at the ESEA gaming network who allegedly turned the company's software into a secret Bitcoin-mining Trojan for personal gain. The company initially considered adding a Bitcoin mining option to its software but a rogue employee added the code without authorization. This unauthorized action led to significant consequences, including damage to clients' systems and increased electricity bills [20559].
Capability (Incompetence/Accidental) accidental (a) The software failure incident in Article 20559 was not due to development incompetence but rather due to an intentional act by an unidentified staffer who altered the company's software to secretly mine Bitcoins. The incident was attributed to a rogue employee who added the unauthorized Bitcoin mining code for personal gain, rather than a failure stemming from development incompetence [20559]. (b) The software failure incident in Article 20559 was accidental in the sense that the unauthorized Bitcoin mining code was added by a rogue employee without the company's knowledge or approval. The company initially thought of adding a Bitcoin mining option to its software but did not implement it officially. The addition of the mining code was not part of the planned development but was done by the employee for personal gain, indicating an accidental introduction of the malicious code [20559].
Duration temporary From the provided article [20559], the software failure incident involving the unauthorized Bitcoin-mining code at ESEA can be categorized as a temporary failure. The incident was caused by a rogue employee who added the mining code for personal gain, which indicates that the failure was due to specific circumstances introduced by the actions of this individual. The company took steps to terminate the responsible employee, address the damages caused, and prevent such incidents from happening again, demonstrating that the failure was not a permanent issue affecting the software under all circumstances.
Behaviour other (a) crash: The software failure incident in the article does not involve a crash where the system loses state and does not perform any of its intended functions. The incident is related to unauthorized Bitcoin mining code being added to the software, which was functioning but performing an additional unintended function of mining Bitcoins secretly [20559]. (b) omission: The software failure incident does not involve omission where the system omits to perform its intended functions at an instance(s). The software was functioning as intended for its primary purpose of allowing Counter-Strike players to play each other in anti-cheating modes, but it also secretly mined Bitcoins without the users' knowledge [20559]. (c) timing: The software failure incident does not involve timing issues where the system performs its intended functions correctly but too late or too early. The unauthorized Bitcoin mining code was added to the software, and it functioned in real-time alongside the primary functions of the software [20559]. (d) value: The software failure incident does not involve a failure due to the system performing its intended functions incorrectly. The software was functioning correctly for its primary purpose, but the addition of the Bitcoin mining code was an unauthorized action that led to unintended consequences [20559]. (e) byzantine: The software failure incident does not involve a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. The addition of the Bitcoin mining code was a deliberate act by an employee for personal gain, leading to consistent but unauthorized behavior within the software [20559]. (f) other: The behavior of the software failure incident can be categorized as unauthorized behavior. An employee added a secret Bitcoin-mining Trojan to the software without authorization, leading to unintended consequences and damage to users' systems and electricity bills. This unauthorized action was not part of the intended functions of the software [20559].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving the ESEA gaming network resulted in significant property damage for its customers. The unauthorized Bitcoin-mining code inserted into the software caused damage to clients' systems and led to increased electricity bills for affected individuals [20559]. The company acknowledged the damages caused by the mining software and set up a claims process for customers to submit verified damages, including graphics cards and power bills, and has reimbursed qualified individuals for their losses [20559].
Domain entertainment (a) The failed system was intended to support the gaming industry, specifically the Counter-Strike gaming community within the E-Sports Entertainment Association (ESEA) network [20559].

Sources

Back to List