Https://t.co/0H0UBgIeUy Schneier jumps over his own cautions that people evaluate risk poorly to skate in another empty pool of shame.
Race Condition Exploit in Starbucks Gift Cards - Schneier on SecurityA researcher was able to steal money from Starbucks by exploiting a race condition in its gift card value-transfer protocol. Basically, by initiating two identical web transfers at once, he was able to trick the system into recording them both. Normally, you could take a $5 gift card and move that money to another $5 gift card, leaving you with an empty gift card and a $10 gift card. He was able to duplicate the transfer, giving him an empty gift card and a $15 gift card. Race-condition attacks are unreliable and it took him a bunch of tries to get it right, but there’s no reason to believe that he couldn’t have kept doing this forever...Schneier on Security
Posted on Twitter over 11 years ago and archived here at /twitter/2015/05/26/tweet-603392277197623297/ in the Twitter collection.
| newer | Twitter post from May 27, 2015, 603584360961433601 | 27 May 2015 |
|---|---|---|
| this post | Twitter post from May 27, 2015, 603392277197623297 | 27 May 2015 |
| older | Twitter post from May 26, 2015, 603282112611897344 | 26 May 2015 |
| newer | Twitter post from May 27, 2015, 603584360961433601 | 27 May 2015 |
|---|---|---|
| this post | Twitter post from May 27, 2015, 603392277197623297 | 27 May 2015 |
| older | Post #119988648063 | 27 May 2015 |