How I hacked modern vending machines

https://hackernoon.com/how-i-hacked-modern-vending-machines-43f4ae8decec

by matteopisani • 8 years ago

249 86 8 years ago

mkesper2• 8 years ago

How I hacked a totally insecure android vending machine wallet app would be more to the point, but nice anyway.

leowoo912• 8 years ago

Do you guys also feel like many people started to become too high level, not getting satisfied with simple app hacks? Hello future.

mkesper2• 8 years ago

Sorry didn't mean it negative. But "hacking a vending machine" sounded much more like touching the real hardware. Teaches an important story about app security, in any case.

jimktrains2• 8 years ago

How dare someone share what they learned!

I bet you complain about build videos on YouTube too? "Come on, people have been building tables like this for millennia" not stopping to think that there are people without the skills to or that want to learn how to, or that can be shown a different way of thinking about an object via a well worded, easy-to-follow essay and guide on how they did their not-cutting-edge research?

et2o• 8 years ago

The incidence of reflexively negative takes has increased the last few months on HN.

lapinot2• 8 years ago

Much simpler hardware hacking: slightly bend the control panel and/or the door with a small lever (a coin might be sufficient). On some models, opening the door starts the "admin mode" where you can control each spire, do tests, change prices etc. The sensor for door opening can be fooled by the slight bend, hence allowing you to take whatever you want.

SmellyGeekBoy2• 8 years ago

Perhaps if the vending machine isn't in a public space / covered by CCTV etc.

This approach just makes the "hacker" look like a normal user to the casual observer.

lapinot2• 8 years ago

I can assure you this hack looks casual: you do it in groups of two and it seems to anyone standing 2m away just as if one is leaning on the machine.

jaclaz4• 8 years ago

Sure, also lockpicking the door open would work, and if you had the possibility to bring the vending machine at home and disassemble/study it you would probably also find another three different ways, what gives?

Still, you would need to perform some "unusual" physical action on the physical machine and you might be noticed by people passing by or by a surveillance cam, this app hack is instead "clean".

And it makes you think about the reliability of any similar app based paying system, in this case is "their" money[1] that "you" can "steal" (by drinking and eating for free), but what if it was "your" money?

[1] so before or later the vending machine firm would notice

beautifulfreak• 8 years ago

Yeah, I pictured the victim too. A friend of mine owned vending machines. He paid rent for each location, and any loss of product came from his own pocket. Similarly, I remember reading a letter to my local newspaper by a woman whose husband managed the newspaper vending machines. She pleaded for people to stop taking extra copies, because her husband had to pay for them. I always thought the newspaper ran those machines, but they're serviced by independent contractors here.

SmellyGeekBoy2• 8 years ago

I guess plenty of people are going to come in here to wave their e-peen and comment on how trivial and obvious this "hack" is, but that's kind of the point. Us developers could learn a lot from this - mainly how not to design any kind of payment app.

jaclaz4• 8 years ago

I guess plenty of people are going to come in here to wave their e-peen and comment on how trivial and obvious this "hack" is, but that's kind of the point. Us developers could learn a lot from this - mainly how not to design any kind of payment app.

Yep, I would add that the unknown programmer that wrote the app very likely thought that it was a very clever approach (and probably he/she has been paid good money to write the app).

csmattryder2• 8 years ago

"Never trust the client" is a lesson every developer learns at some point. Incredible how an entire company missed that, but I'd put this down to "bosses want this out by DATE? Alrighty..."

jaclaz4• 8 years ago

"Never trust the client" is a lesson every developer learns at some point. Incredible how an entire company missed that, but I'd put this down to "bosses want this out by DATE? Alrighty..."

Can you clarify?

It sounds like the responsability for having designed an insecure app is of the people that asked the programmer/sofware house to write it[1]?

[1] and as said very likely paid good money for it ...

bsaul• 8 years ago

Although modern credit card now have a kind of local storage that's used to pay for small amounts of money without querying the server (at least in europe). That may have deceived the developer of that app into thinking it was doing approximately the same.

Cthulhu_• 8 years ago

If they want it out by $DATE I'd argue it'd be simpler to add support for Apple Pay / Google Wallet.

rebuilder• 8 years ago

But the benchmark this system was compared to was already a trust-the-client system : coin payments! I'm sure you can defraud coin-op machines, it's just not easy or common enough to worry too much about.

It's my impression that consumer payment systems operate on a good-enough principle. Being fraud-proof is not the goal, the goal is not to spend more on security than you are preventing in fraud.

namdnay2• 8 years ago

To be fair, I'm sure the amount of money lost to people hacking vending machines by reverse engineering APKs is far smaller than the cost of getting every machine a network connection to a central server

nojvek• 8 years ago

Vending machines could be in buildings that blocking cell reception. I bet one of the requirements were that app should work offline.

And there you have it. Most people don’t understand security. The business can say they are MVP and “secure enough”.

lbriner• 8 years ago

It's much easier to learn how not to do this than to answer how to do it!

