Hacking Starbucks for unlimited coffee

http://sakurity.com/blog/2015/05/21/starbucks.html

by duked • 11 years ago

200 81 11 years ago

sschueller• 11 years ago

Nice but I wouldn't attempt to purchase something at a startbucks in the US where you will go to prison for a long time even if there was no malicious intent.

__m• 11 years ago

Simple rule: if you don't have the permission of the company to mess with their system, don't do it. Why would you anyway? You don't get paid and you spoil your integrity.

droope• 11 years ago

Simple rule: if you find a bug in a companies system, don't tell them without Tor.

anotheryou2• 11 years ago

I really wonder why he gave out his phone-number and alike. It's really not the first news of this kind.

If you need the fame, use a pseudonym that consists of the same letters as your actual name and uncover the story once it cooled off or something...

Artemis2• 11 years ago

But it's fun!

monort• 11 years ago

This rule have exceptions. Messing with systems without permission (starting with Github) helped him to start a security consultancy.

nkozyra2• 11 years ago

Why do it? Ostensibly so it's fixed before someone with malicious intent can get to it. But sometimes for minor fame or for a bounty.

For Starbucks, it's GOOD. It means they're out $2 and some embarrassment instead of out millions when someone sees something is way off in the books.

All that said, I would have tested this more than once to ensure it wasn't some minor built in allowance.

seanp2k2• 11 years ago

While you're absolutely right, unless there's something in it for you beyond curiosity / because you can, the risks much outweigh the benefits IMO.

Why would you help a for-profit company for free? Would they do the same for you? What is the best-possible scenario, a reward / job offer / gift certificate? What is the worst-possible scenario? Years in prison? Legal cases which drain all your savings? It hardly seems worth it to do this. Software vulnerabilities are EVERYWHERE, but trying to be a Good Samaritan in a hostile capitalistic environment doesn't tend to work out in your favor very often.

JoeAltmaier2• 11 years ago

I don't actually see how Starbucks could have been out millions. They'd just notice a gift card had a large balance, investigate, and zero it out. Unless the guy had managed to drink/hawk one million coffees in a few weeks.

lnanek2• 11 years ago

But he did get paid. He bought more than his original gift cards would have allowed him to.

JoeAltmaier2• 11 years ago

Then he deposited the money back. And presumably destroyed the gift cards.

fineman• 11 years ago

Are you a corporate lawyer for sides that normally lose and just throw muck and nonsense, or did you have trouble reading?

He certainly didn't spoil his integrity. He had largely un-traceable riches in his hands, didn't exploit it, and gave it up. Nothing was "messed with".

unimpressive• 11 years ago

To be fair to the relevant authorities, the author does a terrible job of not sounding malicious.

That last paragraph in particular sounds more like a vindictive troublemaker than a concerned hypothetical and writing like that doesn't help your case.

gsam• 11 years ago

To be a good security researcher, no doubt it often takes a devious mind. Now whether or not this deviousness is used for good or evil depends on temperament, upbringing and acceptance or ignorance by other parties.

You don't piss off a hacker. And these people have miles more persistence than other people. That's what makes these people good. I'm not saying they should flagrantly abuse laws but the morality and mentality of these people is usually break first and then think about the consequences. And that's exactly why lots of holes never get reported.

veb2• 11 years ago

This blog post was written for _us_. Not for Starbucks.

It was written as the result of the pathetic replies that he got from them. So of course, it's going to sound _malicious_ because he's probably quite annoyed by their actions.

If you wanted to put a spin on things, you could claim that OP didn't actually contact Starbucks, and has just written this article to wind us all up ;-)

egeozcan• 11 years ago

I guess the reason why they responded in such a way is to prevent any potential future "tinkerers" to get away by saying that they were just white-hats. I guess it would have been better to inform them before testing their payment system for errors.

deepnet2• 11 years ago

This is like punching a guy who hands you the wallet you just dropped.

This was entirely RESPONSIBLE DISCLOSURE.

