Incident: Security Vulnerability in N26 Banking Apps Exposes Users to Hijacking

Published Date: 2016-12-28

Postmortem Analysis
Timeline 1. The software failure incident involving N26's security vulnerabilities happened in September 2016 as mentioned in Article [58091].
System 1. N26 smartphone apps security defenses [58091]
Responsible Organization 1. N26 (Number26) [58091]
Impacted Organization 1. N26 users [58091]
Software Causes 1. The software causes of the failure incident at N26 were related to security vulnerabilities in the smartphone apps that exposed users to potential account hijacking [58091].
Non-software Causes 1. Lack of thorough security testing procedures during the development and deployment of the N26 banking apps [58091]. 2. Insufficient oversight and scrutiny by the financial regulator, Bafin, which granted a banking license to N26 despite security weaknesses being present [58091].
Impacts 1. The software failure incident at N26 exposed users to potential account hijacking, raising concerns about the security of customer accounts [58091]. 2. The incident highlighted security vulnerabilities in N26's smartphone apps, potentially putting thousands of users at risk of fraud [58091]. 3. The research findings by Vincent Haupert and his team demonstrated flaws in N26's security defenses, indicating a breach in customer trust and the potential for phishing attacks [58091]. 4. N26 took steps to address the vulnerabilities by enhancing data encryption, blocking brute-force attacks, and fixing security weaknesses in their app, aiming to secure customer accounts and prevent unauthorized access [58091]. 5. The incident underscored the need for regulators, such as the German financial regulator Bafin, to closely examine the security measures of banks and fintech companies to ensure the protection of customer data and accounts [58091].
Preventions 1. Implementing thorough security testing and audits before launching the software [58091]. 2. Regularly updating and patching the software to address any identified vulnerabilities [58091]. 3. Enhancing data encryption and security measures to protect user information [58091]. 4. Implementing multi-factor authentication to prevent unauthorized access to accounts [58091]. 5. Improving anti-fraud systems to detect and prevent potential attacks [58091].
Fixes 1. Implementing stronger security measures such as reducing and encrypting data transfers, blocking brute-force attacks, and fixing security weaknesses like voice recognition vulnerabilities in the app [58091].
References 1. Vincent Haupert, a research fellow and PhD student in the computer science department of the University of Erlangen-Nuernberg [58091] 2. N26 (Number26) fintech company [58091]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to potential account hijacking at N26 has happened within the same organization. The security researcher, Vincent Haupert, discovered security vulnerabilities in N26's smartphone apps that could have been used to defraud thousands of users. N26 acknowledged the theoretical security vulnerability and completed fixes for the issues identified by Haupert [58091].
Phase (Design/Operation) design, operation (a) The software failure incident in the article can be attributed to the design phase. The security researcher, Vincent Haupert, and his colleagues found security defenses in N26's smartphone apps riddled with holes that could have been used to defraud thousands of users. They were able to identify vulnerabilities in the system that could potentially lead to account hijacking [58091]. (b) Additionally, the software failure incident can also be linked to the operation phase. Haupert demonstrated how his team found numerous ways to attack N26 banking apps to hijack individual customer accounts. This indicates that the failure was also influenced by the operation or misuse of the system [58091].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident in this case was primarily due to security vulnerabilities within the N26 banking apps that could have been exploited to defraud users. The security researcher, Vincent Haupert, and his team found multiple ways to attack N26 banking apps and hijack individual customer accounts, indicating that the vulnerabilities were inherent within the system itself [58091]. (b) outside_system: While the software failure incident was caused by internal security vulnerabilities within the N26 banking apps, it also involved external factors such as the comparison of leaked account credentials from Dropbox with information on N26 users obtained from the company's own software feed. This external data comparison was used to identify potential security weaknesses within the N26 system, highlighting a combination of internal and external factors contributing to the incident [58091].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case was primarily due to non-human actions, specifically vulnerabilities in N26's security defenses that were exploited by the security researcher and his team. The vulnerabilities allowed for potential account hijacking without direct human involvement in the exploitation process. The security researcher, Vincent Haupert, and his colleagues found holes in N26's security defenses that could have been used to defraud thousands of users [58091]. (b) However, human actions were also involved in this incident as the security researcher, Vincent Haupert, actively researched and identified the vulnerabilities in N26's banking apps. He disclosed his research findings to N26, which then took steps to address and fix the vulnerabilities in their software [58091].
