Incident: Snapchat Third-Party Backup Hack Incident.

Published Date: 2014-10-10

Postmortem Analysis
Timeline 1. The software failure incident involving the Snapchat hack happened in October 2014 as per the article published on October 10, 2014 [30975].
System 1. Third-party services (SnapSave and SnapSaved) [30975] 2. Encryption implementation (used only a "single encryption key") [30975]
Responsible Organization 1. Third-party services such as SnapSave and SnapSaved were responsible for causing the Snapchat hack incident [30975].
Impacted Organization 1. Snapchat users - The software failure incident impacted an estimated 200,000 Snapchat accounts whose photos and videos were hacked through third-party services [30975].
Software Causes 1. The failure incident was caused by the unauthorized third-party services, SnapSave and SnapSaved, which allowed Snapchat users to read messages outside of Snapchat's app and create backups of messages without the knowledge or permission of users [30975]. 2. Snapchat's weak implementation of encryption using a single encryption key made it vulnerable to security breaches [30975].
Non-software Causes 1. Lack of user awareness and compliance with Snapchat's Terms of Use regarding the prohibition of third-party apps for sending and receiving Snaps [30975]. 2. Insufficient monitoring and enforcement by Snapchat to prevent the use of unauthorized third-party services [30975]. 3. Inadequate user education and communication from Snapchat about the risks associated with using third-party apps [30975].
Impacts 1. A massive 13-gigabyte library of photos and videos from around 200,000 Snapchat accounts was hacked due to third-party services allowing users to back up their content outside of Snapchat's control [30975]. 2. The incident compromised the security and privacy of Snapchat users who had their messages saved and potentially exposed without their knowledge or consent [30975]. 3. Snapchat users affected by the hack were left with limited options for recourse, as contacting administrators of websites hosting the images was suggested as the only way to potentially have the content removed, with no guarantee of success [30975].
Preventions 1. Implementing stricter controls and monitoring mechanisms to prevent the use of unauthorized third-party apps and services that interact with the main software system [30975]. 2. Conducting regular independent security reviews to identify vulnerabilities and ensure robust security measures are in place [30975]. 3. Enhancing encryption protocols and using stronger encryption methods, such as multi-key encryption, to protect user data and messages from unauthorized access [30975].
Fixes 1. Implement stricter monitoring and enforcement of third-party apps that violate the terms of service, as well as actively seeking out and removing unauthorized apps from platforms like the Google Play Store [30975]. 2. Conduct a thorough security review, including independent evaluations, to identify vulnerabilities and improve encryption practices to better protect user data [30975]. 3. Enhance user education and awareness regarding the risks associated with using third-party apps that compromise security, potentially through in-app notifications or updates to the terms of service [30975].
References 1. Snapchat spokeswoman Mary Ritti [30975] 2. Chris Eng, vice president of research at computer-security research firm Veracode [30975]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the Snapchat hack indicates that Snapchat has had issues with third-party services before. The article mentions that SnapSave, an Android app, and SnapSaved, a website, were at the center of the hack, allowing users to read messages outside of Snapchat's app and creating backups of messages [30975]. This incident highlights a vulnerability in Snapchat's security measures and raises concerns about the company's ability to prevent unauthorized access to user data. (b) The article also mentions that Snapchat has been slow to adopt encryption and has a history of not taking security seriously, according to Chris Eng, the vice president of research at computer-security research firm Veracode [30975]. This suggests that similar incidents or security vulnerabilities may have occurred at other organizations as well, where encryption and security measures were not given enough priority.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be attributed to the use of third-party services like SnapSave and SnapSaved that allowed Snapchat users to read messages outside of Snapchat's app and create backups of messages [30975]. These third-party services were not affiliated with Snapchat and were not officially endorsed by the company. The incident highlights a failure in the design aspect of Snapchat's security measures, as these unauthorized services were able to access and store user data without the knowledge or permission of Snapchat users. (b) The software failure incident related to the operation phase can be linked to the misuse of the system by Snapchat users who utilized third-party apps to send and receive Snaps, despite this practice being expressly prohibited in Snapchat's Terms of Use [30975]. Snapchat put the blame on its users for being victimized by their use of these unauthorized third-party apps, emphasizing that such actions compromised user security. This indicates a failure in the operation aspect of ensuring user compliance with security protocols and guidelines.
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident related to the Snapchat hack was primarily due to factors originating from within the system. Snapchat put the blame on its users for using third-party apps to send and receive Snaps, which compromised user security. The company expressly prohibits such practices in its Terms of Use. Additionally, the incident involved third-party services like SnapSave and SnapSaved, which allowed users to read messages outside of Snapchat's app and create backups of messages, potentially without the knowledge or permission of Snapchat users [30975]. (b) outside_system: The software failure incident related to the Snapchat hack also had contributing factors originating from outside the system. Third-party services like SnapSave and SnapSaved were at the center of the hack, indicating that external entities played a role in the breach. These services were not affiliated with Snapchat and were used by users to back up their photos and videos, leading to the exposure of a significant amount of data from Snapchat accounts [30975].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident related to non-human actions: The Snapchat hack incident was primarily caused by third-party services, namely SnapSave and SnapSaved, which allowed users to back up their Snapchat photos and videos outside of Snapchat's app. These services created backups of messages without the knowledge or permission of Snapchat users, leading to a massive breach of data [30975]. (b) The software failure incident related to human actions: In the case of the Snapchat hack, human actions played a significant role in the failure. Snapchat put the blame on its users for using third-party apps to send and receive Snaps, which compromised user security. The company expressly prohibits such practices in its Terms of Use, yet users engaged in these actions, ultimately leading to the breach [30975].
