Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2035 Thanks!
[Laughter]
[Music]
[Laughter]
hello and welcome to the interair the
r3s stage on the internet let's speak a
bit about the talk that we're going to
watch um it's about unwinable prices on
the internet and uh you have seen it uh
on different websites where you can spin
something and you can win something very
interesting like magnetic monopoles or
something like that and um are and um um
and we will learn if that's possible if
you can win something and if and if you
can win something how you can do that uh
with that passing over to hbert yes
thank you very much uh so yeah my name
is Roland meens uh I uh you can ask me
any questions on my email uh and yeah my
uh talk will be about uh unwinable
unwinable prizes on the internet so
sometimes you find uh websites who
indeed promise you prizes and uh you
can't win them uh that's uh maybe uh
already um a bit of a spoiler um but the
way in which you cannot win them was a
bit surprising to me so and I think it
makes a funny story so hence this talk
uh so I want to go over how in what way
you cannot these prices I'm going to go
a bit over how you can discover this how
I discovered it and how you can discover
this for yourself and uh last but not
least I'm going to talk a bit about what
can you do when you discover such a
website what can you do about it or
against it so yeah first maybe uh how it
started at some point I was uh having a
call with a friend and she clicked uh on
some Facebook link uh to a website where
you could buy a edible cookie dough
which you don't even have to bake you
just eat it directly ly and when you
came to his website it uh basically
there was some popup which said uh said
click here to win a prize and when you
clicked it it said uh spin the wheel
leave your email and you can can win uh
one free kilo of cookie dough yeah
amazing right who doesn't want to win
this um and not only could you win this
free kilo of cookie dough I took a
screenshot of the spinner you saw there
and that's that's on the slides you
could also uh make your own Taste of
cookie dough in their kitchen amazing I
love cooking I would love to make this
uh my own taste in their kitchen you
could win a discount of 50% that's quite
a lot of uh discount uh you could win a
kilo of cake better that sounds like a
great price you could also win 5% of a
discount uh which you can also see there
but after you spawn it uh after you spin
the spinner or after I left my email uh
or let's first start with after my
friend left uh her
email
um they said no luck so she didn't win
anything uh so that was uh that was bad
especially since there are 1 2 3 4 five
there's like 10 10 places the spinner
can up in apparently there was one which
said no luck uh then uh I entered my
email and again the spinner spun and it
ended at the same square no luck well
that's uh that could be unlucky of
course but then I started wondering what
is actually the probability of winning a
prize here um or maybe to put it more
clearly I think the question is what
does this website pay you in return for
them giving uh you uh your email address
because normally I would have never left
it uh so first I attempted to look at my
network traffic so I thought probably
when I submit my email address to this
website they send it to some server who
then of course registers it and adds it
to some database where they uh from
which they spend me their uh new flavors
or something um so I started Postman
started monitoring my traffic and I th
was a bit uh surprised because the
server didn't reply with that I won or
didn't win which basically means that
order logic is actually in the browser
um so I think everybody knows that if
you want to see what the website is
doing you can look at their uh
JavaScript and at their HTML codes uh so
of course I uh opened the inspect sour
Source uh page in Chrome um and one
thing which I noticed a lot of people
don't know is that you can also edit
code if if you uh right click on a file
in Chrome you can save it for overwrites
and the logic for the spinner was indeed
in the browser everything was hand outed
for what you can win and what your
probabilities are was indeed handed in
my browser so of course that's fun uh
that means you can modify their
JavaScript so I found this function in
it which had a load Json thing um and
there I added some code which you can
see on screen it's not really
interesting but what I basically did is
I took all of their prizes you can win
in the spinner and I locked the
probability and uh so that's how I could
find the true probability of this
website in this case uh there was uh a
95% probability of not winning a price
um I thought that was bigger than uh
than the spinner showed me um there was
a 5% chance of a 5% discount uh it's not
such a high discount but there was you
could at least win it there was a 10%
chance of a 10% or sorry a 1% chance of
a 10% discount but everything else like
the free kilo of cookie dough the 50%
discount the free cake better um making
your own taste in their kitchen of
course uh there was a 0% chance of
winning it so yeah I thought that was a
that was a bit lame um so yeah the
