Hackeei uma Máquina de Chopp 🍺

Summary

In this engaging video, Gabriel Patos explores the vulnerabilities of a popular smart beer tap system that allows users to fill their glasses via a mobile app. By analyzing the app's communications and dissecting its code, he uncovers a significant security flaw that permits unauthorized access to any tap without payment. The video highlights the creative process of hacking, illustrating how simple observations can lead to profound discoveries. Patos emphasizes ethical hacking by reporting the vulnerabilities to the company and advocating for responsible use of hacking skills while inviting viewers to join his educational platform, Pato Academy.

Takeaways

• 😀 The increasing popularity of drink-dispensing machines connected to mobile apps raises concerns about potential vulnerabilities.
• 🔍 Gabriel Patos embarks on a hacking journey to discover if he can exploit these machines to dispense drinks for free.
• 📡 Initial attempts to capture HTTP communication between the app and the server highlight the challenges in intercepting secure connections.
• 💻 By decompiling the app, Gabriel uncovers hardcoded tokens and a different communication protocol used by the machine.
• 🛠️ The analysis reveals that the app does not require proper authentication, allowing unauthorized users to access the service.
• 🚪 Gabriel successfully crafts a request to open the drink tap, demonstrating the vulnerability in the machine's security.
• 🎉 The machine responds positively to unauthorized requests, enabling Gabriel to dispense drinks without payment.
• 🛡️ Gabriel emphasizes the importance of ethical hacking and responsible disclosure of vulnerabilities to the company.
• 🤝 He communicates his findings to the CEO, ensuring no users were harmed and offers to pay for the drinks dispensed during his tests.
• 📚 Gabriel invites viewers to join Pato Academy to learn more about ethical hacking and security vulnerabilities.

Q & A

What is the main focus of Gabriel Patos' exploration in the video?

Gabriel Patos focuses on discovering vulnerabilities in a beer-dispensing vending machine, demonstrating how the app communicates with the server and how these communications can be exploited.

What initial step does Gabriel take to start his hacking process?

Gabriel begins by capturing HTTP communications between the app and the server using an iOS app called Proxyman, which logs the requests and responses.

What did Gabriel find when he attempted to capture the communication for the machine's operation?

He discovered that the communication did not occur over HTTP, indicating that a different protocol was used, prompting him to investigate further.

How did Gabriel analyze the app to understand its communication with the server?

He downloaded the Android APK of the app and used a decompilation tool to generate readable Java code, allowing him to examine how the app interacts with the server.

What key information did Gabriel uncover from the app's code?

He identified a hardcoded private token, user identifier, and the structure of a JSON object that the app sends to the server, which was crucial for his hacking attempt.

What was the significance of the 'Open Tap' command that Gabriel discovered?

The 'Open Tap' command is the action that allows the machine to dispense beer, and Gabriel used it to send a request to the server in order to manipulate the machine.

What ethical considerations did Gabriel mention regarding his hacking activities?

Gabriel emphasized the importance of ethical hacking by stating that he reported the vulnerabilities to the company and took steps to ensure no users were harmed during his testing.

What result did Gabriel achieve by sending a JSON request to the server with manipulated user IDs?

He was able to successfully open the tap of the machine, allowing beer to be dispensed without payment, showcasing a significant security flaw in the system.

How did the company respond to Gabriel's findings after he reported the vulnerabilities?

The company appreciated his responsible disclosure, confirmed that no users were harmed, and even provided him with credits for future use, reinforcing the importance of ethical practices in hacking.

What does Gabriel encourage viewers to do at the end of the video?

He invites viewers to join his platform, Pato Academy, to learn more about hacking and to understand how to find and responsibly disclose vulnerabilities.