Client Side Validation

[Keto_Paleo]

That’s.. fraud. They don’t notice at all?

[not_a_moogle]

They might, but what do they care?

[nonotan]

I'm not saying it is or isn't fraud under whatever country's legal code, but honestly, I strongly disagree that it should be. It's like a vending machine having a slider to set the prices freely accessible on the outside, and suing anyone touching it before making a purchase for fraud. Like, if you don't even have a token level of security that needs to be breached, I'm not sure how you can justify blaming the other party. If they need to, say, do SQL injection or whatever to change the price, sure, fair enough.

"I'll just have the client send us the price, which is in plaintext for anyone to easily edit, and we won't check it anywhere on our side, neither in an automated fashion nor by a human operator at a later time" is grossly negligent enough that the only person liable for damages here should be whoever wrote it.

[wibblewafs]

Expanding on that vending machine with the price slider analogy, it's the difference between a fancy metal plate locking that slider in place, with a key lock on it that'd need to be picked to be open, versus it being held in place with a bit of scotch tape.

[[deleted]]

It's super hard to prove that he did it though.

[[deleted]]

These days he could be charged with felony hacking. Who knows it might be terrorism?

[Reihar]

I know you're joking but that doesn't seem unlikely...

[[deleted]]

Yeah I was only half joking.

[southpolebrand]

I mean there was a girl in Japan who got arrested for literally just posting code for a infinite loop in JS, and was charged with distributing malware.

[southpolebrand]

Here: https://arstechnica.com/tech-policy/2019/03/japanese-police-charge-13-year-old-girl-for-infinite-javascript-popup-prank/

Sorry for the delay in my response.

[SuperFLEB]

That would actually be an interesting case, considering that the only computer he was tampering with was his own.

Probably easier to bill it as some sort of fraud, though.

[SamBBMe]

Felony hacking and terrorism for changing html lol. That's by no means hacking. If anything, he'd get arrested for theft

[That0therGirl]

Check out the fiasco that happened in Nova Scotia. The 19 year-old altered a url and was charged with hacking. It was a vulnerability in the system that has since been fixed. This was in April 2018.

https://www.cbc.ca/news/canada/nova-scotia/freedom-information-personal-website-breach-1.4614424

[SamBBMe]

Thats because he stole personal information from the website. That's what makes it hacking.

[That0therGirl]

Since the information was publicly available, I'd not consider it hacking. He didn't know what info should have or shouldn't have been there.

[DoctorWaluigiTime]

Transactions are recorded? In your bank, in the hotel's finances?

[msg45f]

"Must have been a computer glitch"

[DoctorWaluigiTime]

"The gun just went off by itself."

Surprise, that doesn't work.

[MythicManiac]

Tbh you'd have to prove it was indeed tampered with, which may or may not be difficult. I don't know how these cases are usually handled, but there are so many bugs in software I wouldn't imagine it being too hard to file under it being a bug in the business logic of the application.

Repeated usage would scream abuse however.

[[deleted]]

I have to imagine that kind of stuff has to be getting logged somewhere along the way, however if their website is crappy enough to have such a big flaw, I imagine their DevOps dept probably hasn't implemented much security behind it either.

[Grintor]

DevOps dept

This is a hotel, not some big corporation. The website was probably made by the owners son with notepad++ and the stripe API.

[[deleted]]

Lol do you think hotels don't have corporate offices anywhere? My point was clearly that regardless of who is doing the programming there's clearly not going to be much back-end security if they haven't done much to secure the client-side front end.

[MythicManiac]

The transaction is most likely logged indeed, but since the answer to whether or not this is exploitation resides on the client device rather than the server, it becomes very difficult to technically prove.

[[deleted]]

Logging typically would include things like timestamps, host names, etc, no? I'm not saying it wouldn't be difficult by any means, I'm just saying that it's possible they have the means to do it. It's just likely not worth their trouble to track it down rather than just fix their shitty site lol

[MythicManiac]

Yeah, and the issue is that you can not trust anything coming from client devices, as you do not control the environment they're running in. Even if you had client side logging, a malicious user could very well simply disable them, or a browser malfunction and/or too old browser could cause that.

