idbuythatforadollar Posted February 19, 2004 Share Posted February 19, 2004 (edited) Copied from Full Disclosure Mailing Group: //edit: the title should read 'Pepsi' rather than coca cola, if a mod could change it for me that would be just fantastic... ================================================ Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Advisory Location: http://dragos.com/pepsi.txt Release date: February 18, 2004 Severity: Pink (Free Music Downloads) Systems Affected: Diet Pepsi - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label) Pepsi - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label) Sierra Mist - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label) Description: During the Super Bowl, Apple and Pepsi co-launched an Ad campain giving away 100 Million songs via Apple's iTunes Music Store. Because of a vulnerability in the notification of the give-away, attackers can guarentee a free song in any Pepsi purchase. Pepsi uses an industry standard known as "bottlecap liner labeling", where the vendor includes notification of fun and prizes. This method of notification is vulnerable to a pre-purchase notification weakness, allowing attackers to limit their purchase to products that are known to be "winners" in the give-away. Technical Description: An attacker capable of obtaining physical access to a bottle prior to purchase may create a non-uniform probability distribution leading to predictable outcome. By causing the bottle to be inclined at a specific declination, the attacker may gain partial visibility into result variable thereby bypassing the natural selection process. This attack is not new. Prior soft drink distribution versions have been vulnerable to this attack in the past. Known vulnerable versions have included the Mountain Dew "Free Soda" give-aways. Protection: Vendors should put all Pepsi 20 OZ bottles in a vending machine, which should mitigate this attack by not allowing physical access before the attacker purchases the product. ISS users can add the following TRONS rule to detect this attack: alert bottle any any -> any any (msg:"pepsi attack"; tilt:>15; classtype:information-leak; priority:pink;) This rule may be used to identify downloads of known exploits: alert tcp any 80 -> any any (msg:"Pepsi exploit download"; content:"pepsi"; nocase; content:"tilt"; nocase; classification:exploit-download-attempt;) Vendor Status: The vendor has not been notified. Exploit: Exploits have been observed in the wild and are presumed to be in common use. A proof-of-concept exploit is available at: http://www.macmerc.com/news/archives/1270 Contributors: Ereet Hagiwara Brian Caswell Dragos Ruiu _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html Edited February 19, 2004 by idbuythatforadollar Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/ Share on other sites More sharing options...
ultraviolet7 Posted February 19, 2004 Share Posted February 19, 2004 why did you title this coca cola? Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1754942 Share on other sites More sharing options...
idbuythatforadollar Posted February 19, 2004 Author Share Posted February 19, 2004 ultraviolet7 said: why did you title this coca cola? BOLLOCKS! lol Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1754946 Share on other sites More sharing options...
Si Veteran Posted February 19, 2004 Veteran Share Posted February 19, 2004 idbuythatforadollar said: BOLLOCKS! lol :laugh: :laugh: :laugh: :laugh: Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1754951 Share on other sites More sharing options...
Spyder Veteran Posted February 19, 2004 Veteran Share Posted February 19, 2004 idbuythatforadollar said: //edit: the title should read 'Pepsi' rather than coca cola, if a mod could change it for me that would be just fantastic... done Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1754979 Share on other sites More sharing options...
isus Posted February 19, 2004 Share Posted February 19, 2004 yea, i am doing this alot... i have won quite a few songs :shifty: Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1754989 Share on other sites More sharing options...
QuarterSwede Posted February 19, 2004 Share Posted February 19, 2004 Unless you are a Pepsi addict this is usless and personally pointless (I like Coca-Cola a lot more). If one wants to buy a Pepsi just to "win" a free song download why not just spend potentially, and most likely, less and just buy the song for $0.99 from iTunes? The only way it's really worth buying a pepsi to win a song download from iTunes is if Pepsi offered the deal on 2 Liter bottles. Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755020 Share on other sites More sharing options...
HellBender Posted February 19, 2004 Share Posted February 19, 2004 I'm sure it'll take Microsoft a few months to patch this one. Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755037 Share on other sites More sharing options...
hoyablue Posted February 19, 2004 Share Posted February 19, 2004 HellBender said: I'm sure it'll take Microsoft a few months to patch this one. Yeah, especially since Apple is in charge of the iTunes Music Store... :rolleyes: Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755053 Share on other sites More sharing options...
Homie Posted February 19, 2004 Share Posted February 19, 2004 I dont get it.. Edit: Oh, bah well I knew that... :rofl: :rofl: :whistle: :whistle: Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755057 Share on other sites More sharing options...
