Hacker News Reader

Comment by jbob2000 | Hacker News Reader

jbob2000

So now I can script a bot to book restaurant reservations all over the city at busy times. Then nobody shows up for the reservations, the busy time has passed, and customers have moved on or gone home.

Restaurants make or break on one or two nights in a month. A calculated social engineering attack like this could bring down hundreds of restaurants in a city, which would cause millions of dollars in lost taxes, and you see where this is going.

View on HN

Someone has already done that: https://chicago.eater.com/2018/3/5/17078210/opentable-reserv...

Was there something stopping you from doing that before? A lot of places you can even do it online.

literally effort. when you lower the attackers effort and cost to try an attack, the attempts generally go up.

I meant, you could build a bot that calls. We have the technology already, and the people on the other end probably won't notice. Plus the "do it over the Internet" thing where screen scraping and scripting is super easy.

But could you build a bot that calls and is convincing enough to trick the target into actually accepting the request as genuine and reserving the timeslot?

It could most likely be done on any internet reservation system with little to no effort.

Yes, the time commitment of having one person pickup the phone and place 100+ phone calls (and the suspicion on the other end when you call back with a new name but the same voice).

You could write a screen scraper to book online through the various booking systems, but each booking system probably has its own restrictions on how many accounts you can have and how often they can book. You skip all of these protections when you phone your reservation in (arguably, the restaurant staff should be enforcing these protections when they pick up the phone, but restaurant staff are often overworked and apathetic).

Then the restaurants will just stop taking phone reservations. Either no reservations or online-only.

I agree it's a problem. The probably means of mitigation is for restaurants to take your credit card number when you book. Many already do this. I expect it to expand if false bookings become a problem.

To be fair I think any mediocre dev could do that now simply with headless browser automation.

How would you script "script a bot" - i think you're underestimating the effort. You'd have better luck trying to attack by mass booking manually.

You adapt. Take valid CC info and charge cancellation fee.

Reply on news.ycombinator.com