4 ms·

I encountered and reported this bug over three years ago. I decided not to write about it but considering that they still haven't fixed it... http://chadscira.

I encountered and reported this bug over three years ago. I decided not to write about it but considering that they still haven't fixed it... http://chadscira.com/post/556999d91cb00914380006ee/Re-Starbucks-unlimited-coffee# http://chadscira.com/post/556999d91cb00914380006ee/Re-Starbu...

paulpauper 11y ago
wow considering how long this has gone on, there must have been a handful of people who made a lot of money doing this. A starbucks giftcard is almost like a currency . I wonder if walmart cards have a similar vulnerability
- jonhohle 11y ago
  In my experience, Starbucks is one of the few places which allows transfer of gift card balances or purchases of gift cards with other gift cards. I can only assume this is because gift cards are intended to behave like cash (when the balance is zero, they have no additional value), but operate under the mechanics of credit/debit cards (asynchronous transactions, network failures/delays, etc.). Debit cards have the feature of going negative with very clear legal liability assigned to the account holder. Gift cards holders are essentially anonymous, so recourse may be more difficult.
  - hurin 11y ago
    So logically, being one of the few places which allow transfer of gift card balances One of their first concerns should be is any facet of this affected by race conditions? It's not that complicated of a problem really..
    - chadscira 11y ago
      which is why I'm so upset :(
veb 11y ago
I'm lost. You say in the end they "fixed" it (quotes included) and you yourself tested it and it did actually seem fixed... but it's not according to OP. I do apologise if I've missed something blatantly obvious here! Was your method the same as OP by the way?
- chadscira 11y ago
  The method i used had to do with a race condition related to transferring between cards, just like the OP. Either way they should be paying more attention to this type of exploit, considering the history of the issue. I think they may have updated something and had a regression, the big question is how long has it been like this.
- nandemo 11y ago
  It's called a regression. Believe it or not, there's a lot of software organizations out there that still get away with using anti-patterns like: not integrating code frequently, not using modern source control systems, not using automated tests, not doing security audits, and not doing incident reviews.
  - akshatpradhan 11y ago
    Part of the SDLC!
homakov 11y ago
LOL. I mean... LOL.

paulpauper 11y ago

wow considering how long this has gone on, there must have been a handful of people who made a lot of money doing this. A starbucks giftcard is almost like a currency . I wonder if walmart cards have a similar vulnerability

jonhohle 11y ago
In my experience, Starbucks is one of the few places which allows transfer of gift card balances or purchases of gift cards with other gift cards. I can only assume this is because gift cards are intended to behave like cash (when the balance is zero, they have no additional value), but operate under the mechanics of credit/debit cards (asynchronous transactions, network failures/delays, etc.). Debit cards have the feature of going negative with very clear legal liability assigned to the account holder. Gift cards holders are essentially anonymous, so recourse may be more difficult.
- hurin 11y ago
  So logically, being one of the few places which allow transfer of gift card balances One of their first concerns should be is any facet of this affected by race conditions? It's not that complicated of a problem really..
  - chadscira 11y ago
    which is why I'm so upset :(

veb 11y ago

I'm lost. You say in the end they "fixed" it (quotes included) and you yourself tested it and it did actually seem fixed... but it's not according to OP. I do apologise if I've missed something blatantly obvious here! Was your method the same as OP by the way?

chadscira 11y ago
The method i used had to do with a race condition related to transferring between cards, just like the OP. Either way they should be paying more attention to this type of exploit, considering the history of the issue. I think they may have updated something and had a regression, the big question is how long has it been like this.
nandemo 11y ago
It's called a regression. Believe it or not, there's a lot of software organizations out there that still get away with using anti-patterns like: not integrating code frequently, not using modern source control systems, not using automated tests, not doing security audits, and not doing incident reviews.
- akshatpradhan 11y ago
  Part of the SDLC!

homakov 11y ago

LOL. I mean... LOL.