Spyder Veteran Posted February 19, 2004 Veteran Share Posted February 19, 2004 nspeds said: Yeah, especially since Apple is in charge of the iTunes Music Store... :rolleyes: d'oh! Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755063 Share on other sites More sharing options...
isus Posted February 19, 2004 Share Posted February 19, 2004 Jstphish said: Unless you are a Pepsi addict this is usless and personally pointless (I like Coca-Cola a lot more). If one wants to buy a Pepsi just to "win" a free song download why not just spend potentially, and most likely, less and just buy the song for $0.99 from iTunes?The only way it's really worth buying a pepsi to win a song download from iTunes is if Pepsi offered the deal on 2 Liter bottles. think about it this way... it costs me $1 even to buy a pepsi. it costs $0.99 to buy a song. win or lose, i am still getting a soda. if i win, that's $0.99 i save. usually i would waste that $1 on mountain dew, sprite, or whatever looks appealing. so now i can buy a diet pepsi (the only ones around here with the game caps), which is healthier for me (no sugar), tastes the same as regular, and i have a chance to win a soda. sounds like a good deal to me. plus, buying a soda, you can use cash, so you don't have to use a credit card. Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755091 Share on other sites More sharing options...
ryanmcv Posted February 19, 2004 Share Posted February 19, 2004 How do you think I won all 13 of those free songs already? ;) Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755113 Share on other sites More sharing options...
ericnmu Posted February 19, 2004 Share Posted February 19, 2004 I do this with coke and dr. pepper too. Coke is a little harder, you have to have it at the right angle, then you can catch a glimpse of a jargled word (winner) or a Drink (loser). Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755126 Share on other sites More sharing options...
doggbizkit00 Posted February 19, 2004 Share Posted February 19, 2004 im 2 / 4. ive been doing the tilt method and it works great. the two losers have been from slurpee (cant cheat) and vending machine at school (cant cheat). Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755241 Share on other sites More sharing options...
me101 Veteran Posted February 19, 2004 Veteran Share Posted February 19, 2004 Been doing this trick for years... But buying a $1 drink (or even considerably more at a sporting or entertainment event!) to hopefully get a 99c iTunes download music which I can only either burn onto CD or put into an iPod, nah, think i'll keep my money... Quote The only way it's really worth buying a pepsi to win a song download from iTunes is if Pepsi offered the deal on 2 Liter bottles. This would be the best, considering that I can usually buy a 2L bottle of Pepsi for like 79c, once bought a slew of 2L Pepsi for 49c... now that would have been a good deal! If you want to put any iTunes code that you may find under a Pepsi bottle cap, why not visit Tune Recycler... Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755307 Share on other sites More sharing options...
Stokkolm Posted February 19, 2004 Share Posted February 19, 2004 I love Pepsi :cool: , I haven't won any songs yet though. Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755325 Share on other sites More sharing options...
nuka_t Posted February 19, 2004 Share Posted February 19, 2004 heres a good one. just use winmx. Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755336 Share on other sites More sharing options...
bakerster Posted February 19, 2004 Share Posted February 19, 2004 nuka_t said: heres a good one. just use winmx. *joyfully waits for winmx 4* Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755355 Share on other sites More sharing options...
Stokkolm Posted February 19, 2004 Share Posted February 19, 2004 h4x0r b4k3r said: *joyfully waits for winmx 4* yeah, the site hasn't been updated since Oct. 19th, 2002. Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755397 Share on other sites More sharing options...
radioboy Posted February 19, 2004 Share Posted February 19, 2004 me101 said: But buying a $1 drink (or even considerably more at a sporting or entertainment event!) to hopefully get a 99c iTunes download music which I can only either burn onto CD or put into an iPod, nah, think i'll keep my money... Burn to CD Rip to MP3 lather rinse repeat or just go line out to line in and record away Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755472 Share on other sites More sharing options...
ericnmu Posted February 20, 2004 Share Posted February 20, 2004 im 9/9 with free coke's. Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1755824 Share on other sites More sharing options...
Toxikk Veteran Posted February 20, 2004 Veteran Share Posted February 20, 2004 just use the dollar to buy the damn song. drink the drink and if you happen to win, then go you. Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1758444 Share on other sites More sharing options...
+John Teacake MVC Posted February 20, 2004 MVC Share Posted February 20, 2004 I thought this was meant to be a **** take lol. Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1759328 Share on other sites More sharing options...
Xerino Posted February 21, 2004 Share Posted February 21, 2004 I figured this out before it was discovered, you can do it with almost any pepsi bottle contest, Im working on my 3rd email address now being you can only have 200 songs per email addy Link to comment https://www.neowin.net/forum/topic/142809-pepsi-bottle-exploit/#findComment-1761405 Share on other sites More sharing options...
Recommended Posts