• @RavenFellBlade
    link
    37
    edit-2
    2 months ago

    I’d love to know what this would actually do.

    Edit: Thanks for the responses and lively discussion!!

    • BombOmOm
      link
      fedilink
      English
      862 months ago

      Assuming the accounting system this thing links with both does not protect from SQL injection attacks (many don’t, despite it being easy to protect against) and also has a table named “Bills” with a field named “amount”; what this would do is go through every single Bills record and half the value in the amount field. This would completely fuck the system, particularly when it came to billing and tax filing as the numbers for accounts billing and receivable wouldn’t even come close to matching each other. The accounting department would have a hell of a time fixing the damage.

          • @Mic_Check_One_Two@reddthat.com
            link
            fedilink
            472 months ago

            Yup. Rand() chooses a random float value for each entry. By default I believe it’s anywhere between 0 and 1. So it may divide the first bill by .76, then the second by .23, then the third by 0.63, etc… So you’d end up with a completely garbage database because you can’t even undo it by multiplying all of the numbers by a set value.

            • @Buddahriffic@lemmy.world
              link
              fedilink
              152 months ago

              Also, by dividing by a number between 0 and 1, you increase the amount it looks like it billed. So income will look like it’s higher than outgoing funds, which will raise suspicions of embezzlement. And if someone actually is embezzling, whatever accounting tricks they’ve been using to hide it might just stop working because everything might need to be examined with a fine tooth comb. “Oh, the billing numbers aren’t right, and also it turns out the invoice numbers aren’t right either. Billing issue was tracked to a hack, but what’s going on with these invoices?”

            • @affiliate@lemmy.world
              link
              fedilink
              52 months ago

              if you’re trying to be malicious, wouldn’t it be better to multiply by Rand() instead of divide by Rand()?

              assuming there are a decent number of recorded sales, you’d end up seeing many of the calls to Rand() returning values very close to 0. so, if you’re dividing by those values, you’d end see lots of sales records reporting values in the thousands, millions, or even billions of dollars. i feel like that screams “software bug” more than anything. on the other hand, seeing lots of values multiplied by values close to 0 would certainly look weird, but it wouldn’t be as immediately suspicious.

              (of course a better thing would just be to use Rand() on a range other than [0,1])

        • @dfc09@lemmy.world
          link
          fedilink
          172 months ago

          I imagine they could if they knew exactly what you did and when, but if it doesn’t get discovered until later and nobody knows what happened, it would probably be a bitch to figure out

          • @T156@lemmy.world
            link
            fedilink
            English
            72 months ago

            It seems like it would be fairly easy to find. All you need to do is find out where the price drops massively, and work backwards from there, since it doesn’t change the code going forward.

          • @SchmidtGenetics@lemmy.world
            link
            fedilink
            5
            edit-2
            2 months ago

            Pretty sure it would be obvious to anyone working there that chicken tenders are $10 not $5. Even a quick glance at any single bill would show the issue.

            • Dr. Jenkem
              link
              fedilink
              English
              72 months ago

              No it would change the value of all past bills, future bills would still be correct.

                • Dr. Jenkem
                  link
                  fedilink
                  English
                  2
                  edit-2
                  2 months ago

                  No. The bill given to the customer would still show the correct amount.

                  And if anyone looked at previous bills from the backend, they would see normally priced chicken tenders. The total for the bill would be wrong though.

      • @dan@upvote.au
        link
        fedilink
        7
        edit-2
        2 months ago

        does not protect from SQL injection attacks (many don’t, despite it being easy to protect against)

        Every modern database library automatically protects against SQL injection, usually by using prepared statements (where the query with placeholders, and the placeholder values, are sent as two separate things). so a system would have to be written extremely poorly to be vulnerable to it.

        This post is just a joke as developers should hopefully be aware of the OWASP top 10 security vulnerabilities.

        Edit: Bad developers will do bad things, but any reasonable developer should be well aware of these risks.

    • Kerb
      link
      fedilink
      37
      edit-2
      2 months ago

      its an sql injection attack.
      its rather unlikely that it works in a modern app.

      assuming this would work,
      it injects a command in the sql database.

      it is assumed that the app runs a sql querry with the input field as a parameter e.g.
      INSERT INTO "bills" (item, ammount, tip) VALUES ("steak", "20,00 $", "content of the custom tip goes here");

      the semicolon indicates the end of the querry,
      so the the text would cause the app to run an unfinished querry, and then start a new querry that messes up the content of the bills table.

    • @diffcalculus@lemmy.world
      link
      fedilink
      English
      282 months ago

      Nothing. For one, it won’t let you enter letters. Two, the table structure to these POS systems are more nuanced than a simple bills table with am amounts field.

      It’s amusing and all, but it’s not something you can do.

      Source: work with, and develop around, these types of POS systems.