| Recurring |
multiple_organization |
(a) The software failure incident related to the cyber attack targeting banking accounts has not been shown to have happened again at a specific organization [10439].
(b) The article mentions that the 'man in the browser' cyber attacks, including the variant of the 'SpyEye' trojan, are increasingly common and can affect users of various banks and financial institutions. These attacks are not specific to one organization but can target users across different organizations [10439]. |
| Phase (Design/Operation) |
design |
(a) The software failure incident described in the articles is related to the design phase. The incident involves a new generation of cyber attacks that have evolved to bypass the latest security measures, including PIN devices and security software like Norton 360. The attack involves diverting users to a fake banking website by presenting a fake security upgrade window, which then allows cyber-criminals to access the real account using login details obtained through this deception [10439].
(b) The software failure incident is not directly related to the operation phase or misuse of the system. Instead, it focuses on the design flaw that allows cyber-criminals to deceive users and gain access to their accounts through sophisticated attacks that bypass security measures [10439]. |
| Boundary (Internal/External) |
within_system |
(a) within_system: The software failure incident described in the articles is primarily within the system. The cyber attack, known as the 'man in the browser' attack, targets users' web browsers and diverts them to fake banking websites. The attack leverages malicious software that steps in when a user visits a banking website, presenting a fake security upgrade window that redirects users to a fraudulent banking site. This attack bypasses security systems, including PIN devices and PC security software like Norton 360, demonstrating a vulnerability within the system itself [10439].
(b) outside_system: The software failure incident does not seem to have contributing factors originating from outside the system. The attack is focused on exploiting vulnerabilities within users' browsers and security measures, rather than external factors beyond the control of the system [10439]. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident in the articles is primarily related to non-human actions. The incident involves a new generation of cyber attacks, specifically the 'man in the browser' attack, which bypasses security systems, including PIN devices and PC security software, to divert users to fake banking websites and access real accounts without the users' knowledge [10439].
(b) Human actions are also involved in the incident as cybercriminals are actively exploiting vulnerabilities in security systems and creating malicious software to deceive users and steal money from their accounts. Additionally, the article mentions that users who do not have security devices provide criminals with the means to access their accounts repeatedly [10439]. |
| Dimension (Hardware/Software) |
hardware, software |
(a) The software failure incident occurring due to hardware:
- The article mentions that the cyber attack known as the 'man in the browser' attack targets users' web browsers and diverts them to fake banking websites, indicating that the attack is exploiting vulnerabilities in the hardware components of users' systems [10439].
(b) The software failure incident occurring due to software:
- The article highlights that the 'man in the browser' attack is a type of cyber attack that infects a user's web browser and diverts them to fake banking websites, showcasing a failure in the security software to detect and prevent such attacks [10439]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident described in the articles is malicious in nature. It involves a cyber attack known as the "man in the browser" attack, which diverts users to fake banking websites with the intent to steal money from their accounts. The attack bypasses security systems, including PIN devices and security software, to deceive users into providing access to their accounts unknowingly. Cybercriminals use malicious software to trick users into believing they are receiving a security upgrade, leading them to a fake banking website where their login details are stolen. The attack hides fraudulent transactions and changes the total balance to prevent victims from realizing their accounts have been compromised [10439]. |
| Intent (Poor/Accidental Decisions) |
unknown |
(a) The intent of the software failure incident was not due to poor decisions but rather a sophisticated cyber attack aimed at bypassing security measures and tricking users into divulging their banking information. The attack involved diverting users to fake banking websites through malicious software, exploiting vulnerabilities in security systems including PIN devices and security software like Norton 360. The attackers used tactics like offering fake security upgrades to deceive users and gain access to their accounts without their knowledge [10439]. |
| Capability (Incompetence/Accidental) |
development_incompetence |
(a) The software failure incident reported in the articles is related to development incompetence. The incident describes a new banking cyber attack that penetrates accounts protected with the latest PIN security devices. The attack bypasses security systems, including PIN devices, and security software like Norton 360. It diverts users to a fake banking website by offering a fake 'security upgrade' and then accesses the real account using login details obtained through this deception. The attack is sophisticated and specifically focused on banking, indicating a level of professional competence by the cybercriminals behind it [10439].
(b) The software failure incident is not related to accidental factors but rather to a deliberate and targeted cyber attack designed to deceive users and steal money from their accounts [10439]. |
| Duration |
temporary |
The software failure incident described in the articles can be categorized as a temporary failure. The incident involves a cyber attack known as the "man in the browser" attack, which diverts users to fake banking websites and allows cyber-criminals to access real accounts using login details obtained through malicious software [10439]. This type of attack is not a permanent failure but rather a temporary disruption caused by specific circumstances, such as the presence of malware and vulnerabilities in security systems. |
| Behaviour |
value, other |
(a) crash: The incident described in the articles does not involve a crash where the system loses state and stops performing its intended functions. Instead, the software failure incident involves a cyber attack that diverts users to fake banking websites without crashing the system [10439].
(b) omission: The software failure incident does not involve the system omitting to perform its intended functions at an instance(s). Instead, the incident involves malicious software diverting users to fake banking websites to steal information without the system omitting any functions [10439].
(c) timing: The software failure incident does not involve the system performing its intended functions too late or too early. The incident is related to cyber attacks that divert users to fake banking websites, manipulating the timing of user interactions but not the system's timing of functions [10439].
(d) value: The software failure incident does involve the system performing its intended functions incorrectly. The incident describes how cyber-criminals access real accounts using log-in details, including the randomly generated code from PIN devices, leading to unauthorized access and theft of funds [10439].
(e) byzantine: The software failure incident does not exhibit the characteristics of a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. The incident primarily involves a targeted cyber attack that diverts users to fake banking websites to carry out fraudulent transactions [10439].
(f) other: The software failure incident involves a sophisticated cyber attack known as the "Man in the Browser" attack, where malicious software sits between a user and their bank account, diverting users to fake websites to steal information and manipulate balances. This behavior is not specifically categorized in the options provided [10439]. |