Did the author get a bug bounty? If not, is it that companies who understand tech the least also don't understand the value of such things?
Domino's: Pizza and Payments
21–30 of 58 posts
Re: Domino's: Pizza and Payments
#22How was he able to see the raw responses from the payment gateway? Do they use HTTP instead of HTTPS to make these requests?
Re: Domino's: Pizza and Payments
#23My interest is certainly peaked about the 10% off coupons.
Here in the UK there is always a 50% off or better deal for mediums and larges. If you can't find one on the page or from a quick Google ringing the store will get it (only ever had to do this at a friend's in Liverpool)
In Australia users have created userscripts that will track and share voucher codes and their expiry.
https://openuserjs.org/scripts/jehan/Dominos_Pizza_Voucher_C...
Re: Domino's: Pizza and Payments
#24How was he able to see the raw responses from the payment gateway? Do they use HTTP instead of HTTPS to make these requests?
Because the messages were clear at some point on a machine he controlled.
This is what the article means by the payment processing being done on the client: Some client-side code (JavaScript? A mobile app?) would receive the message from the payment gateway, and send the success code to Dominos.
He may have used a debugger[1] to breakpoint the application where the application has a cleartext version of the traffic, however he might have also taken advantage of the fact that even if using HTTPS, if the programmer uses a certificate store the user has access to (which they usually do), they can install a custom root certificate and then use something like mitmproxy[1] or charles[2] to decode the traffic.
What's needed to make this secure is to have a token provided by the payment processing API that the server can verify but that the client cannot produce (or tamper with)[4].
[1]: https://securitycafe.ro/2015/01/28/intercepting-functions-fr...
[3]: https://www.charlesproxy.com/
[4]: https://en.wikipedia.org/wiki/Hash-based_message_authenticat...
Re: Domino's: Pizza and Payments
#25My interest is certainly peaked about the 10% off coupons.
For these discount pizza chains, there is usually plenty of coupons floating around - they even accept 'competitor' coupons. You can probably find some if you search for them on the internet. But as old adage goes, you get what you pay for.
I'm not sure the adage applies here. When using a coupon you get up to 100% more than you paid for, assuming you're using the not at all rare buy one get one free ones.
Re: Domino's: Pizza and Payments
#26It's not that processing payment client-side is wrong, it's that the Dominos app implement it wrongly, or DataCash simply doesn't provide any security feature for protecting against http request data tampering, which I believe the latter is not the case. Most payment gateway have a security mechanism to ensure the response from payment server have its integrity remain intact. Most of the time by hashing some combinat…
From what I've seen, most developers understand "the client's sent data cannot be trusted", but they fail to understand how much it entails. It's not merely the forms they send, it's all of it, cookies, user agents, internal tokens that pass through Javascript, whatever. If the client touched it, it's compromised!
Re: Domino's: Pizza and Payments
#27client-side payments is totally normal, when done right, unlike dominos's's buggy version -- what usually happens is that the vendor sends you to a payment processor, and you pay them, and the payment processor sends a verification token to the vendor , and the vendor delivers your product to you. Domino's skipped one critical step.
> ... and the payment processor sends a verification token to the vendor I would just add one more critical step: the vendor actually verifies the verification token rather than just checking that it exists (since the token is often passed through the client, it can't be inherently trusted either). This should involve either hitting the processor's server or verifying a cryptographic signature, and verifying that the…
Why not have the payment processor notify the vendor's server directly? I believe PayPal does this.
Re: Domino's: Pizza and Payments
#28Did the author get a bug bounty? If not, is it that companies who understand tech the least also don't understand the value of such things?
From the tone of it, it seems he is graceful that he didn't get into any legal trouble. So I'd bet no, he didn't get any bounty.
Re: Domino's: Pizza and Payments
#29How was he able to see the raw responses from the payment gateway? Do they use HTTP instead of HTTPS to make these requests?
Useful little tool: https://github.com/iSECPartners/ios-ssl-kill-switch
Re: Domino's: Pizza and Payments
#30My interest is certainly peaked about the 10% off coupons.
For these discount pizza chains, there is usually plenty of coupons floating around - they even accept 'competitor' coupons. You can probably find some if you search for them on the internet. But as old adage goes, you get what you pay for.
> But as old adage goes, you get what you pay for.
Fancy cheese on toast?