| Recurring |
one_organization, multiple_organization |
(a) The software failure incident related to a password breach at Yahoo has happened again within the same organization. In the incident reported in Article 13178, more than 450,000 usernames and unencrypted passwords were stolen from Yahoo Voice, a user-contribution service on Yahoo's network. This incident is similar to the one reported in Article 13336, where a hacker collective called D33Ds Co. publicly posted over 450,000 log-in credentials obtained from Yahoo's "Contributor Network" site due to a "union-based SQL injection" attack. Both incidents involved a breach of user credentials within Yahoo's services [13336, 13178].
(b) The software failure incident related to a password breach has also occurred at other organizations. The incident reported in Article 13178 mentions similar attacks reported against other online services, including Android Forums and Formspring, where users were encouraged to change their passwords immediately. These attacks were separate from the Yahoo breach but indicate a trend of password breaches affecting multiple organizations [13178]. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident related to the design phase:
- The incident involved a major password breach at Yahoo, where more than 450,000 log-in credentials were publicly posted by hackers. The attack was described as a "union-based SQL injection," which exploited a poorly secured site's database to obtain private information [13336].
- The passwords obtained from Yahoo were stored in plain text instead of being cryptographically hashed, which is a significant security failure on Yahoo's part [13336].
- The incident exposed usernames and passwords from Yahoo's "Contributor Network" site, which was originally an independent site called Associated Content acquired by Yahoo. The exposed passwords mostly belonged to contributors who wrote material for either Associated Content or Yahoo [13336].
- The incident also revealed a large number of log-in credentials for other email services like Gmail, Hotmail, AOL, and ISPs, indicating a potential design flaw in how user accounts were managed and secured [13336].
(b) The software failure incident related to the operation phase:
- The incident involved the misuse of user-generated content services on Yahoo's network, particularly Yahoo Voice, where more than 450,000 usernames and unencrypted passwords were stolen and posted online [13178].
- The passwords for the Yahoo Voice accounts were not encrypted, allowing hackers to immediately use them against other services, including Yahoo Mail, putting a significant amount of user data at risk [13178].
- The attack on Yahoo Voice was linked to an SQL injection attack, a common form of hacking that exploits flaws in the database and web software to gain access to sensitive information [13178].
- The incident highlighted the potential risks associated with the operation and security practices of user-generated content platforms like Yahoo Voice, where the lack of encryption for passwords posed a serious threat to user data [13178]. |
| Boundary (Internal/External) |
within_system |
(a) The software failure incident related to the Yahoo password breach can be categorized as within_system. The incident was caused by a "union-based SQL injection," which is a method of exploiting a vulnerability within the system to trick the database into divulging private information [13336]. Additionally, the passwords were stored in plain text instead of being hashed, which is a significant security failure on Yahoo's part [13336]. The attack on Yahoo Voice, a user-contribution service on Yahoo's network, also involved exploiting flaws in the database and web software to gain access to usernames and passwords [13178]. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident occurring due to non-human actions:
- The software failure incident involving the Yahoo password breach was primarily due to a "union-based SQL injection" attack, which is a method of exploiting a vulnerability in the database without human participation [13336].
- The attack on Yahoo Voice, where over 450,000 usernames and unencrypted passwords were stolen, was also attributed to an SQL injection attack, which is a non-human action that exploits flaws in the database and web software [13178].
(b) The software failure incident occurring due to human actions:
- The failure to properly secure the passwords in the Yahoo Contributor Network, leading to the exposure of usernames and passwords stored in plain text, was a security failure on Yahoo's part, which can be considered a failure due to human actions [13336].
- The decision not to encrypt passwords in Yahoo Voice accounts, potentially exposing them to immediate use by hackers, was a human action that contributed to the severity of the breach [13178]. |
| Dimension (Hardware/Software) |
software |
(a) The software failure incident occurring due to hardware:
- The articles do not mention any hardware-related issues contributing to the software failure incident. Therefore, it is unknown if hardware played a role in this incident.
(b) The software failure incident occurring due to software:
- The software failure incident in the articles is primarily attributed to a software vulnerability in Yahoo's system. The attack was described as a "union-based SQL injection," which is a software-related vulnerability that allowed hackers to trick the database into divulging private information [13336].