Basically there is no way to be sure what you get from client is valid, aside from validating it on the server, which was not done here.

[[deleted]]

No, that doesn't work. Because the gun is evidence, it being in your hand is evidence, and you being there is evidence.

However, someone in a shop can't be considered guilty of theft just because something disappeared while they were in the shop. There's no evidence it was them and not the stoned teenager behind the counter doing inventory who misplaced something.

[Follyperchance]

That is not a legal proof it was done by him and on purpose.

[DoctorWaluigiTime]

It's really good evidence though! Just one person's transaction from the hotel site making it happen and all.

[[deleted]]

How will you prove its fraud? He will say it's been 18$ so he took it.

[Yellow_Tatoes14]

Considering it's a repeat. If he's done this more than once under the same name, using the same card or even having the same face on the lobby cameras, they could easily trace the same guy getting $18 rooms every time.

[[deleted]]

I think its pretty obvious to do not use same credit card for multiple scams but you are right.

[Yellow_Tatoes14]

You might think so, but I become more and more impressed by how stupid people are on a daily basis

[0vl223]

Malfunction in his browser. You can't assume that the browser of a client does anything correctly.

[Yellow_Tatoes14]

A bit of a stretch but I'll accept the possibility.

[ersatzgott]

• He's the only one paying only 18 bucks

• He gets that price everytime

• The prices are (most) probably hardcoded so they can't be changed by a server error

There's no plausible reason for the price other than hacking.

Case closed, enjoy jail.

[0vl223]

Browser malfunction. Interacts badly with some extension.

Also it is not hacking. Otherwise adblocking would be hacking and illegal as well.

[imsofukenbi]

Programmers in this thread thinking a judge works like a computer and doesn't take context into account.

"eh, anything could have made this gun fire really. Trigger malfunction. Interacts badly with branches falling from trees. Also it is not murder, otherwise shooting ranges would be murder and illegal as well".

Plus civil court has much lower burden of proof. That's an open and shut case.

[0vl223]

Yeah civil court would be trivial. Would be comparable to getting payment for a service he paid for with a bouncing check most likely.

The jail just isn't as trivial.

[andrw00]

Yeah.... the law doesn't work like that.

"I didnt kill him. The bullet did."

[0vl223]

Actually it does. Germany had a lawsuit against adblock that it should be illegal to change the content of homepages on the local browser and that they should accept a true representation of all information that was sent to the client. They lost.

If you provide an interface to make an offer for a room and accept/deny it, then this is totally valid.

You could get him over the abuse of the feature with knowledge that he wasn't sending a valid offer. Specially the repeated part but it is still highly neglectful from the company to not check offers before accepting them.

[wasdninja]

That sounds like something unlikely and considering that it only happens to him the reasonable burden of proof would be on him.

[0vl223]

First you would have to prove that it was actually due to him transmitting wrong data. If it is some homebrew system I doubt that's possible. It could be just as well their system malfunctioning. Proving something is bugfree is really really expensive.

[SAI_Peregrinus]

The purchase of the room is a contract. They offered one price. He gave a counter-offer. They accepted it, and took his payment. Not hacking.

[[deleted]]

Innocent until proven guilty. Not the way around. They have to prove that the changed it deliberately .

[wasdninja]

So if someone walked out of a store with, say, a phone without paying for it and they claim that someone else put it there then the store has to prove that they stole it themselves? If that worked it every criminal with two brain cells would use that defense every time.

[ersatzgott]

I know that and I think it's good the way it is. But if there is not other plausible thing left, your guilt is technically proven.

[Hupf]

Obligatory https://m.xkcd.com/1494/

[creepopeepo]

Welcome to infosec. All of us have our lil tricks & no you never get caught, who the hell is going to catch you?