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: - The Snapchat hack incident was not directly attributed to hardware failure but rather to third-party services that allowed users to back up their photos and videos [30975]. (b) The software failure incident related to software: - The Snapchat hack incident was primarily caused by the unauthorized third-party services, SnapSave and SnapSaved, which allowed users to save and access Snapchat messages outside of the official app, leading to a breach of user data [30975].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident related to the Snapchat hack can be categorized as malicious. The incident involved a third-party hack where an enormous library of photos and videos from 200,000 accounts was saved through unauthorized apps and websites not affiliated with Snapchat [30975]. The hack was not a result of an unintentional error or fault but rather a deliberate act by individuals seeking to access and store Snapchat messages without the users' knowledge or permission. Snapchat explicitly blamed its users for being victimized by their use of third-party apps, which compromised the security of the system [30975]. Additionally, the incident highlighted the risks associated with using unauthorized third-party services that can lead to breaches and unauthorized access to sensitive data.
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident related to the Snapchat hack can be attributed to poor decisions made by Snapchat in allowing third-party services like SnapSave and SnapSaved to exist and operate alongside their platform. These services were not affiliated with Snapchat and allowed users to save messages and videos, contrary to Snapchat's intended ephemeral messaging feature. Snapchat admitted that they were not aggressive in policing third-party apps, indicating a lack of proactive measures to protect user data [30975]. (b) Additionally, the incident can also be linked to accidental decisions or unintended consequences as Snapchat users unknowingly used these third-party services to save messages, compromising their security. The backups created by these services may not have been intentional, raising questions about the users' awareness and consent regarding the storage of their Snapchat data [30975].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The article mentions concerns about Snapchat's security practices, with Chris Eng, vice president of research at computer-security research firm Veracode, stating that Snapchat has "a history of not taking security seriously" and suggesting that they may not be aggressive in policing third-party apps [30975]. (b) The incident involving the Snapchat hack where a 13-gigabyte library of photos and videos from 200,000 accounts was compromised through third-party services like SnapSave and SnapSaved indicates a failure that occurred accidentally due to users utilizing these unauthorized third-party apps to store and access Snapchat messages without the knowledge or permission of Snapchat [30975].
Duration permanent, temporary (a) The software failure incident related to the Snapchat hack can be considered as a permanent failure. The incident involved third-party services that allowed users to back up their Snapchat photos and videos, leading to a massive hack of a 13-gigabyte library of content from around 200,000 accounts [30975]. This breach exposed a significant number of users to potential privacy violations and security risks due to the unauthorized storage of their messages outside of Snapchat's intended system. Additionally, the incident highlighted concerns about Snapchat's security practices, including its slow adoption of encryption and potential lack of independent security reviews [30975]. (b) On the other hand, the software failure incident can also be viewed as a temporary failure in the sense that it was caused by specific circumstances related to the unauthorized third-party services used by some Snapchat users. Snapchat explicitly prohibits the use of such third-party apps in its Terms of Use, emphasizing the compromise to user security that can result from using these services [30975]. The incident underscores the risks associated with users deviating from the intended platform and engaging with external services that may not adhere to the same security standards or privacy protections as the official Snapchat application.
Behaviour other (a) crash: The Snapchat hack incident did not involve a system crash where the system loses state and does not perform any of its intended functions. The hack involved unauthorized access to a large library of photos and videos from user accounts, indicating a breach rather than a crash [30975]. (b) omission: The incident did not involve a failure due to the system omitting to perform its intended functions at an instance(s). Instead, the failure was related to unauthorized access and storage of user data by third-party services [30975]. (c) timing: The failure was not related to the system performing its intended functions correctly but too late or too early. The incident was more about unauthorized access and storage of user data by third-party services, leading to a breach [30975]. (d) value: The software failure incident was not due to the system performing its intended functions incorrectly. The issue was related to unauthorized access and storage of user data by third-party services, compromising user security [30975]. (e) byzantine: The incident did not involve the system behaving erroneously with inconsistent responses and interactions, which would align with a byzantine failure. The primary issue was the unauthorized access and storage of user data by third-party services [30975]. (f) other: The behavior of the software failure incident in this case could be categorized as a security breach or data leak. The incident involved the unauthorized access and storage of a significant amount of user data by third-party services, leading to a compromise of user privacy and security [30975].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident related to the Snapchat hack resulted in the compromise of users' security and privacy. An enormous library of photos and videos from approximately 200,000 accounts was hacked through third-party services not affiliated with Snapchat. These third-party services, such as SnapSave and SnapSaved, allowed users to read messages outside of Snapchat's app and created backups of messages without the knowledge or permission of the users [30975]. As a consequence, users' personal data, in the form of photos and videos, was accessed and potentially exposed due to this software failure incident.
Domain information (a) The software failure incident related to the Snapchat hack primarily impacted the industry of information production and distribution. The incident involved the unauthorized access and storage of photos and videos from Snapchat accounts, highlighting a breach in the security of the messaging service [30975].

Sources

Back to List