Pepsi Bottlecap Liner Labeling Information Leak Vulnerability
Advisory Location:
http://dragos.com/pepsi.txt
Release date:
February 18, 2004
Severity:
Pink (Free Music Downloads)
Systems Affected:
Diet Pepsi - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)
Pepsi - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)
Sierra Mist - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)
Description:
During the Super Bowl, Apple and Pepsi co-launched an Ad campain giving away 100 Million songs via Apple's iTunes Music Store. Because of a vulnerability in the notification of the give-away, attackers can guarentee a free song in any Pepsi purchase. Pepsi uses an industry standard known as "bottlecap
liner labeling", where the vendor includes notification of fun and prizes. This method of notification is vulnerable to a pre-purchase notification weakness, allowing attackers to limit their purchase to products that are known to be "winners" in the give-away.
Technical Description:
An attacker capable of obtaining physical access to a bottle prior to purchase may create a non-uniform probability distribution leading to predictable outcome. By causing the bottle to be inclined at a specific
declination, the attacker may gain partial visibility into result variable thereby bypassing the natural selection process.
This attack is not new. Prior soft drink distribution versions have been vulnerable to this attack in the past. Known vulnerable versions have included the Mountain Dew "Free Soda" give-aways.
Protection:
Vendors should put all Pepsi 20 OZ bottles in a vending machine, which should mitigate this attack by not allowing physical access before the attacker purchases the product.
ISS users can add the following TRONS rule to detect this attack:
alert bottle any any -> any any (msg:"pepsi attack"; tilt:>15; classtype:information-leak; priority:pink;)
This rule may be used to identify downloads of known exploits:
alert tcp any 80 -> any any (msg:"Pepsi exploit download"; content:"pepsi"; nocase; content:"tilt"; nocase;
classification:exploit-download-attempt;)
Vendor Status:
The vendor has not been notified.
Exploit:
Exploits have been observed in the wild and are presumed to be in common use.
A proof-of-concept exploit is available at:
http://www.macmerc.com/news/archives/1270
Contributors:
Ereet Hagiwara
Brian Caswell
Dragos Ruiu
