Domino’s Android app allowed for fake payments resulting in unlimited free pizza

Share Button

88a8b3e51e0355233907417f5bc3e288

The latest benefit to having even basic coding skills is access to unlimited free Domino’s pizza. At least it was until Paul Price, a security consultant from the UK, notified the chain of the delicious payment flaw he discovered.

In his blog titled Domino’s: Pizza and Payment, Price describes intercepting and changing the values of code given by Domino’s payment gateway Datacash after he had attempted to pay with a made-up credit card number through the Domino’s Android app.

As expected the card is declined and the App shows an error message. Let’s try our luck by intercepting the response and changing some values around. I start a new order and set breakpoints on the HTTP endpoint for the DataCash API. Once the breakpoint triggers on the response, I change the <reason> attribute value to ACCEPTED and <status> to 1 (which means transaction accepted according to the DataCash documentation).

The payment went through and Domino’s Pizza Tracker notified him that his pizza was being prepared. Price still wasn’t convinced that the modification he made wouldn’t be stopped somewhere down the line so he called up his local Domino’s to find out how far his fake payment went. Turns out Price was 20 minutes away from devouring a pizza he didn’t pay a pence to purchase, a bittersweet moment as he described it.

My first thought:awesome. My second thought: shit.
Price took the high road and told the delivery driver of the flaw with payments made using Domino’s mobile application. Domino’s has since resolved the issue.

“We take security extremely seriously and discovered this issue last year during one of our frequent reviews. We are pleased to say it was resolved very quickly,” Rod Brooks, Domino’s head of IT, told Motherboard in a statement.
What is interesting to note is that Price cites the incident as having occurred three years ago, and Domino’s claims to have discovered the issue just last year. That’s a lot of free pizza for those whose taste buds fought off their conscience.

Source : dailydot.

Share Button

1 Comment

  1. Thank you for your blog post.Really looking forward to read more. Much obliged.

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.