One shop's timing issue is another mans free dogfood
summary
A retailer coupon lets every seventh bag be free but online and in-store counters lag, so two purchases made within a 2-minute span in 2024 and again in 2025 both register the free item; a later check shows three paw progress indicator and a “not registered until picked up” design. A synchronized live test with two locations reproduces the double-free. Disclosure goes by support email after drafting with an AI; no confirmed fix and the issue remains ambiguous feature versus timing vulnerability.
AI-written summary · about
chapters (10)
- 0:00Welcome
- 1:13Coupon system incident
- 2:59Unexpected free purchase
- 4:25Time sync issue theory
- 5:52Disclosure attempt
- 6:56Testing two years later
- 7:57Feature behind the paws
- 8:40Synchronized purchase experiment
- 10:08Moral and security
- 11:11Conclusion
related talks
09mI thought we did things right until I went looking - Security errors in Norwegian websites
31mHow Double-Fetch Situations turn into Double-Fetch Vulnerabilities...
14mKeynote: Panic in San Francisco: The Critical Vulnerability That Wasn't
34mExploiting Race Conditions Using the Scheduler
32mLearn to Exploit TOCTOU Race Condition Vulnerabilities with OWASP TimeGap Theory
34mFront-End Performance - The Dark Side
08mWhat Makes Us Human? A Tale of Advertising Fraud
34mDetecting Race Conditions on macOS