They need to send a basket of muffins to the guy.

Surely they should take INTENT into account.

The interesting question is : How much has Starbucks lost because of this vulnerability ( the white hat may not have been the 1st to discover it ) ?

raverbashing• 11 years ago

Yeah, responding to a limited (experimental) exploitation of a vulnerability in a hostile way will usually make people think twice, and selling the vulnerability to 3rd parts will seem more interesting.

IgorPartola• 11 years ago

Apparently one of the common scams in Eastern Europe is to drop a wallet by a tourist. When the tourist picks up the wallet and hands it back, the scammer starts loudly yelling that the tourist stole their wallet, threatening to call the police if the tourist doesn't give them some cash. So I guess sometimes it does pay to punch they guy handing you your own wallet.

aikah• 11 years ago

Not just in eastern Europe, there was a variation of this scam in Amsterdam(at least 10 years ago), where an alleged drug dealer would hold some white powder in his hands and bump into you on purpose, so that it makes him drop the powder, then the guy would say that you wasted his drugs and you should pay him money as reparation.

chadscira6• 11 years ago

It fascinates me that a $80B publicly traded company that is one of the leaders in gift cards doesn't take security more seriously...

They seriously need to invest in security :/, im sure they have lost a good amount of money to this issue considering that its been around since 2012.

deepnet2• 11 years ago

Did they fix it ?

Perhaps they cannot fix it ?

Maybe their IT is in denial ?

Interested to see a follow-up report.

pkaye• 11 years ago

Should they not be maximizing value to the shareholders?

GhotiFish• 11 years ago

I wonder if there would be anything you could say at that point to get them to follow through (without implying any intent to exploit obviously).

I couldn't imagine a better boost to a security professionals career than getting sued over finding a very serious vulnerability and disclosing it in entirely good faith, only to get sued for the deed. It's outrageous enough to make headway online, you'd never actually face any repercussions, and your name would be everywhere due to the story.

anotheryou2• 11 years ago

I told 2 companies that they are leaking email addresses (got spam on single-purpose addresses). One replied very kindly and asked for details, the other did not answer, after writing them publicly on twitter they blocked me there...

The misbehaving one was http://joby.com/ they build these awesome gorilla-pods. Do yourself a favor and buy one of the many clones. (got spam to joby.com.singlepurpose@mydomain.com)

More or less shady paypal-shops are the worst though :) (paypal hands your mail-adress out (I wonder why they do not relay communications like ebay))

Scoundreller• 11 years ago

I think Ebay stopped because buyers would get in touch directly with a seller to do re-orders (sometimes at a discount).

Sellers used to be able to Ebay message non-winning bidders and offer them product at whatever they bid at. Sellers would also link buyers to their web-store for that item or related ones. Ebay blocks those kinds of messages. Now sellers do it with a paper pamphlet with your package.

Paypal, on the other hand, wants you to do more transactions, outside of Ebay or not, because they would likely still be the payment processor and get their cut.

It took a while for Ebay to integrate Paypal into the buying process (I'd argue they never really did), so they seemed to always operate semi-independently with non-aligned interests with their parent.

paulpauper2• 11 years ago

Who wants to be a Starbucks-Crypto millionaire

chadscira6• 11 years ago

I encountered and reported this bug over three years ago. I decided not to write about it but considering that they still haven't fixed it...

http://chadscira.com/post/556999d91cb00914380006ee/Re-Starbu...

paulpauper2• 11 years ago

wow considering how long this has gone on, there must have been a handful of people who made a lot of money doing this. A starbucks giftcard is almost like a currency . I wonder if walmart cards have a similar vulnerability

jonhohle• 11 years ago

In my experience, Starbucks is one of the few places which allows transfer of gift card balances or purchases of gift cards with other gift cards.

I can only assume this is because gift cards are intended to behave like cash (when the balance is zero, they have no additional value), but operate under the mechanics of credit/debit cards (asynchronous transactions, network failures/delays, etc.). Debit cards have the feature of going negative with very clear legal liability assigned to the account holder. Gift cards holders are essentially anonymous, so recourse may be more difficult.

veb2• 11 years ago

I'm lost.