You cannot rely on the data network, have to cope with all kinds of failure modes and mobile features support. Most companies decide that they will make some attempt to make things secure and live with the risk.

MisterTea• 8 years ago

I actually came to complain about the silly filler content I had to scroll past that felt like ads were inserted? I just closed the page after I lost the article in the memes.

Synaesthesia• 8 years ago

I didn’t get that on my iPhone with adblock

baud147258• 8 years ago

I found the memes not that bothering, since they are mostly in the 'narrative' part of the article and absent from the technical part.

caf• 8 years ago

Probably could have boosted the "walletFreeVend" value also.

Insanity2• 8 years ago

So in the end he informed the company, and they fixed it? I wasn't clear on the ending with 'hogus bogus', maybe I missed something.

Pretty neat project to undertake. Kudos :D

Robadob• 8 years ago

I took the stock photo of coins to suggest that they disabled the App, leaving the only means to pay as the old fashioned method.

Insanity2• 8 years ago

Ahh okay, that occured to me but was not sure. Thanks for elaborating :)

3chelon2• 8 years ago

This is why I so love the millenials' habit of communicating via hieroglyphs when we have perfectly good words.

fenomas• 8 years ago

The coins are arranged in the "glider" hacker logo, so there's probably no more meaning to it than that.

bluedino• 8 years ago

This feels like a 2600 article, in a good way.

voltagex_• 8 years ago

Yep, really solid and you could apply a lot of the steps (creating a debuggable APK) to other projects.

BuckarooBanzay• 8 years ago

Would a simple backup/copy of the "charged" database have sufficed? e.g: backup the db with a 5$ charge, use the credits, restore the database...

retSava• 8 years ago

Likely, it's just a password-protected database, not signed or such. I think that's what his/her app "Time machine" button does.

titaniczero• 8 years ago

Absolutely. I've seen these vending machines before, naive me assumed they had a server-side database. I was completely wrong..

softawre2• 8 years ago

Still, is it worth stealing a 1$ coffee to potentially be criminally charged with theft?

turbo_fart_box• 8 years ago

This is great. I love the step by step guide. I didn't know you could modify code and just resign the APK in order to flip the debug switch.

doctorRetro• 8 years ago

"One day I decided to interrupt seasoning myself in the bat-cave and direct to my hometown to get some sunlight..."

What?

curiousDog• 8 years ago

I was laughing at that myself. Guessing this is something that sounds way better in the author's native language.

yuchi• 8 years ago

Yeah seasoning in italian never means “adding spice to some food” but only “keeping it in a cold/dry place and wait for it to be ready“ (usually months, sometimes years).

14• 8 years ago

Almost felt like security through obscurity. Because this modify the app hack was huge for cheating in some games on jail broken iPhone years back. I would increase my coins and keep playing. I was under the belief developers stopped it years ago by making purchases done server side. So to see that this app it is done locally on the device was a big surprise to me and I would have not guessed it possible(in the sense that it would be crazy to ever build a payment app that way as this abuse has been done with games for years)."

nullbyte• 8 years ago

Fantastic article. This is the stuff I like to see on HN.

cphoover• 8 years ago

I don't understand why the vending machine would trust the client to tell it how much credit the user had without first verifying from an upstream centralized db. This is bad design in my eyes...

ddebernardy• 8 years ago

My initial thought was that this was how the developers were overcoming the potential for network problems. But in that case it would have been a mere cache, so agreed on that it's bad design.

tokyodude3• 8 years ago

AFAIK this is how Felica works which is the system for many of the transit systems across the world as well as a payment system built into feature phone since 2005, Android since 5-6 years ago and iPhone since iPhone7 in Japan and 8 everywhere else.

https://en.wikipedia.org/wiki/FeliCa

I don't know for a fact that it works without a DB but I do know that they exist in places that don't seem to access to a DB and they work instantly (no long pause like credit cards).

lifthrasiir• 8 years ago

It works without a DB as far as I know, and there are handful incidents where people knowingly blocked a connection to the payment system to charge the card with no money spent. Primary security measures against fraudulent transport cards had been blacklisting, which seems to work well enough as there are not much hacked cards.

innocentfelon2• 8 years ago

Val Kilmer did the same thing to a coffee vending machine in the movie Real Genius.

Instead of using Android, he used a freezer and a small hacksaw to section off coin-sized slugs from a frozen rod.

Have to give the points to Kilmer’s character because in addition to doing it first, his crime left almost no trail and didn’t come with felony exposure (most juries would not believe ice slugs are counterfeiting)

Making a daily habit of getting free hacked coffee could result in felony convictions and imprisonment in many countries for violating electronic data laws. I know FBI agents happy to bring charges for matters this trivial. This is where they’d rather spend their time instead of pursuing big league criminals.

Still a great article to read.

bluntfang• 8 years ago

I know FBI agents happy to bring charges for matters this trivial.

