Pepsi Bottle Exploit!

[idbuythatforadollar]

Copied from Full Disclosure Mailing Group:

//edit: the title should read 'Pepsi' rather than coca cola, if a mod could change it for me that would be just fantastic...

================================================

Pepsi Bottlecap Liner Labeling Information Leak Vulnerability

Advisory Location:

http://dragos.com/pepsi.txt

Release date:

February 18, 2004

Severity:

Pink (Free Music Downloads)

Systems Affected:

Diet Pepsi - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)

Pepsi - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)

Sierra Mist - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)

Description:

During the Super Bowl, Apple and Pepsi co-launched an Ad campain giving away

100 Million songs via Apple's iTunes Music Store. Because of a vulnerability

in the notification of the give-away, attackers can guarentee a free song in

any Pepsi purchase. Pepsi uses an industry standard known as "bottlecap liner

labeling", where the vendor includes notification of fun and prizes. This

method of notification is vulnerable to a pre-purchase notification weakness,

allowing attackers to limit their purchase to products that are known to be

"winners" in the give-away.

Technical Description:

An attacker capable of obtaining physical access to a bottle prior to purchase

may create a non-uniform probability distribution leading to predictable

outcome. By causing the bottle to be inclined at a specific declination, the

attacker may gain partial visibility into result variable thereby bypassing

the natural selection process.

This attack is not new. Prior soft drink distribution versions have been

vulnerable to this attack in the past. Known vulnerable versions have included

the Mountain Dew "Free Soda" give-aways.

Protection:

Vendors should put all Pepsi 20 OZ bottles in a vending machine, which should

mitigate this attack by not allowing physical access before the attacker

purchases the product.

ISS users can add the following TRONS rule to detect this attack:

alert bottle any any -> any any (msg:"pepsi attack"; tilt:>15;

classtype:information-leak; priority:pink;)

This rule may be used to identify downloads of known exploits:

alert tcp any 80 -> any any (msg:"Pepsi exploit download";

content:"pepsi"; nocase; content:"tilt"; nocase;

classification:exploit-download-attempt;)

Vendor Status:

The vendor has not been notified.

Exploit:

Exploits have been observed in the wild and are presumed to be in common use.

A proof-of-concept exploit is available at:

http://www.macmerc.com/news/archives/1270

Contributors:

Ereet Hagiwara

Brian Caswell

Dragos Ruiu

_______________________________________________

Full-Disclosure - We believe in it.

Charter: http://lists.netsys.com/full-disclosure-charter.html

Edited February 19, 2004 by idbuythatforadollar

[ultraviolet7]

why did you title this coca cola?

[idbuythatforadollar]

  ultraviolet7 said:

why did you title this coca cola?

BOLLOCKS! lol

[Si Veteran]

  idbuythatforadollar said:

BOLLOCKS! lol

:laugh: :laugh: :laugh: :laugh:

[Spyder Veteran]

  idbuythatforadollar said:

//edit: the title should read 'Pepsi' rather than coca cola, if a mod could change it for me that would be just fantastic...

done

[isus]

yea, i am doing this alot... i have won quite a few songs :shifty:

[QuarterSwede]

Unless you are a Pepsi addict this is usless and personally pointless (I like Coca-Cola a lot more). If one wants to buy a Pepsi just to "win" a free song download why not just spend potentially, and most likely, less and just buy the song for $0.99 from iTunes?

The only way it's really worth buying a pepsi to win a song download from iTunes is if Pepsi offered the deal on 2 Liter bottles.

[HellBender]

I'm sure it'll take Microsoft a few months to patch this one.

[hoyablue]

  HellBender said:

I'm sure it'll take Microsoft a few months to patch this one.

Yeah, especially since Apple is in charge of the iTunes Music Store... :rolleyes:

[Homie]

I dont get it..

Edit: Oh, bah well I knew that... :rofl: :rofl: :whistle: :whistle:

[Spyder Veteran]

  nspeds said:

Yeah, especially since Apple is in charge of the iTunes Music Store... :rolleyes:

d'oh!

[isus]

  Jstphish said:

Unless you are a Pepsi addict this is usless and personally pointless (I like Coca-Cola a lot more). If one wants to buy a Pepsi just to "win" a free song download why not just spend potentially, and most likely, less and just buy the song for $0.99 from iTunes?

The only way it's really worth buying a pepsi to win a song download from iTunes is if Pepsi offered the deal on 2 Liter bottles.

think about it this way...

it costs me $1 even to buy a pepsi. it costs $0.99 to buy a song. win or lose, i am still getting a soda. if i win, that's $0.99 i save. usually i would waste that $1 on mountain dew, sprite, or whatever looks appealing. so now i can buy a diet pepsi (the only ones around here with the game caps), which is healthier for me (no sugar), tastes the same as regular, and i have a chance to win a soda.

sounds like a good deal to me.

plus, buying a soda, you can use cash, so you don't have to use a credit card.

[ryanmcv]

How do you think I won all 13 of those free songs already? ;)

[ericnmu]

I do this with coke and dr. pepper too.

Coke is a little harder, you have to have it at the right angle, then you can catch a glimpse of a jargled word (winner) or a Drink (loser).

[doggbizkit00]

im 2 / 4. ive been doing the tilt method and it works great. the two losers have been from slurpee (cant cheat) and vending machine at school (cant cheat).

[me101 Veteran]

Been doing this trick for years...

But buying a $1 drink (or even considerably more at a sporting or entertainment event!) to hopefully get a 99c iTunes download music which I can only either burn onto CD or put into an iPod, nah, think i'll keep my money...

  Quote

The only way it's really worth buying a pepsi to win a song download from iTunes is if Pepsi offered the deal on 2 Liter bottles.

This would be the best, considering that I can usually buy a 2L bottle of Pepsi for like 79c, once bought a slew of 2L Pepsi for 49c... now that would have been a good deal!

If you want to put any iTunes code that you may find under a Pepsi bottle cap, why not visit Tune Recycler...

[Stokkolm]

I love Pepsi :cool: , I haven't won any songs yet though.

[nuka_t]

heres a good one. just use winmx.

[bakerster]

  nuka_t said:

heres a good one. just use winmx.

*joyfully waits for winmx 4*

[Stokkolm]

  h4x0r b4k3r said:

*joyfully waits for winmx 4*

yeah, the site hasn't been updated since Oct. 19th, 2002.

[radioboy]

  me101 said:

But buying a $1 drink (or even considerably more at a sporting or entertainment event!) to hopefully get a 99c iTunes download music which I can only either burn onto CD or put into an iPod, nah, think i'll keep my money...

Burn to CD

Rip to MP3

lather

rinse

repeat

or just go line out to line in and record away

[ericnmu]

im 9/9 with free coke's.

[Toxikk Veteran]

just use the dollar to buy the damn song. drink the drink and if you happen to win, then go you.

[+John Teacake MVC]

I thought this was meant to be a **** take lol.

[Xerino]

I figured this out before it was discovered, you can do it with almost any pepsi bottle contest, Im working on my 3rd email address now being you can only have 200 songs per email addy