Hacking Retail Gift Cards Remains Scarily Easy

In November of 2015, Will Caput worked for a security firm assigned to a penetration test of a major Mexican restaurant chain, scouring its websites for hackable vulnerabilities. So when 40-year-old Caput took a lunch break, he had beans and guacamole on his mind. He decided to drive to the local branch of the restaurant in Chico, California. While there, still in the mindset of testing the restaurant’s security, he noticed a tray of unactivated gift cards sitting on the counter. So he grabbed them all—the cashier didn’t mind, since customers can load them with a credit card from home via the web—and sat down at a table, examining the stack as he ate his vegetarian burrito. As he flipped through the gift cards, he noticed a pattern. While the final four digits of the cards seemed to vary randomly, the rest remained constant except one digit that appeared to increase by one with every card he examined, neatly ticking up like a poker straight. By the time he finished his burrito, he had a plan to defraud the system. Read more at Wired.