15 ms·
Hacking Voi Scooters: How I Created $100k Worth of Free Rides
- blacksoil 7y agoWould the author be in trouble by posting this? I really hope he would not.. I'm just afraid there's some sort of clause upon registration against this sort of hacks..
- braythwayt 7y ago"I had nothing to do one Sunday evening, so I played around with reverse-engineering the different scooter apps' APIs to see if I could find any loopholes. One would think that the more well-funded companies had thought more about their tech and would be good at preventing fraud. However, that isn't the case." That sounds an awful lot like the author thinks that what they were doing is fraudulent. But I seem to have misplaced my Law Degree, so I couldn't say. Personally, I am not sympathetic with attempts to "hack" a business' systems, whether by social engineering, attempting to exploit loopholes, or full-on exploiting security vulnerabilities. It may be legal, I cannot say, but when done in bad faith it is nothing more than parasitism. Or if you prefer, "exploitative." Now of course, if the author has no intention of using these fraudulently obtained promo codes, and this is supposed to be some kind of white-hat "security research," that's another matter. But this doesn't really look like it is being conducted for public benefit, e.g. to protect the privacy of users. And unsolicited testing of other people's systems seems like a legally perilous activity.
- rvnx 7y agoIt's very weird, he seems to admit defrauding the system and bragging about. I don't think it's a very wise idea.
- deleted 7y ago[deleted]
- NetOpWibby 7y agoAuthor must be a fan of rap music. Look no further than Bobby Shmurda and Tekashi 69.
- fuzz4lyfe 7y agoA lot of hackers I read about have a great deal of bravo about things like this. Yeah sure you found a vulnerability in a companies API and got something for free. What I look forward to see is his next hack, where he somehow gets past the part where the company sends men with guns to his home to throw him in jail. Hopefully he can use the free rides to go someplace without a extradition treaty. Really he only managed to hack a small portion of the system and ignored the societal safeguards that are far more robust.
- braythwayt 7y ago"bravado" :-)
- fuzz4lyfe 7y agoMy bad, I'll blame autocorrect
- braythwayt 7y agoNot bad! That's the beauty of crowd-sourcing. Fee free to use words that seem right, and if it turns out that there is a slight adjustment to be made, everyone learns for free.
- gtirloni 7y agoIANAL but this is in their user agreement [0]: 1.9 Unauthorized use, tampering and hacking. You must not tamper with, attempt to gain unauthorized access to, modify, hack, repair, any Voi material or hardware, source-codes, information, including the Voi App, Website and Scooter, for any purposes. The Voi App, Website and the Scooter may only be used for the purposes pursuant to this Agreement. If that's valid in court, that's another matter. It looks like the Sweden Penal Code has a definition of data breach and jail time [1] 0 - https://www.voiscooters.com/voi-user-agreement-12rr/ https://www.voiscooters.com/voi-user-agreement-12rr/ 1 - https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/sweden https://iclg.com/practice-areas/cybersecurity-laws-and-regul... EDIT: Not discussing the technical details of this post because they are quite boring, to be honest. That's Web Security 101 and, given so many previous incidents, far from surprising that these companies aren't handling it well.
- ryanlol 7y agoHe's in Sweden, which is a reasonable country. It is very unlikely that he'd get into any kind of trouble over posting this.
- 49para 7y agoJulian Assange might disagree.
- lostmyoldone 7y agoThat case was an odd one, for sure, but it was also so odd that one can't really use it as comparison. The only thing that's comparable was the pirate bay thing. I'm not going to say it was caused by innoffical, illegal, pressure from some influential country or person, but sometimes it feels like the only plausible explanation. Not only did the prosecutor act strangely, but also, reading accounts of what Assanges lawyer or witnesses has said in court ( regarding the extradition request ) is ... cringy more often than not.
- esoterica 7y agoDoes a “reasonable” country not prosecute people for committing crimes?
- lostmyoldone 7y agoIn a reasonable country, the prosecutors office and the police are supposed to prioritize crimes that cause the greater danger to people, and/or to the society. If prosecuting is unlikely to increase safety and well being, the resources are better used where such positive effects can be achieved. Prosecutors and police alike certainly doesn't have a perfect track record in this regard, there's still quite some room for improvement.
- esoterica 7y agoSo we should just not prosecute fraud/theft and other nonviolent or white collar crimes at all?
- bufferoverflow 7y agoIf you're gonna commit multiple crimes, at least do it for a significant amount of money. This is just not worth it, and trivial to get caught.
- social_quotient 7y agoReminds me the time we integrated a web survey with giftbit (api driven gift card service). While developing this for our client I had this nagging sense that we needed to rate limit or block multiple submissions by a single email but the client wanted it to ship ASAP and not take the extra time to have some validation flow. Day 1 - 8 legit surveys each getting $50 amazon card Day 2 - just over a hundred with 90+ being the same gmail account. Day 3 - out of credits, campaign over. Between this and the Voi write up I think it’s important to have a dark mind in the room to avoid stuff like this being so trivial. Some hacks you hear about and the first thought is about how gifted or smart the hack/er was, other times you just think how dumb the developer was. I’ve been on both sides of this and while I’m not proud of it I think the stories like these keep people on their toes.
- easytiger 7y ago> block multiple submissions by a single email but the client wanted it to ship ASAP and not take the extra time to have some validation flow. Surely that would have taken you ten minutes at most? I can't imagine anything more trivial. I can't imagine that the client wanted multiple survey results from the same person either.
