Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I hacked modern vending machines

hackernoon.com

Post reply on HN
Print view View original

11–20 of 90 posts

Re: How I hacked modern vending machines

#11

Post by Zanni »

jaclaz wrote: post #10
csmattryder wrote: post #9

Earlier quoted context omitted.

"Never trust the client" is a lesson every developer learns at some point. Incredible how an entire company missed that, but I'd put this down to "bosses want this out by DATE? Alrighty..."

>"Never trust the client" is a lesson every developer learns at some point. Incredible how an entire company missed that, but I'd put this down to "bosses want this out by DATE? Alrighty..." Can you clarify? It sounds like the responsability for having designed an insecure app is of the people that asked the programmer/sofware house to write it[1]? [1] and as said very likely paid good money for it ...

Never trust the client of a client-server system (not the client that hired the programmer). The server needs to own the truth. He was able to hack the app because the wallet was stored locally.

Re: How I hacked modern vending machines

#12

Post by jaclaz »

Zanni wrote: post #11
jaclaz wrote: post #10

Earlier quoted context omitted.

>"Never trust the client" is a lesson every developer learns at some point. Incredible how an entire company missed that, but I'd put this down to "bosses want this out by DATE? Alrighty..." Can you clarify? It sounds like the responsability for having designed an insecure app is of the people that asked the programmer/sofware house to write it[1]? [1] and as said very likely paid good money for it ...

Never trust the client of a client-server system (not the client that hired the programmer). The server needs to own the truth. He was able to hack the app because the wallet was stored locally.

Yep, I know, it was the reference to the little time allowed that struck me:

>but I'd put this down to "bosses want this out by DATE? Alrighty..."

Re: How I hacked modern vending machines

#15

Post by csmattryder »

jaclaz wrote: post #12
Zanni wrote: post #11

Earlier quoted context omitted.

Never trust the client of a client-server system (not the client that hired the programmer). The server needs to own the truth. He was able to hack the app because the wallet was stored locally.

Yep, I know, it was the reference to the little time allowed that struck me: >but I'd put this down to "bosses want this out by DATE? Alrighty..."

I've seen far too many projects where security/usability/accessibility is compromised because a project manager with limited technical qualifications decides that a time-frame is much more important than these features, and the programmers just have to get XYZ built to release for the date.

I've even been a part of some of those projects.

Re: How I hacked modern vending machines

#16

Post by Robadob »

Insanity wrote: post #14

So in the end he informed the company, and they fixed it? I wasn't clear on the ending with 'hogus bogus', maybe I missed something. Pretty neat project to undertake. Kudos :D

I took the stock photo of coins to suggest that they disabled the App, leaving the only means to pay as the old fashioned method.

Re: How I hacked modern vending machines

#18

Post by bsaul »

csmattryder wrote: post #9
SmellyGeekBoy wrote: post #5

I guess plenty of people are going to come in here to wave their e-peen and comment on how trivial and obvious this "hack" is, but that's kind of the point. Us developers could learn a lot from this - mainly how not to design any kind of payment app.

"Never trust the client" is a lesson every developer learns at some point. Incredible how an entire company missed that, but I'd put this down to "bosses want this out by DATE? Alrighty..."

Although modern credit card now have a kind of local storage that's used to pay for small amounts of money without querying the server (at least in europe). That may have deceived the developer of that app into thinking it was doing approximately the same.

Re: How I hacked modern vending machines

#19

Post by Insanity »

Robadob wrote: post #16
Insanity wrote: post #14

So in the end he informed the company, and they fixed it? I wasn't clear on the ending with 'hogus bogus', maybe I missed something. Pretty neat project to undertake. Kudos :D

I took the stock photo of coins to suggest that they disabled the App, leaving the only means to pay as the old fashioned method.

Ahh okay, that occured to me but was not sure. Thanks for elaborating :)

Re: How I hacked modern vending machines

#20

Post by lbriner »

SmellyGeekBoy wrote: post #5

I guess plenty of people are going to come in here to wave their e-peen and comment on how trivial and obvious this "hack" is, but that's kind of the point. Us developers could learn a lot from this - mainly how not to design any kind of payment app.

It's much easier to learn how not to do this than to answer how to do it!

You cannot rely on the data network, have to cope with all kinds of failure modes and mobile features support. Most companies decide that they will make some attempt to make things secure and live with the risk.

Post reply on HN