You say in the end they "fixed" it (quotes included) and you yourself tested it and it did actually seem fixed... but it's not according to OP.

I do apologise if I've missed something blatantly obvious here!

Was your method the same as OP by the way?

chadscira6• 11 years ago

The method i used had to do with a race condition related to transferring between cards, just like the OP.

Either way they should be paying more attention to this type of exploit, considering the history of the issue. I think they may have updated something and had a regression, the big question is how long has it been like this.

nandemo• 11 years ago

It's called a regression.

Believe it or not, there's a lot of software organizations out there that still get away with using anti-patterns like: not integrating code frequently, not using modern source control systems, not using automated tests, not doing security audits, and not doing incident reviews.

homakov• 11 years ago

LOL. I mean... LOL.

Almaviva• 11 years ago

I don't see how this is different from finding an ingenious way to jimmy open the lock of the door at night, figuring out how to take cash from the register, and then phoning them up to tell them they need to spend money on a new door.

chadscira6• 11 years ago

Yes but this issue doesn't save customers from losing money or data so there isn't really a moral reason to disclose this. It directly impacts Starbucks, and their balance sheet.

It's more like Jimmy phones up the owner, and tells the maid that there is an issue with the door, after not liking the maids response he tells a group of people about the issue, and the next day the house gets robbed...

nothrabannosir• 11 years ago

Am I missing something, or did you describe every bug bounty program everywhere? Isn't this exactly the definition of a security bug?

Even in your dry analogy, what's the problem? Would you not want people to tell you they found a very easy way to take money out of the register?

Not that it matters; this is text-book, industry standard security bug reporting. He waited with the public disclosure until it was fixed.

(If he didn't; different story. Maybe I misunderstood that part? Was that it?)

titanomachy• 11 years ago

After trying really hard to find anyone who cares, I managed to get this bug fixed in like 10 days.

Sounds like it did get fixed, but it was a little confusing because he goes on to talk about how he could make millions counterfeiting gift cards.

maxerickson• 11 years ago

A damaged lock needs to be replaced.

If you must have an analogy, I think it's more like walking up to an unattended cash register during business hours and fiddling with it, figuring out how to take $0.10 out of it, and then putting the $0.10 back.

Not clearly harmless (or it wouldn't make so many people object), but the counting of the damages stops at a quite low number.

snowwrestler• 11 years ago

No, it's like seeing a door ajar, then calling the company to tell them that they forgot to close and lock their door. It takes a pretty dumb company to get mad about that.

unethical_ban• 11 years ago

Same way pirating a movie is the same as stealing a car.

wepple• 11 years ago

To add some context, starbucks do appear to invite whitehat security testing in a bug-bounty like manner:

http://www.starbucks.com/about-us/company-information/online...

That means that Homakov was likely not breaking the law, and you would expect starbacks to be more welcoming of the report.

qq66• 11 years ago

The thing about big companies is that the person responding to the inbound communcation is usually in a totally separate department from the person who wrote the policy, and often doesn't know the policy exists. It's really hard to get a group of 50,000 people to act consistently with each other.

Of course, I hope for Starbucks' sake that it quickly backtracks and thanks this guy with at a minimum a bunch of free Starbucks and a phone call or email from the CIO or CEO. It's not in Starbucks' interest to dissuade white hat hacking, since black hat hackers don't care about Starbucks' policies.

dkhenry• 11 years ago

Unlimited starbucks coffee can also be had by visiting any large wildfire and scooping the ashes into a container full of water. It essentially the same thing.

54mf• 11 years ago

Cool, cool, very productive, thanks for your input. Your coffee opinions are very relevant to this discussion, and have been duly noted.

CookWithMe• 11 years ago

I have never used a gift card at starbucks before, but that bill [0] doesn't make any sense to me.

He says he has two cards: One has $15, one has $5.

