Search This Blog

Showing posts with label Hacking Techniques. Show all posts

Nespresso Prepaid Vending Machines Hacked by a Belgian Researcher for Free Coffee


Polle Vanhoof, a Belgian cybersecurity researcher discovered there a flaw in the older Nespresso prepaid coffee machine smart cards and exploited the vulnerability to acquire virtually limitless free drinks.

Vanhoof revealed the vulnerability in Nespresso coffee machine smart cards back in September 2020 and he openly lauded the efforts of Nespresso for managing the issue and now with Nespresso’s approval, he has published his article regarding the flaws in the payment system. Nespresso is unperturbed that other coffee vendors can use this vulnerability to their advantage because this hacking method can only be applied on the older payment cards that have a network connection. 

Modus operandi of this hack

Nespresso payment system operates on ‘stored-value wireless payment card’, it is identical but different from how the modern credit card works. Here wireless refers to the card which uses Near Field Communication (NFC), NFC is used by credit cards, modern door security cards, and nearly in every passport issued in the past decade. 

When someone waves an NFC card close to the NFC reader, the card begins to power up due to the electromagnetic emissions from the reader (which needs to be attached to the power supply), the card powers up due to the antenna present on it in the form of a metal coil that produces electricity as it moves via a magnetic field. The electrical energy which is left in the charged-up card is utilized for a short, wireless exchange of cryptographic data with the NFC reader. It means that NFC cards do not require a battery so they can be tiny, flat, light, and cheap. 

Vanhoof disclosed that older Nespresso cards operate on the Mifare Classic NFC chip and this chip does not have strong enough cryptography which makes the NFC cards vulnerable. NFC cards require a delicate balance of low power consumption with high cryptographic power and in the case of Mifare classic, this balance is more in the favor of the attacker. Mifare Classic runs on a stripped-down 48-bit cipher called Cryptol instead of a well-acknowledged and publicly documented algorithm called AES-128.

Cyber Security Researcher Exposes the Biggest Threat Regarding YouTube Users Privacy


David Schutz, a security researcher uncovered the potential unauthorized access to a user’s viewing history, favorites, and playlists by the threat actors. Threat actors manipulated the website and embedded a YouTube video to secure access to a user’s viewing history and playlists.

Threat actors managed to earn $1,337 via the security bug, Schutz explained that he discovered the vulnerabilities by linking two things – in a somewhat “unexpected” manner. Website developers utilize YouTube embedded player to embed videos into their own site and this player also has a feature known as API (Application Programming Interface). 

API lets users embed functions commonly executed on YouTube into their personal website or application. API also allows the users to retrieve, insert, delete or update many of these resources. A resource constitutes a kind of item that comprises part of the YouTube experience which includes loading a new video or playlist, subscription, play/pause the player.

Every user on YouTube has a few personal playlists, for example, the playlist with the ID ‘HL’ comprises the user’s viewing history and the ID with ‘WL’ contains the user’s view later and so on.

David Schutz explained the vulnerabilities via blog post: “Since the YT embedded player is also logged in to YT, a malicious website could have embedded a player, instructed it to play e.g., the ‘HL’ playlist (which would start playing the currently visiting user’s watch history), and get the contents of the playlists using the API the embedded player has, thereby stealing the watch history of the user who opened the website”.

“The attacker could also have prepared a page for a specific victim, which when opened by that victim, would steal the victim’s unlisted videos (which otherwise would require knowing the ID to watch). The main issue was that you were able to load private playlists into the player in the name of the victim, and later steal the contents of those private playlists,” the post further read.