- jaynetics 7y agoThis might actually delay things if you work at some bureaucratic company where you need to discuss with another department whenever you want to add a table to the database or something. Also, while keeping track of email addresses is simple, making such a system hard to exploit isn't all that trivial, with there being wildcard and throwaway email addresses and so on.
- easytiger 7y agoHe said they already stored the email address, and that the offender used the same one. At least the most trivial of checks would have deterred the person most likely. This to me would be a fundamental feature of the system - multiple survey results from the same person are of no value.
- fwr 7y agoMirror: https://web.archive.org/web/20190928130035/https://fant.io/p/hacking-voi/ https://web.archive.org/web/20190928130035/https://fant.io/p...
- slacka 7y agoAnother mirror here: http://archive.is/GXpH6 http://archive.is/GXpH6
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- raihansaputra 7y agoPost seems to be deleted.
- labawi 7y agoWasn't good either.
- squarefoot 7y agoI'd be willing to pay any reasonable amount to use one of these for short trips, but please make a model using bigger wheels or any bump in the road would either destroy them or my back, probably both.
- croisillon 7y agothe bigger model is called a bicycle
- xeromal 7y agoAt least where I live, the advantage of the scooters/e-bikes is that you can take a lunch break without coming back sweaty riding a bike and looking like a serial killer in a meeting.
- xeromal 7y agoIn Los Angeles, we have little bike scooters with bigger wheels and faster speeds. They're probably exactly what you're looking for.
- labawi 7y agoPlease don't make these "Potential improvements" - use SSL pinning. - block different GMail emails from the same Google user. - prevent different users from using the same credit card. These are user hostile. I see no legitimate reason to do so. Though limiting coupon use with same base email/card/.. is reasonable. - require more information than just an email address. Maybe you need to (e.g. theft) but coupon reuse prevention is overreaching. - don't email the promo codes in plain text. ... It could also be built as a deep link into the app Is this assuming iOS use and opening the mail on the phone? EDIT: If you disagree, please state the reason. To elaborate: Paying for your kid, spouse or friend from a single card seems reasonable. Not everyone has lots of cards. As for email canonicalization: What if you lose access to your account, want one for kids, separating work/personal .. don't do it by default unless you do have a good reason. You're just adding minor inconveniences and possibly serious vulnerabilities (using random email forwarders along with typical email password resets). Certificate pinning to deny user access - your APIs should be secured by making them secure and it will actually work. Data itself (also) belongs to the user, not (only) to the service provider. Some may disagree, but laws in some countries state so.
- joshuaissac 7y agoWhat is user hostile about SSL pinning? Would the user not want to know when the certificate does not match up?
- labawi 7y agoEDIT: The user will not be informed the certificates don't match up. He already knows as it is meant to dissuade user's traffic inspection. It makes traffic inspection of your own devices hard. If you warn and ask the user, then fine, but I believe it was meant as mandatory.
- eskpe 7y agoOriginal removed, web archive: https://web.archive.org/web/20190928130035/https://fant.io/p/hacking-voi/ https://web.archive.org/web/20190928130035/https://fant.io/p...
- xkcd-sucks 7y agoOriginal article https://web.archive.org/web/20190928113147/https://fant.io/p/hacking-voi/ https://web.archive.org/web/20190928113147/https://fant.io/p...
- zitterbewegung 7y agoWas the content on the site taken down? It appears by clicking on the link that we are being directed to the blog itself not the blog post.
- femto113 7y agoThis doesn’t feel like much of a “hack”, it just leveraged the fact that an email address is all that’s needed to create an account and get a promo code. in the end he just has 1000s of accounts with $10 of promo credits each. His plan is to switch accounts every time he runs out of credits, seems like the easiest solution from Voi’s perspective would be to expire promo credits after a few weeks.
- rolltiide 7y ago> One would think that the more well-funded companies had thought more about their tech and would be good at preventing fraud. However, that isn't the case. There is a mostly Western idea that money means you have considered everything right and are rewarded from that This is such a huge distortion and I don't understand it, almost seems like it is a necessary religious doctrine to make people comfortable with pursuing this system
- dijit 7y agoLots of these scooters in Malmo, Sweden and I see local kids getting rides for free by "ending the ride" while pulling down the throttle as the scooter is being unlocked. I've never done it, I've just heard about it, quite a lot.
- cheeze 7y agoIMO cert pinning isn't all that important. The number of painful outages caused by cert pinning versus the actual security benefit isnt worth it IMO. But the truth is that random app dev doesn't have their shit together enough to do pinning right. Don't believe me? AWS recommends the same https://aws.amazon.com/blogs/security/how-to-prepare-for-aws-move-to-its-own-certificate-authority/ https://aws.amazon.com/blogs/security/how-to-prepare-for-aws... If you're Chase, or PayPal, sure. But if you're random startup with a crappy app, don't bother IMO.
- K0nserv 7y agoI read this on LinkedIn a few days ago and what immediately struck me is how irresponsible the post is. 90 day disclosure deadlines and the practice of responsible disclosure is well established. In the author's own timeline it's clear he gave Voi 9 days to respond before publishing all the details. This kind of conduct reflects poorly on the whole security community and I assume someone told the author this, resulting in the unpublishing of the post.
- azadnelsn 7y agoCan someone give me a hacked credit card
- siadstecher 7y agosiadstecher@gmail.com
- joel336667 7y agoI want some credits