21–30 of 90 posts
So in the end he informed the company, and they fixed it? I wasn't clear on the ending with 'hogus bogus', maybe I missed something. Pretty neat project to undertake. Kudos :D
I took the stock photo of coins to suggest that they disabled the App, leaving the only means to pay as the old fashioned method.
Much simpler hardware hacking: slightly bend the control panel and/or the door with a small lever (a coin might be sufficient). On some models, opening the door starts the "admin mode" where you can control each spire, do tests, change prices etc. The sensor for door opening can be fooled by the slight bend, hence allowing you to take whatever you want.
Sure, also lockpicking the door open would work, and if you had the possibility to bring the vending machine at home and disassemble/study it you would probably also find another three different ways, what gives? Still, you would need to perform some "unusual" physical action on the physical machine and you might be noticed by people passing by or by a surveillance cam, this app hack is instead "clean". And it makes…
I guess plenty of people are going to come in here to wave their e-peen and comment on how trivial and obvious this "hack" is, but that's kind of the point. Us developers could learn a lot from this - mainly how not to design any kind of payment app.
"Never trust the client" is a lesson every developer learns at some point. Incredible how an entire company missed that, but I'd put this down to "bosses want this out by DATE? Alrighty..."
Would a simple backup/copy of the "charged" database have sufficed? e.g: backup the db with a 5$ charge, use the credits, restore the database...
So in the end he informed the company, and they fixed it? I wasn't clear on the ending with 'hogus bogus', maybe I missed something. Pretty neat project to undertake. Kudos :D
I took the stock photo of coins to suggest that they disabled the App, leaving the only means to pay as the old fashioned method.
Would a simple backup/copy of the "charged" database have sufficed? e.g: backup the db with a 5$ charge, use the credits, restore the database...
Earlier quoted context omitted.
I took the stock photo of coins to suggest that they disabled the App, leaving the only means to pay as the old fashioned method.
This is why I so love the millenials' habit of communicating via hieroglyphs when we have perfectly good words.
Relax and have some fun. ;)
Earlier quoted context omitted.
"Never trust the client" is a lesson every developer learns at some point. Incredible how an entire company missed that, but I'd put this down to "bosses want this out by DATE? Alrighty..."
Although modern credit card now have a kind of local storage that's used to pay for small amounts of money without querying the server (at least in europe). That may have deceived the developer of that app into thinking it was doing approximately the same.
I'm guessing the reason they're doing a stored value system is because the per transaction part of the merchant fees is too high for vending machine coffee, getting a larger deposit as one transaction helps a lot with that (although, apparently not enough to hire people who know not to trust clients)