One day someone will use the SQL injection to execute code on the remote server to add message to the web site that tells the workers to unionise and demand actually fair wages and put an end to the whole tipping nonsense
I’ve had transactions flagged for (intentionally) leaving large tips before. These large tips were justified for various reasons, such as comped meals.
What makes you think it was flagged for a large tip specifically, rather than just an unusually high transaction?
It still confused me how they would know it was a $20 steak and $80 tip versus 5x $20 steaks and no tip. It would appear the same, a $100 transaction at Bob’s Steakhouse.
The message specifically said it was due to the “unusually large tip”. They wanted me to confirm that it was intended.
If the article linked below is to be believed, the credit card company does indeed know how much of the transaction is a tip due to the way the transaction is processed. Note that this was at a full-service restaurant, not tipping at the counter for fast food or some other thing.
Consider when you pay with a credit card at a sit-down restaurant, they read the card first. Then you write in the tip on the receipt, meaning that they process this part later after the initial card reading. It is probably different with the tabletop self-checkout devices though.
I hate %, give me a option to round up to the nearest 5. This is useful for my financial tracking, and I’m willing to bet a lot of people would like nice round numbers. If I buy a coffee or whatever and it’s $7 I round up to $10, not because I’m trying to give a good tip but because it’s more convenient for me when I’m sitting there doing my finances (I track everything) and while I know that not everyone would universally agree maybe they would only want to round up to the nearest whole dollar the fact remains I feel like most places would actually end up with more total tips overall if that was a one button option
The meme says “IRS”, so it’s obviously intended to refer to America.
But outside of that context, they’d fucking deserve it for their shitty dark pattern UX trying to export American tipping culture into the civilised world. If people want to tip, they can do it using cash (so the money actually goes to the person you intended it to!). Or at most, there could be a little “tip” button in the corner somewhere that then takes you to a page like this. It shouldn’t be shoved in our faces like this.
Camden in Sydney? That’s appalling. It’s bad enough to be presented with a screen like in the OP. Needing to actually speak to a person to not have a tip added sounds probably illegal.
Ah right, cheers. Tbh my first guess was that it might be a place in Britain, but I didn’t know so I Googled it and all the results were about Sydney (including one from brittanica.com…).
Well, we did almost end up in Canberra at one point, but as luck would have it the wife’s boss didn’t support the transfer. It’s no Sydney, but anything would have been better than staying stateside. I don’t really miss it, and all my friends say it’s worse now 🙂
Am farmer, can confirm. I also have my chequebook with me… Non-farmers, when was the last time you wrote a cheque, aside from rent? I feel like we’re the only ones still using them.
In most places even if you tip cash they are supposed to keep that for the tip pool and it is split. Often among the cook staff and other people at the restaurant.
Live in a country where tipping is practically unheard of. Lately pay terminals have started appearing in restaurants that have asking for tip enabled by default, and restaurants often don’t know how to disable it.
Well, at least there are some safeguards. I was handed the terminal so I put in my PIN code, not realising it was actually asking for a tip. I was pretty confused when it said “value too high” or something like that.
The owners know how. They also know that by leaving it there they make extra money on top of sales. They also know that the person getting berated for having it there is the worker who can’t change it.
Owners are often the biggest morons at the location.
Before that, I used the same basic software package at Subway because the owner couldn’t be bothered, and the manager, great lady, was not technically apt.
Americunts shit on you when you tell them tipping culture is bad. Like, here in my third world country, where we all earn a misery compared to the minimum wage in burger land, we can say no to tips or just give a few cents or some more…fuck this. Food is already expensive. I am not going to waste extra cash for my food.
Plenty. I have had people tell me I am inhumane for criticising tipping culture, and if I point out it is related to the extreme class system and slavery history of America they downvote me to hell and try to justify that it is “land of tha free” or whatever.
They don’t even have freedom from hunger or illness in their messed up country.
And tipping culture has creeped in both magnitude (i.e. 15% used to be standard, but now it’s the low end) and scope (e.g. tips prompts at fucking fast food places)
I’ve seen plenty of wait staff show up to defend tipping in Reddit threads. They’d rather shame customers than demand fair wages from their employers. Or maybe they were all just bots.
I think those people tend to make a lot of money off tips. There have been times I could get way more than you’d get from any paycheck a restaurant would ever be willing to pay, even with the laws changed for that sector, for “less” work. Depending on the place you work at you could have $300+ a night cash Friday-Sunday and that’s me going back to what I remember from 12 years ago so who knows what they’re able to get now.
I don’t even make $900 a week now in a psudo-managment position in a factory. Not that the $900 is consistent there for those in food service, I just think that’s one reason people would be openly resistant to the idea of changing how tipping works.
I’ve seen a lot of people, including servers and diners, defending tipping culture.
Sadly.
I’m on the side of tipping while in a tipping culture, but only because of the crap way servers are payed and they’re the only ones hurt by protesting through refusing to tip. Otherwise, it’s a practice that needs to die.
You could probably also try peeling off the outer plastic of the device so you can access the USB port and plug in an external keyboard, but the person holding it might notice
In my country, we can buy pre-paid credit cards in the supermarket using cash. I guess that is still traceable using supermarket security cameras and facial recognition, but if you’re attempting this, I’d make it as difficult as possible.
