Pepsi Bottlecap Liner Labeling Information Leak Vulnerability Advisory Location

Full text:

Pepsi Bottlecap Liner Labeling Information Leak Vulnerability

Advisory Location:
http://dragos.com/pepsi.txt

Release date:
February 18, 2004

Severity:
Pink (Free Music Downloads)

Systems Affected:
Diet Pepsi - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)
Pepsi - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)
Sierra Mist - 20 FL OZ Bottle (with "1 in 3 Wins a FREE Song" label)

Description:
During the Super Bowl, Apple and Pepsi co-launched an Ad campaign giving away
100 Million songs via Apple's iTunes Music Store. Because of a vulnerability
in the notification of the give-away, attackers can guarantee a free song in
any Pepsi purchase. Pepsi uses an industry standard known as "bottlecap liner
labeling", where the vendor includes notification of fun and prizes. This
method of notification is vulnerable to a pre-purchase notification weakness,
allowing attackers to limit their purchase to products that are known to be
"winners" in the give-away.

Technical Description:
An attacker capable of obtaining physical access to a bottle prior to purchase
may create a non-uniform probability distribution leading to predictable
outcome. By causing the bottle to be inclined at a specific declination, the
attacker may gain partial visibility into result variable thereby bypassing
the natural selection process.

This attack is not new. Prior soft drink distribution versions have been
vulnerable to this attack in the past. Known vulnerable versions have included
the Mountain Dew "Free Soda" give-aways.

Protection:
Vendors should put all Pepsi 20 OZ bottles in a vending machine, which should
mitigate this attack by not allowing physical access before the attacker
purchases the product.

ISS users can add the following TRONS rule to detect this attack:

alert bottle any any -> any any (msg:"pepsi attack"; tilt:>15;
classtype:information-leak; priority:pink;)

This rule may be used to identify downloads of known exploits:

alert tcp any 80 -> any any (msg:"Pepsi exploit download";
content:"pepsi"; nocase; content:"tilt"; nocase;
classification:exploit-download-attempt;)

Vendor Status:
The vendor has not been notified.

Exploit:
Exploits have been observed in the wild and are presumed to be in common use.
A proof-of-concept exploit is available at:
http://www.macmerc.com/news/archives/1270

Contributors:
Ereet Hagiwara
Brian Caswell
Dragos Ruiu