conclusion uh of the first part of the
talk is of course you can't win any of
these interesting uh prizes on this
website um but yeah that's not the end
because we could modify the JavaScript
right so first of all I thought that
only 5% chance of winning uh this uh 5%
disc uh discount was a bit low so you
can of course change that and that way I
could always win uh win this uh 5%
discount so cool but then uh I thought
oh well that means of course I can also
win this best price this free kilo of
cookie dough right uh it Set uh by
default it said do win is false but I
can change to true I can set the
pability too a lot and the result was an
error so it looks like this website
didn't even Cod the logic for winning
these interesting prizes
so that's uh that's not very nice um so
yeah of course now I concluded this for
one website but I was wondering uh do
more websites use this practice so it
turns out this particular website was
using uh Shopify uh and in Shopify you
can have a lot of plugins so in this
case this website decided to install the
spin a sale plugin and if you go to this
um plugin U Shopify you see that it's
very popular it's uh got a a lot of
positive reviews and uh a lot of people
gave it five stars because it really
increases the amount of people that sign
up on websites to get their spam um and
if you look at the reviews there's also
a lot of written reviews and then
sometimes owners left their email uh or
their um uh website domain so I found
way more of these uh places where you
could win interesting things uh from
barbecues to Rodeo equipment to I don't
know what but a lot of these websites
were basically promising big prizes
which you couldn't really win um so yeah
there's one uh by the way there's maybe
one website which I did really like
there was this website which uh also
made some prices unwinable but they
basically uh set the probability for
winning nothing to zero and they always
made sure that you won a reasonable
amount of uh of a discount so I thought
that's uh that's also uh fun but yeah
the amount so the probabilities you see
here uh don't really correspond to the
actual probabilities you have in the app
um so that maybe brings me to the to the
last question is this ethical or legal
and what can we do about it so uh if you
go back so I had many discussions with
friends about what did you think about
this uh when I discovered this I think
that most people were kind of amazed
that when they see something like this
they didn't really expect that the the
probabilities you see on this spinner
are exactly the probabilities you get so
I think that most people didn't expect
you to have a 10% chance of winning a
lot of cookie dough but I think that
people didn't expect the actual spinner
to look like this on the screen so I
think that most people expected you to
have a a bit of a fairer chance to win
anything um so yeah I give my email in
return for a fair chance to win specific
prizes that's the reason I sign up but
the shop owners of course don't keep up
their end of the deal and uh they only
give gave me a very small chance of a
discount and a very big chance of having
no price um so yeah I think that's uh at
least the conversation I had with my
friends a lot of people are not
surprised that the probabilities are not
correct but people are surprised that
they are so incorrect and you cannot win
those prizes um so what I did is I
emailed the owners of the website so I'm
going to paraphrase it and not show the
actual email but I said hey I can't
really win any of these big prizes I
figured it out and uh the first reply I
got was oh let me ask the website
builder I'm mostly making tasty things
he uh the he he was actually actually in
the actually in the email uh so that's
why I'm adding it here but that made me
a bit sour I thought yeah I mean you're
obviously not keeping your end of the
deal when I sign up with my email so I
asked them two more times to change it
and later they said oh we changed it and
I looked at their website again and they
didn't really change it um later they
did change it a bit
uh but they kept some uh interesting
prices like making your own taste in
their kitchen so they as you can see
here they did replace a lot of things
with just oh you get a
discount uh I think they gave you a way
bigger chance to win this 3% discount so
at least people always got something um
but they still included some prices
which are uh which are not uh actually
winnable um but yeah that may be brings
me to the to the part of is there a law
against uh against lying on the internet
uh you would of course probably not but
uh I discovered that there's this
Authority for consumers and markets this
was a Dutch website by the way so I'm
only quoting the Dutch authority of
consumers and markets the outo retied
consument and Market in the Netherlands
and I uh actually actually reached out
to them and they seem to be quite uh
quite happy with messages I sent them so
to again paraphrase them uh they said uh
in Dutch but I'll translate it uh in
case a seller has an action in which
some prices can't be won
uh this apparently can be seen as an
unfair commercial practice and