Maybe. If they can identify which record was the last one changed and the last one changed its directly related to the one that made the change and the ended transaction statement successfully posted a transaction
If the SQL injection crashed that person’s transaction there’s little chance of finding the culprit
Assuming the accounting system this thing links with both does not protect from SQL injection attacks (many don’t, despite it being easy to protect against) and also has a table named “Bills” with a field named “amount”; what this would do is go through every single Bills record and half the value in the amount field. This would completely fuck the system, particularly when it came to billing and tax filing as the numbers for accounts billing and receivable wouldn’t even come close to matching each other. The accounting department would have a hell of a time fixing the damage.
Yup. Rand() chooses a random float value for each entry. By default I believe it’s anywhere between 0 and 1. So it may divide the first bill by .76, then the second by .23, then the third by 0.63, etc… So you’d end up with a completely garbage database because you can’t even undo it by multiplying all of the numbers by a set value.
if you’re trying to be malicious, wouldn’t it be better to multiply by Rand() instead of divide by Rand()?
assuming there are a decent number of recorded sales, you’d end up seeing many of the calls to Rand() returning values very close to 0. so, if you’re dividing by those values, you’d end see lots of sales records reporting values in the thousands, millions, or even billions of dollars. i feel like that screams “software bug” more than anything. on the other hand, seeing lots of values multiplied by values close to 0 would certainly look weird, but it wouldn’t be as immediately suspicious.
(of course a better thing would just be to use Rand() on a range other than [0,1])
Also, by dividing by a number between 0 and 1, you increase the amount it looks like it billed. So income will look like it’s higher than outgoing funds, which will raise suspicions of embezzlement. And if someone actually is embezzling, whatever accounting tricks they’ve been using to hide it might just stop working because everything might need to be examined with a fine tooth comb. “Oh, the billing numbers aren’t right, and also it turns out the invoice numbers aren’t right either. Billing issue was tracked to a hack, but what’s going on with these invoices?”
does not protect from SQL injection attacks (many don’t, despite it being easy to protect against)
Every modern database library automatically protects against SQL injection, usually by using prepared statements (where the query with placeholders, and the placeholder values, are sent as two separate things). so a system would have to be written extremely poorly to be vulnerable to it.
This post is just a joke as developers should hopefully be aware of the OWASP top 10 security vulnerabilities.
Edit: Bad developers will do bad things, but any reasonable developer should be well aware of these risks.
Every modern database library automatically protects against SQL injection,
No. Every modern library allows using prepared statements, but very few (of any) force using them. If the developer doesn’t use them the libraries won’t do shit to protect you.
What I meant is that not many people write raw SQL in product code any more, other than for analytical purposes (which are often in a system like Apache Airflow rather than in product code). ORM systems have mostly taken over except for cases where you really need raw SQL for whatever reason.
First, injection attacks are third on the owasp list, although they do roll xss into it too, which changed the name, since “shit sanitization on input” and “shit escaping before use” are the cause of both. owasp.org/Top10/A03_2021-Injection/
Secondly, SQL injection is freakishly common and easy. I don’t know of any database libraries that prevent you from directly executing an SQL literal, they just encourage parameterized statements.
I have personally run into plenty of systems where people build SQL via string concatenation because for whatever reason they can’t use an orm or “proper” SQL generator.
You can find them in the wild fairly often by just tossing ’ or 1=1;– into fields in forms. If it gets mad in a way that doesn’t make sense or suddenly takes forever, you win!
That one was a treat when I check under critical, since it’s an injection attack that can bypass parameterized query protections for the database driver, which is why “defense in depth” and “always sanitize your fucking inputs” are such key things to remember.
I hope that provided what you’re looking for, and maybe increases your awareness of SQL injection. 😊
I imagine they could if they knew exactly what you did and when, but if it doesn’t get discovered until later and nobody knows what happened, it would probably be a bitch to figure out
It seems like it would be fairly easy to find. All you need to do is find out where the price drops massively, and work backwards from there, since it doesn’t change the code going forward.
Pretty sure it would be obvious to anyone working there that chicken tenders are $10 not $5. Even a quick glance at any single bill would show the issue.
Yeah, obviously the issue can be discovered. My point is that it’s not going to be immediately discovered by the cashier or a customer. It’ll probably not get discovered until the accountant comes by and notices the discrepancy.
Nothing. For one, it won’t let you enter letters. Two, the table structure to these POS systems are more nuanced than a simple bills table with am amounts field.
It’s amusing and all, but it’s not something you can do.
Source: work with, and develop around, these types of POS systems.
its an sql injection attack.
its rather unlikely that it works in a modern app.
assuming this would work,
it injects a command in the sql database.
it is assumed that the app runs a sql querry with the input field as a parameter e.g. INSERT INTO “bills” (item, ammount, tip) VALUES (“steak”, “20,00 $”, “content of the custom tip goes here”);
the semicolon indicates the end of the querry,
so the the text would cause the app to run an unfinished querry, and then start a new querry that messes up the content of the bills table.
Add comment