- The incident involved the theft of over 450,000 usernames and unencrypted passwords from Yahoo Voice, a user-contribution service on Yahoo's network, indicating a software-related security flaw in how user data was stored and protected [13178]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident related to the Yahoo password breach was malicious in nature. The incident involved a hacker collective known as D33Ds Co. who publicly posted over 450,000 log-in credentials obtained from Yahoo's "Contributor Network" site through a "union-based SQL injection" attack. The hackers described their attack as a way of tricking the poorly secured site's database into divulging private information, leading to a mass disclosure of usernames and passwords stored in plain text. The incident was aimed at pointing out lax security at Yahoo, although the exposed passwords became available to malicious individuals worldwide [13336].
(b) The incident was non-malicious in the sense that Yahoo's official statement mentioned that the compromised file was older and that fewer than 5 percent of the Yahoo passwords disclosed were currently valid. Yahoo took immediate action to fix the vulnerability, change passwords, and notify affected users and other companies whose users' accounts may have been compromised. The incident highlighted the importance of changing passwords regularly and following online safety tips [13336]. |
| Intent (Poor/Accidental Decisions) |
poor_decisions, accidental_decisions |
(a) The intent of the software failure incident:
- The software failure incident related to the Yahoo password breach was not intentional but rather a result of poor decisions made in terms of security measures. The hackers exploited a vulnerability in Yahoo's Contributor Network site using a "union-based SQL injection" to obtain over 450,000 log-in credentials [13336]. This incident highlighted significant security failures on Yahoo's part, such as storing passwords in plain text instead of hashing them for protection against mass disclosure. The hackers claimed they released the information to point out lax security at Yahoo, not for malicious purposes [13336].
- The incident involving the Yahoo Voice hack was also not intentional but rather a result of poor decisions related to security practices. The passwords for the accounts were not encrypted, making it easy for hackers to access emails and potentially use them against other services, including Yahoo Mail [13178]. The attack was carried out using an SQL injection attack, exploiting flaws in the database and web software to gain unauthorized access to user data [13178]. |
| Capability (Incompetence/Accidental) |
development_incompetence |
(a) The software failure incident occurring due to development incompetence:
The incident involving the Yahoo password breach was primarily due to a lack of professional competence in terms of security measures implemented by Yahoo. The hackers were able to exploit a "union-based SQL injection" vulnerability on Yahoo's "Contributor Network" site, which allowed them to access and disclose over 450,000 log-in credentials. Additionally, the passwords were stored in plain text instead of being hashed, which is a standard security practice to prevent mass disclosure of passwords [13336].
(b) The software failure incident occurring accidentally:
The incident involving the Yahoo password breach was not accidental but rather a deliberate attack by a hacker collective called D33Ds Co. The hackers exploited a vulnerability in Yahoo's system using an SQL injection attack to obtain and disclose the log-in credentials. The incident was not accidental but a result of a targeted attack on Yahoo's security infrastructure [13336]. |
| Duration |
permanent |
(a) The software failure incident related to the Yahoo password breach can be considered permanent. The incident involved a major password breach where more than 450,000 log-in credentials were publicly posted by hackers. The attack was described as a "union-based SQL injection," which allowed the hackers to obtain private information from Yahoo's "Contributor Network" site. The passwords were stored in plain text, which is a significant security failure on Yahoo's part. The incident led to the exposure of usernames and passwords, which were widely distributed across the Internet [13336, 13178].
The breach was a serious security incident that exposed sensitive information and passwords of users, leading to a permanent impact on the affected individuals and potentially compromising their accounts on various services. |
| Behaviour |
crash, value, other |
(a) crash:
- Article 13336 reports a crash incident where Yahoo's password breach led to a major exposure of user passwords, indicating a failure due to the system losing state and not performing its intended functions [13336].
- Article 13178 mentions a potential crash incident where more than 450,000 usernames and unencrypted passwords were stolen from Yahoo Voice, a user-contribution service on Yahoo's network, potentially leading to a serious security risk [13178].
(b) omission:
- The articles do not specifically mention an omission as the primary behavior of the software failure incident.
(c) timing:
- The articles do not specifically mention timing as the primary behavior of the software failure incident.
(d) value:
- Article 13336 describes a value-related failure where Yahoo's security flaw led to passwords being stored in plain text instead of being hashed, which is a significant security failure on Yahoo's part [13336].
- Article 13178 also highlights a value-related failure where the passwords for the Yahoo Voice accounts were not encrypted, potentially allowing hackers to immediately use them against other services, including Yahoo Mail [13178].
(e) byzantine:
- The articles do not specifically mention a byzantine behavior as the primary behavior of the software failure incident.
(f) other:
- The other behavior observed in the software failure incident is a security breach due to a hack. Both articles report incidents where hackers gained unauthorized access to user credentials, leading to a breach of sensitive information [13336, 13178]. |