Just curious, what does one need to do in order to network with FBI agents and have them divulge what they're willing to charge people with?

jstarfish• 8 years ago

Work in corporate security or law enforcement.

innocentfelon2• 8 years ago

Be very unlucky. Then the networking happens against your will.

The divulging comes in the form of an indictment, or, if you decide your integrity is not for sale and you turn down a plea offer, multiple days of hearings, trial, and sentencing.

maaark• 8 years ago

That's a dumb movie plot. Vending machines measure and weigh coins. A coin-sized chunk of ice does not weigh the same as a coin.

danilocesar3• 8 years ago

I don't want to be that guy, but....

He didn't hack the vending machine. He did hack the app. It was very cool and such, but not what I was expecting from the head line.

athenot• 8 years ago

The vending machine trusts the app without any checks, therefore its security posture depends on how secure the app is.

danilocesar3• 8 years ago

Honestly, what did the company say when he reported the security issue?

danilocesar3• 8 years ago

As a reward for his finding, did the company gave him a .db file with 500 credits in coffee?! :)

ZeWaren• 8 years ago

We had one connected vending machine in the building. Its credit database was on a remote server, so such hacks would not work.

However, if you unplugged its ethernet connector and buy something, then somehow your would get your food/drinks and your transaction was stored into a buffer until the machine went online again.

That buffer being in volatile memory, unplugging the power cord of the machine was enough for it to forget you ever bought something.

cataflam• 8 years ago

Fun stuff!

The article has an old vibe of hacking articles published in the '90s/'00s (in a good way).

obviously, it was password protected

Not obvious at all. Last time I checked, WhatsApp or Telegram didn't password protect their database (that was a while ago admittedly). And obviously, it doesn't actually provide that much protection if the key is on the phone, as the article demonstrates.

tokyodude3• 8 years ago

On the one hand it's interesting to see the machines get hacked. On the other hand I love living in a country where the machines generally don't get hacked or vandalized because it means we get to have the convenience of more machines.

fatnoah• 8 years ago

My favorite vending machine moment in college occurred when the person stocking the soda vending machine forgot to lock it. We all enjoyed free soda and, most impressively IMHO, no one took advantage and tried to take all of the soda from themselves. People just treated it like a refrigerator and would grab a soda when they were so inclined.

GFischer• 8 years ago

I remember my mind being blown when I saw a newspaper dispensing machine in Canada for the first time...

That would absolutely not work in South America.

You can clearly see which tourists are from our part of the world in Europe where paying for transport is "optional"...

tokyodude3• 8 years ago

I'm happy I live in a place where if the machine broke people would likely not steal the sodas.

I find it disappointing so many cultures steal so easily if it's convenient.

ben1040• 8 years ago

This reminds me of how in the '90s my university gave out smartcard student IDs that had a little cash account on them for vending machines and dorm laundry rooms.

They installed readers into the soda machines, and they put a central panel in each laundry room with a reader and a keypad for you to indicate which washing machine you wanted to activate.

We found out that the vending machine hardware would query the card before selling you an item, but wouldn't debit your account until dispensing it, in case the vend failed. If you timed it just right and removed your card after it was interrogated but before the item dropped, you'd get it for free.

The smartcard project was only a 2-year evaluation and the university decided to move away from it, so the smartcard company came and took away all their hardware.

When they did this, they took the panel down out of the laundry rooms, but did not fully clean up the wiring coming out of the back of each washing machine. One of my roomates got curious and discovered shorting the leads of that wiring to a battery would mimic the signal the smartcard panel would use to tell the machine it's been "given" a quarter. Do that 3x and you got a 75 cent wash for free.

blacksmith_tb• 8 years ago

Real-world race condition! In the same period I remember the copiers in my college library would debit their magstripe cards about 1-2 seconds after the 'copy' button was pressed. A frugal / amoral user could easily eject the card, reinsert, copy the next page, eject, reinsert...

kkotak• 8 years ago

These are the types of things that keep me worrying about self driving cars and if an entire system can be hacked to do the opposite of avoiding obstacles by malicious forces.

orev• 8 years ago

Curious how the disclosure was handled here. Was it responsible? I can easily see a black market of accounts popping up at this university. It takes a long time to develop hardware stuff, and a month is probably not reasonable to expect changes to be made.

iforgotpassword• 8 years ago

Most of these systems are inherently insecure. Tbh, I cannot think of a simple way to make this really secure that doesn't require a somewhat more sophisticated system, especially if you don't want the machine to stop working if network connectivity drops, or servers of the vendor are down. If you come up with a really robust system, you're probably gonna charge quite a bit more than the company offering this system, and I'm pretty sure most customers just don't care or take this seriously.

The other point is that often times these machines that support an app get set up in companies for their employees, where you can be reasonably sure that everyone will play by the rules. We have a coffee machine at work that uses RFID tokens to handle credit with no security or encryption, and it works, even though we're all IT folks. A university with a CS department and its respective students is a different story though. :-)

1024core• 8 years ago

Does this require a rooted device, or will any Android device work?

How I hacked modern vending machines

Related Stories