Shock and Horror - Coffee is hackable!!

0 comments

On a quite Thursday morning I was checking my email and one email stood out above the others so I dived in to read it 1st.

I should say that for security reasons I subscribe to the Full Disclosure email list where vulnerabilities are often 1st spoken about and released. This gives me a few days heads start over script kiddies who will take these vulns and deploy ready made scripts for the masses to abuse them.

But when it gets to the stage that my morning tea and coffee is affected (and who knows for what nefarious use?) you have to ask is full disclosure of a vulnerability going too far?

Quote:
AFFECTED: FLAVIA BEVERAGE SYSTEM (ALL VERSIONS)

NOTES: SO FAR THIS EXPLOIT HAS ONLY BEEN TESTED WITH THE "CHOCO" FLAVOR OF BEVERAGE PACKET.

SPECIAL THANKS TO: V.S. KESHURAVAIA GADHIRECHELA IN THE CUBICLE NEXT TO ME.

GREETZ: #COFFEEMACHINES, #31337DONGS, #HOMOSEXUAL_HACKERS

ABSTRACT: THE FLAVIA VENDING MACHINE WORKS ON THE PREMISE THAT ACCESS TO BEVERAGE PACKETS DOES NOT IMPLY ACCESS TO THE BEVERAGE. THE SECURITY CONTROLS EXIST ON THE MACHINE TO ENSURE THAT PAYMENT IS RECEIVED BEFORE BEVERAGE DISTRIBUTION IS POSSIBLE. HOWEVER, IN REALITY, IT IS POSSIBLE TO CREATE A BEVERAGE USING ONLY THE BEVERAGE PACKET AND NOT THE FLAVIA MACHINE.

[PROOF OF CONCEPT]

SUPPLIES REQUIRED: PAIR OF SCISSORS (1), BOILING WATER, STYROFOAM CUP (1), FLAVIA BEVERAGE PACKETS (2), STRAW (1)

PROCEDURE:

1. POUR BOILING WATER INTO STYROFOAM CUP UNTIL IT FILLS 75% OF THE CUP'S VOLUME.

2. CUT EACH FLAVIA BEVERAGE PACKET AT THE BOTTOM SEAM AND EMPTY IT INTO THE WATER.

3. STIR VIGOROUSLY WITH STRAW.

4. OVERWRITE THE INSTRUCTION POINTER WITH THE ADDRESS OF YOUR SHELLCODE.

ER

4. ENJOY YOUR DELICIOUS BEVERAGE.

[STEPS TO CORRECT]

THE FLAVIA MACHINE IS FLAWED DUE TO ITS FREE DISTRIBUTION OF FLAVIA BEVERAGE PACKETS NEXT TO THE MACHINE. THE BEVERAGE PACKETS SHOULD BE STORED INSIDE THE MACHINE. UNTIL THEN, THIS EXPLOIT WILL BE CONTINIOUSLY USED BY THE MEMBERS OF CUBICLE 4701 AS WE ENJOY BEVERAGES THAT TASTE LIKE FREEDOM.

##