Card 3203 is billed $14.68 and card 6075 is billed $2.02.

The remaining balance on card 3203 is $0, card 6075 has $5.70 remaining.

If card 3203 had $15 and card 6075 had $5 before he used them, the remaining balance should have been $0.32 and $2.98, respectively...

That's really me guessing, but it could be the $5 was just an example to explain the concept and in fact he used smaller values (e.g. $0.05) to be able to trigger the bug more often without generating too much cash... but he should have explained the bill somehow.

[0] http://sakurity.com/img/sbcheck.jpg

cokernel• 11 years ago

That's exactly right. In the comments Homakov mentions that the $15 and $5 figures have been "adjusted for simplicity".

mpg33• 11 years ago

Bring a $100 bill and say it's all you have ;)

llamataboot• 11 years ago

Relevant BBC story: http://www.bbc.com/news/technology-32844123

ISL• 11 years ago

HN, where news becomes news.

mangeletti3• 11 years ago

Isn't it true that using an UPDATE statement referencing the existing column's value also works?

Pseudo-code:

    UPDATE account WHERE ... SET balance = balance - 5

If both sides of the transfer are handled this way, and then the balance of the transferrer is checked after to ensure it's greater than 0 (rollback otherwise), won't that suffice to handle the issue without having to use SELECT ... FOR UPDATE?

---

To further simplify this, you could include a WHERE balance > [transfer amount] clause to the transferrer UPDATE query. If the number of rows updated is 1, UPDATE the transferee's row. If the number of rows updated is 0, you're done (tell the user they don't have sufficient funds). Isn't that right?

barrkel2• 11 years ago

The issue (as I understand it) was transferring balance from one card to another. So two rows need updating, one with an increment, the other with a decrement.

jlgaddis2• 11 years ago

I'm not a developer (I generally only write shell/Perl/Python scripts to make my own job easier) or a database expert but wouldn't this issue be pretty easy to avoid if the whole process were wrapped up in a transaction? E.g.:

  BEGIN TRANSACTION;
  SELECT balance AS balance1 FROM giftcards WHERE gift_card_id = 1;
  SELECT balance AS balance2 FROM giftcards WHERE gift_card_id = 2;
  UPDATE giftcards SET balance = balance1 - 5 WHERE gift_card_id = 1;
  UPDATE giftcards SET balance = balance2 + 5 WHERE gift_card_id = 2;
  END TRANSACTION;

Obviously, this is somewhat simplified and you'd have various checks to make sure balance1 was actually >= 5, etc.

Again, I'm not a developer, so what am I missing?

mangeletti3• 11 years ago

Exactly; each of these operations require only 1 query (you don't need to SELECT and then UPDATE), and then a third SELECT query afterwards to ensure the transferrer's balance wasn't reduced to below 0, in which case the save point is rolled back.

dbbolton• 11 years ago

Off topic: what's up with the guillemets in the code example? Does that actually work as a replacement for single/double quotemarks in some shells? Mine just treats them as an ordinary character, e.g.

    print «Cookie: session=session1»                                        
    «Cookie: session=session1»

jpollock• 11 years ago

Transferring balances between accounts is hard. If you have any sort of sharding, all of a sudden you don't get transaction safety in the transfer. You can have sharding for many reasons, such as different vendors, different locations, different releases and pure performance.

So, you transfer and hope for the best, typically everything will be fine.

Then you add an asynchronous job to go over the logs and reconcile the results - flagging fraud.

There are two ways of processing transactions. You can remove the money first and then add it to the new account. That will tend to show up as "lost" money when the customer sees a problem. Not really a good thing if you're a service business (vs a bank).

The other way to go is add the money first and then remove it. That will allow money to be created (as in this case), but won't result in customers seeing money disappear.

Finally, there may be a problem where they are reading from a cache to perform the transfer, and the read-copy is a little stale. Again, this would tend towards giving customer's money.

Hacking Starbucks for unlimited coffee

Related Stories