Full Disclosure mailing list archives
Pepsi Bottlecap Liner Labeling Information Leak Vulnerability
From: Brian <bmc () shmoo com>
Date: Thu, 19 Feb 2004 10:37:36 -0700
Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Advisory Location: http://dragos.com/pepsi.txt Release date: February 18, 2004 Severity: Pink (Free Music Downloads) Systems Affected: Diet Pepsi - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label) Pepsi - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label) Sierra Mist - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label) Description: During the Super Bowl, Apple and Pepsi co-launched an Ad campain giving away 100 Million songs via Apple's iTunes Music Store. Because of a vulnerability in the notification of the give-away, attackers can guarentee a free song in any Pepsi purchase. Pepsi uses an industry standard known as "bottlecap liner labeling", where the vendor includes notification of fun and prizes. This method of notification is vulnerable to a pre-purchase notification weakness, allowing attackers to limit their purchase to products that are known to be "winners" in the give-away. Technical Description: An attacker capable of obtaining physical access to a bottle prior to purchase may create a non-uniform probability distribution leading to predictable outcome. By causing the bottle to be inclined at a specific declination, the attacker may gain partial visibility into result variable thereby bypassing the natural selection process. This attack is not new. Prior soft drink distribution versions have been vulnerable to this attack in the past. Known vulnerable versions have included the Mountain Dew "Free Soda" give-aways. Protection: Vendors should put all Pepsi 20 OZ bottles in a vending machine, which should mitigate this attack by not allowing physical access before the attacker purchases the product. ISS users can add the following TRONS rule to detect this attack: alert bottle any any -> any any (msg:"pepsi attack"; tilt:>15; classtype:information-leak; priority:pink;) This rule may be used to identify downloads of known exploits: alert tcp any 80 -> any any (msg:"Pepsi exploit download"; content:"pepsi"; nocase; content:"tilt"; nocase; classification:exploit-download-attempt;) Vendor Status: The vendor has not been notified. Exploit: Exploits have been observed in the wild and are presumed to be in common use. A proof-of-concept exploit is available at: http://www.macmerc.com/news/archives/1270 Contributors: Ereet Hagiwara Brian Caswell Dragos Ruiu _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Brian (Feb 19)
- Re: Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Brent J. Nordquist (Feb 19)
- Re: Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Alain (Feb 20)
- Re: Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Martin Helas (Feb 20)
- RE: Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Andrew Aris (Feb 20)
- Re: Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Andrew Simmons (Feb 20)
- Re: Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Martin Helas (Feb 20)
- Re: Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Don C. Weber (Feb 20)
- RE: Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Andrew Aris (Feb 20)
- <Possible follow-ups>
- Re: Pepsi Bottlecap Liner Labeling Information Leak Vulnerability tcleary2 (Feb 20)
- Re: Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Gadi Evron (Feb 20)
- Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Wayne Chang (Feb 20)