apparently the authority of consumers
and markets in the Netherlands does try
to monitor compliance with this
legislation uh I also asked them what
they can do about it so if I go to them
and I say hey these these websites are
uh having this unfair commercial
practice uh what can you do about it and
they said oh yeah please uh please reach
out to us um and besides contacting the
firm and asking for a commitment they
can apparently give companies a fine if
they refuse to change their way of
working uh so that's uh that's at least
one thing you can do if you find
practices like this on the
internet um yeah and as I said uh when I
talked to them they seem to be quite
eager to actually do something about it
which I was amazed by uh I didn't really
expect anyone to care about this except
for me who found it a really funny story
um so yeah the conclusions are basically
uh uh no you cannot win any of these
interesting prices uh on these and other
websites I checked um we also learned
that you can save your JavaScript
locally uh so you can discover this um
we discovered that you can find a lot of
websites which use this plug-in and uh
if you ever find unfair commercial
practices uh like unable prices on the
internet you can report such sites at
the AO retired consument Market in the
Netherlands um so yeah that's it for my
talk if you want to reach out to me I
don't know how smart it is to at the end
of this talk give my real email uh but
you can email me at Roland gmail.com uh
my GitHub is aans and I think I'm mostly
active on LinkedIn or Twitter so uh add
me there and follow me there um yeah
that's
it I'm kind of suspecting that someone
like walks on stage now uh
cool uh
so sorry uh this one CAU me off guard um
I was expecting it for to last t a bit
longer um let
me see if there are any questions so
far
um none so none so far but hopefully so
people remember you can put them in the
Twitter in the twitters in the in the
masteron of this world and also uh on
the
um um uh in the uh in the IRC in the in
ha in channels r3s or rc3 so
um uh I I do have one question um did
you in this whole Endeavor stumble upon
a website that did things fairly like do
you have I mean honestly I I was kind of
expecting that it is a scam this this my
expectation I I was surprised that you
could actually win anything um and uh
the thing is um are there legitimate
websites who do that who implement this
spinning wheel fairly yeah so as I said
I think that I I also didn't expect the
wheel to have the exact probabilities
which are there but already there I
think when I talk about this with
friends a lot of them say oh I
I they were already amazed at that these
probabilities are not the same um I
think you have to kind of see it as if I
would stand on the street with uh with
the actual wheel and I would say hey do
you want to win a Kil of cookie though
and you you don't see this on the wheel
you would of course never leave your
email it would be weird um what I what I
did like is this one website of which I
gave an example which uh set the
probability of no price to zero and made
sure that you always won or the biggest
chance you had there was winning a 20%
discount on their rodo I thought it was
and they also had a small chance of
winning 25% with uh but then you had to
order for at least $300 or something
okay so I think that's fair but yeah a
lot of the so the discounts seem to be
quite like given gener generously uh
because I think that encourages to to um
buy more more yeah yeah but the the
things like free free stuff um
that that just seems to be not winable
um okay oh sadly I put I put my phone
away for a second and there like 500
questions not 500 but three so um what
tooling would you recommend to reverse
engineer clients on JavaScript
especially if it's minified or off
fiscated oh yeah if you have something
which is minified or off fiscated that
will take you a long time uh that's
really hard I actually think that
there's one uh other spinner uh for
Shopify
uh which does obus Skate their uh their
code so of course I started looking into
this more When I Was preparing this talk
there was this other spinner which
obvious skates it and I didn't even get
started there uh I think what's at least
relatively easy is doing this Postman
thing so inspecting what goes to the
server and comes back so in these
packages the the data is normally quite
quite okay MH but indeed as soon as it
enters your browser and it gets pared by
something OB fiscated you you don't
stand a chance or at least if you don't
have a big thing to gain uh I wouldn't I
wouldn't take any of this effort anymore
uh yeah uh I I know there are deis
cators but I'm not sure how well they
work but yeah I think that yeah again if
you if you really start looking into it
uh normally if you have something like a
d offis Gator it's the thing I normally
look for is um function names which Mak
sense like in this case I was quite
lucky that there was this function C in
it which has a had a paration uh part so
then it's easy to figure out immediately
okay here is where the data comes in and
I can start to inspect this um but as
soon as you don't know what any of the
functions do it's uh harder one one