Dimension (Hardware/Software) software (a) The software failure incident reported in the articles is primarily related to software issues rather than hardware. The incident involved a security vulnerability in the smartphone apps of the fintech company N26, which exposed users to potential account hijacking. The security researcher, Vincent Haupert, and his team found multiple ways to attack N26 banking apps and identified security weaknesses that could have been exploited to defraud users [58091]. The vulnerabilities identified were related to the software defenses of N26, such as data transfers, anti-fraud systems, and voice-recognition security weaknesses in the app [58091]. (b) The software failure incident is attributed to software-related factors. The security researcher highlighted flaws in the security defenses of N26's smartphone apps, indicating that the vulnerabilities originated in the software design and implementation. The incident involved weaknesses in the software that could have been exploited by hackers to hijack individual customer accounts, rather than hardware-related issues [58091].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case was malicious. A security researcher, Vincent Haupert, and his colleagues found security vulnerabilities in N26's smartphone apps that could have been exploited to defraud thousands of users and potentially hijack individual customer accounts. Haupert demonstrated how he could identify N26 user credentials and potentially break into their accounts, highlighting the serious security flaws in N26's systems. Despite not exploiting the vulnerabilities, the potential for account hijacking was a significant risk introduced by human actions with malicious intent [58091]. (b) The software failure incident was non-malicious in the sense that the security researcher, Vincent Haupert, responsibly disclosed the vulnerabilities to N26 and worked with the company to address and fix the issues. N26 acknowledged the security vulnerability reported by Haupert and completed the necessary fixes to enhance the security of customer accounts. The company took steps to make customer accounts more secure by encrypting data transfers, blocking brute-force attacks, and fixing security weaknesses in its app. Ultimately, N26 stated that no customer data was available to third parties and that all vulnerabilities identified by Haupert appeared to have been fixed [58091].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident involving N26 was primarily due to poor decisions made in the design and implementation of their security defenses. The security researcher, Vincent Haupert, and his colleagues discovered multiple vulnerabilities in N26's smartphone apps that could have been exploited to defraud thousands of users. These vulnerabilities included holes in the security defenses that exposed users to potential account hijacking [58091]. Furthermore, Haupert highlighted how N26's security weaknesses could have been used to identify N26 user credentials and potentially break into their accounts. He mentioned that with such vulnerabilities, fintech companies like N26 risk squandering the trust that traditional banks have built over the years [58091].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in Article 58091 can be attributed to development incompetence. The security researcher, Vincent Haupert, and his colleagues found N26's security defenses to be riddled with holes that could have been used to defraud thousands of users. Haupert highlighted various vulnerabilities in N26's banking apps that could allow for the hijacking of individual customer accounts, indicating a lack of professional competence in ensuring robust security measures [58091]. (b) Additionally, the incident can also be categorized as accidental. The security vulnerabilities discovered by Haupert and his team were not intentionally created by N26 but were accidental weaknesses in the software that could potentially lead to account hijacking. Haupert's disclosure of the research findings to N26 and the subsequent fixes implemented by the company suggest that the vulnerabilities were not deliberately introduced but were accidental flaws in the software [58091].
Duration temporary The software failure incident reported in Article 58091 can be categorized as a temporary failure. The security researcher, Vincent Haupert, and his colleagues identified security vulnerabilities in N26's smartphone apps that could potentially lead to account hijacking. These vulnerabilities were actively exploited by the researchers to demonstrate the risks associated with the flaws in N26's security defenses. However, N26 took immediate action upon being alerted by Haupert and his team, implementing fixes to address the vulnerabilities. The company stated that all vulnerabilities had been promptly and completely addressed, indicating that the software failure was temporary and not a permanent issue [58091].
Behaviour omission, other (a) crash: The software failure incident in the article is not related to a crash where the system loses state and does not perform any of its intended functions. (b) omission: The software failure incident in the article is related to omission, as the security researcher found N26 security defenses riddled with holes that could have been used to defraud thousands of users. This omission led to the exposure of users to potential account hijacking [58091]. (c) timing: The software failure incident in the article is not related to timing, where the system performs its intended functions correctly but too late or too early. (d) value: The software failure incident in the article is not related to the system performing its intended functions incorrectly. (e) byzantine: The software failure incident in the article is not related to the system behaving erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident in the article is related to a security vulnerability that exposed users to potential account hijacking due to holes in the security defenses of the N26 banking apps [58091].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving the German fintech company N26 exposed users to potential account hijacking, which could have led to the defrauding of thousands of users. Security researcher Vincent Haupert and his colleagues found security vulnerabilities in N26's smartphone apps that could have been exploited to hijack individual customer accounts. Haupert was able to identify 33,000 N26 user credentials by comparing data from a leak of 68 million account credentials from Dropbox with information on N26 users obtained from the company's own software feed. This incident highlighted the potential risk of financial loss and data compromise for N26 customers [58091].
Domain finance (a) The failed system was related to the finance industry, specifically a fintech company named N26 [58091]. The incident involved a security vulnerability in N26's smartphone apps that exposed users to potential account hijacking, highlighting the importance of security in online banking and financial services.

Sources

Back to List