Kiosk mode bypass for an Ariane Allegro Scenario Player based hotel check-in te
pentagrid.ch
pentagrid.ch
I was expecting some kind of SQL injection, which you could at least understand as a result of incompetence. Or I can similarly understand UTF-8 bugs or whatever.
But it's not like O'Brien is an uncommon name. I don't know if I'm more mystified by the fact that this made it past testing, or that rather than the reservation lookup just returning no matches it actually crashes.
I'm really trying to imagine what possible code could be crashing. I guess my best guess is an off-by-one error in a function trying to escape strings for use in a SQL query, that leads to inserting infinite quotes and running out of memory. But then I can't imagine who would be writing their own escaping function...
Satisfied, he declares the bar ready for business.
The first customer comes in and asks where the bathroom is. The bar explodes.
In 2018 Apple became the first company to reach a market capitalisation of one trillion dollars.
So — in answer to “How the heck does a bug with a single quote make it past QA, let alone crash an app?”
Humans aren’t really as clever or discerning as we claim to be.
I've reviewed code where the Linux kernel documentation states the function WILL return -1 if the feature is disabled, pointed it out in code review, they merge it later (completely ignoring my comment), then get the ticket where the user had disabled the feature in their micro-kernel and the app crashes.
Sometimes, it's like some devs just don't care about the unhappy paths.
https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...
I don't think it was crashing, but a few years ago I fixed a bug on the app I'm working on, where we had issues with apostrophes in names with SQL Server (where single apostrophes in strings have to be escaped with another one); as it turned out, another dev had written a buggy replace function, the fix was just to use the replace built in the standard lib. I don't think the dev had written a full escaping function, it was just a method to deal with the apostrophes.
Ugh. I've been in a similar scenario and had to report a security bug via the normal support channel for a fairly large-sized company. Never again. It was significantly more work to get the bug in front of someone who understood it and could do something about it than it was developing the exploit in the first place.
After a certain company size it should be a legal requirement to have a dedicated security contact listed somewhere.
Now, after a few good faith attempts to get an exploit in front of the appropriate person at a company, I just forget it. I'm sure there are people in similar situations who, after a few attempts to report to the company, end up selling the exploit rather than forgetting it.
Then you can plug in a USB key and do whatever you want.
Ariane doesn't give a single shit.
With Linux and X, it is possible to run X server with a specific app inside. You crash the app, it restarts together with X server.
Of course, in Windows you can specify a different app other than Explorer.exe as "shell" and get a single app session! It just doesn't get used because:
Unfortunately, these systems seem to always been developed by especially clueless people who only ever have seen hammers in their lives and therefore everything looks like nails.
Having said that, the quality of embedded programming always looks subpar. It's like these people see themselves as hardware makers and therefore think they can avoid learning software making 101.
Here's the truth: for any organization the most secure operating system is the one your people have experience in. That's it. Good Windows sysadmins can run a secure Windows shop and bad Linux sysadmins can run an insecure Linux shop. It's the people.
Desktop Windows isn't made for kiosk applications at all, unlike the long gone (and barely related) Windows CE. It's all various sorts of bolted-on crapware.
I've also encountered Linux kiosks where the app crashed and it is just sitting at a busybox terminal with root access as well.
If you even slightly know how Windows IoT or Embedded works, setting up a Windows kiosk is pretty dang simple. There's simple wizards baked into Embedded/IoT that walk you through it.
> Desktop Windows isn't made for kiosk applications at all
Fully agreed here. They messed up shipping this with what appears to be full-fat Windows 7. Dumb move on their part.
https://web.archive.org/web/20240605075458/https://www.penta...
I think I found the problem
https://learn.microsoft.com/en-us/windows/iot/iot-enterprise...
However sometimes if you plug in a keyboard and hit ctrl-alt-del you get task manager and can run additional programs.
I can imagine the Allegro app uses a virtual keyboard of some type for this user entry, and it goes south from there.
I can see why most companies prefer Windows though for these type of devices. Driver issues with graphics and third party hardware are a constant pain point for us.
Unless you control the whole ecosystem and write your own drivers (e.g. smart TVs), Linux based systems are tricky. I'd imagine Windows has the same issue to some extend, but it's the default target for manufacturers, so their Windows drivers are usually better.
I feel there could be a market for a custom Linux OS aimed for these use cases. Windows licensing is not cheap when you have tens of thousands of devices, and they aren't running the 'Home' version.
Customer maybe can’t understand/accept the real cost to do a good job.
Matching this, management probably prioritises hitting deadlines over anything else and multiplying the problem by employing unskilled developers and testers to save money.