full-disclosure - Pepsi Bottlecap Liner Labeling Information Leak Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040219173736.GA20277@shmoo.com>
From: bmc at shmoo.com (Brian)
Subject: Pepsi Bottlecap Liner Labeling Information Leak Vulnerability

Pepsi Bottlecap Liner Labeling Information Leak Vulnerability

Advisory Location:
http://dragos.com/pepsi.txt

Release date:
February 18, 2004

Severity:
Pink (Free Music Downloads)

Systems Affected:
Diet Pepsi  - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)
Pepsi       - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)
Sierra Mist - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)

Description:
During the Super Bowl, Apple and Pepsi co-launched an Ad campain giving away
100 Million songs via Apple's iTunes Music Store.  Because of a vulnerability
in the notification of the give-away, attackers can guarentee a free song in
any Pepsi purchase.  Pepsi uses an industry standard known as "bottlecap liner
labeling", where the vendor includes notification of fun and prizes.  This
method of notification is vulnerable to a pre-purchase notification weakness,
allowing attackers to limit their purchase to products that are known to be
"winners" in the give-away.

Technical Description:
An attacker capable of obtaining physical access to a bottle prior to purchase
may create a non-uniform probability distribution leading to predictable
outcome.  By causing the bottle to be inclined at a specific declination, the
attacker may gain partial visibility into result variable thereby bypassing
the natural selection process.

This attack is not new.  Prior soft drink distribution versions have been
vulnerable to this attack in the past. Known vulnerable versions have included
the Mountain Dew "Free Soda" give-aways.

Protection:
Vendors should put all Pepsi 20 OZ bottles in a vending machine, which should
mitigate this attack by not allowing physical access before the attacker
purchases the product.

ISS users can add the following TRONS rule to detect this attack:

    alert bottle any any -> any any (msg:"pepsi attack"; tilt:>15; 
        classtype:information-leak; priority:pink;)

This rule may be used to identify downloads of known exploits:

    alert tcp any 80 -> any any (msg:"Pepsi exploit download"; 
         content:"pepsi"; nocase; content:"tilt"; nocase; 
         classification:exploit-download-attempt;)

Vendor Status:
The vendor has not been notified.  

Exploit:
Exploits have been observed in the wild and are presumed to be in common use.
A proof-of-concept exploit is available at:
    http://www.macmerc.com/news/archives/1270

Contributors:
Ereet Hagiwara
Brian Caswell
Dragos Ruiu