other maybe tip which I sometimes use is
uh changing functions and see what goes
wrong on the page so if you have a
function you can maybe just remove the
code and or remove this function and see
where it crashes or where it goes wrong
mhm that can also say something about
what did I just break what did I it's a
bit of a trying to figure things out by
breaking parts and seeing what happens
but that's uh that's at least something
which which sometimes can help you um
mhm yeah okay that's uh yeah so
basically approach JavaScript like you
would any other any other decompiled
binary thingy yeah yeah it's basically
one big puzzle and uh yeah so if you if
you are Bor during lockdown there you go
um so um there oh they're they're
growing the questions that's nice um was
it possible uh to modify a website in a
way to pretend to have won the big prize
yeah so what I did is uh so what I did
in terms of so I didn't even have to
pretend because I could just change the
probabilities MH so um the spinner would
always come at the place I would wanted
to come MH and this is this is this was
my point about uh this gave an error
just the spinning would stop and nothing
would happen so the logic for handling
these events was simply not coded yeah
um so there was no there was no kind of
uh interaction programmed for these kind
of cases yeah the question I I think
what they what they are going for please
correct me if I'm wrong on the internet
um I'm never wrong on the internet
people shouldn't lie on the internet at
least that's for sure no um they um if
if it would be possible to not not get
the error code and pretend yeah you won
like the the 1 kogam of free cookie
dough I presume yes it would be possible
to to design something that looks like
the official thing or or yeah I mean one
one thing I was considering uh when I
sent him an email I was basically
considering two things one is just be
direct and say hey Luke you're you're uh
doing this unfair thing or I was also
considering maybe I can just send him an
email and say hey look the spinner ended
at at a big pre
uh but nothing happened can I still get
it so basically try to use some social
engineering to try to get this price
anyways and see how they would respond
if they would just directly tell me with
oh you can't win this there's something
wrong uh
yeah and um yeah um what about those
websites claiming you are the one
millionth visitor you w a fruity phone
how how uh does the code look there
oh I haven't looked at those but I I
don't assume there's any logic encoded
there uh so the the reason I found this
interesting is that uh the things which
would give you something would actually
still give you something so I could
order my cookie dough with 10% discount
if I wanted to eat cookie though um but
I think the the you are the one
millionth winner just uh just sent your
email directly to a Nigerian prince and
nothing else happens uh so yeah I I
don't think there's any any logic uh
behind that
but but then you can win an inheritance
of 10 million uh pounds right I mean he
he told me it will be there any
day um and uh the last question which is
my favorite so far whoever submitted the
question you you won the internet what
would you do if you would win a huge
amount of cookie dough on the internet
oh man uh I uh I I would distribute it
to all my friends I uh it would actually
be quite cool to to come here next year
and give another talk and then bring a
lot of cookie dough so if the owners of
this website are watching uh and uh want
to sponsor this event I'm open contact
me you have you already have my email
because I'm the weird person who uh who
sent you an email so um also they they
they could have they could have been
fair and submitted some cookie and sent
you some cookie dough for the back pound
back Bounty program or something like
that and I I have to correct you on that
part I hope next year we'll be back in
liik but let's see where that's that
that goes yeah for for the for the
Bounty for the buck Bounty thing uh I I
I'm still kind of wondering like I'm
still kind of thinking that they they of
course knew this right they of course
knew they that they set these
probability zero uh so yeah I'm also
still kind of if people still want to
have a discussion online it's still
interesting to ask yourself what would
you have done so if you have access to a
plugin like this uh would you uh would
you submit would you add on minimal
prices or not uh that's maybe a bit of
an ethical question for yourself to
think about uh yeah and um yeah
nonetheless thank you very much for uh
for the talk um it was very interesting
and um I'm sure you will be around this
rc3 world or uh yeah I'm now going to
drive home but I can maybe quickly check
if there's people who want to have a
jitsy CO or something or want to uh
discuss something I can quickly take a
look at what kind of uh messages there
are I mean they can show drop your an
email or something that yeah again you
can uh you can reach me at uh my email
uh it's on screen again I don't know how
smart it is uh please uh please don't
spam I think that's too late yeah um but
yeah thank you very much and have a safe
trip
[Music]
home oh