Earlier quoted context omitted.
Good to know, thanks! I guess the term in english would be "maturing"
Curing?
aging?
How I hacked modern vending machines
61–70 of 90 posts
Re: How I hacked modern vending machines
#62I guess plenty of people are going to come in here to wave their e-peen and comment on how trivial and obvious this "hack" is, but that's kind of the point. Us developers could learn a lot from this - mainly how not to design any kind of payment app.
I actually came to complain about the silly filler content I had to scroll past that felt like ads were inserted? I just closed the page after I lost the article in the memes.
I found the memes not that bothering, since they are mostly in the 'narrative' part of the article and absent from the technical part.
Re: How I hacked modern vending machines
#63We had one connected vending machine in the building. Its credit database was on a remote server, so such hacks would not work.
However, if you unplugged its ethernet connector and buy something, then somehow your would get your food/drinks and your transaction was stored into a buffer until the machine went online again.
That buffer being in volatile memory, unplugging the power cord of the machine was enough for it to forget you ever bought something.
Re: How I hacked modern vending machines
#64I don't want to be that guy, but.... He didn't hack the vending machine. He did hack the app. It was very cool and such, but not what I was expecting from the head line.
The vending machine trusts the app without any checks, therefore its security posture depends on how secure the app is.
Re: How I hacked modern vending machines
#65Fun stuff!
The article has an old vibe of hacking articles published in the '90s/'00s (in a good way).
> obviously, it was password protected
Not obvious at all. Last time I checked, WhatsApp or Telegram didn't password protect their database (that was a while ago admittedly). And obviously, it doesn't actually provide that much protection if the key is on the phone, as the article demonstrates.
Re: How I hacked modern vending machines
#66I don't understand why the vending machine would trust the client to tell it how much credit the user had without first verifying from an upstream centralized db. This is bad design in my eyes...
My initial thought was that this was how the developers were overcoming the potential for network problems. But in that case it would have been a mere cache, so agreed on that it's bad design.
Re: How I hacked modern vending machines
#67Earlier quoted context omitted.
Absolutely. I've seen these vending machines before, naive me assumed they had a server-side database. I was completely wrong..
Still, is it worth stealing a 1$ coffee to potentially be criminally charged with theft?
Is there any duty of care for the vending machine software vendor towards the owners of the vending machines? Are they not playing the role of a virtual clerk that allows shoplifters to walk out of the store unchallenged whenever they yell out "It's okay; I've already paid for this!"?
It's worth stealing a $1 coffee to expose the extreme negligence behind the virtual clerk software. The software is essentially turning the vending machine into an honor box, and presumably the owner of the machine actually wanted proof of payment before vending anything, or they wouldn't have bought the machine. They could have put up a mains-powered samovar with a coin box bolted to it and a sign reading "1 euro per coffee. Call (+39) 355 5555555 to report problems."
It's not even clear to me who is being stolen from. How does Argenta determine how much they are to pay the machine owner? How do they determine how much to pay the machine servicer? If Argenta pays for the coffee, and the owners and servicers are unharmed, potential theft of coffee becomes an incentive to repair their software. Otherwise, you'd just be screwing some vending machine operator whose only failing was to trust Argenta over a dumb(er) coin and note validator.
Re: How I hacked modern vending machines
#68I don't understand why the vending machine would trust the client to tell it how much credit the user had without first verifying from an upstream centralized db. This is bad design in my eyes...
AFAIK this is how Felica works which is the system for many of the transit systems across the world as well as a payment system built into feature phone since 2005, Android since 5-6 years ago and iPhone since iPhone7 in Japan and 8 everywhere else.
https://en.wikipedia.org/wiki/FeliCa
I don't know for a fact that it works without a DB but I do know that they exist in places that don't seem to access to a DB and they work instantly (no long pause like credit cards).
Re: How I hacked modern vending machines
#69On the one hand it's interesting to see the machines get hacked. On the other hand I love living in a country where the machines generally don't get hacked or vandalized because it means we get to have the convenience of more machines.
Re: How I hacked modern vending machines
#70This reminds me of how in the '90s my university gave out smartcard student IDs that had a little cash account on them for vending machines and dorm laundry rooms.
They installed readers into the soda machines, and they put a central panel in each laundry room with a reader and a keypad for you to indicate which washing machine you wanted to activate.
We found out that the vending machine hardware would query the card before selling you an item, but wouldn't debit your account until dispensing it, in case the vend failed. If you timed it just right and removed your card after it was interrogated but before the item dropped, you'd get it for free.
The smartcard project was only a 2-year evaluation and the university decided to move away from it, so the smartcard company came and took away all their hardware.
When they did this, they took the panel down out of the laundry rooms, but did not fully clean up the wiring coming out of the back of each washing machine. One of my roomates got curious and discovered shorting the leads of that wiring to a battery would mimic the signal the smartcard panel would use to tell the machine it's been "given" a quarter. Do that 3x and you got a 75 cent wash for free.