2

I have seen a startup (Verify Kero) that is building a product for verifying consumer goods. It places a 16 digit secret code under scratch-able coating. Consumer finds the code behind coating and sends it to Verify Kero via web, SMS, IVR and mobile apps etc. Corresponding company name, manufacturing date, product name, expiry etc. are sent back to consumer.

This idea looks very fantastic to laymen and also been incubated in a top incubator of city and has been appreciated by a lot of ICT4D people. But my opinion says that the product is vulnerable. Mass random numbers can be tested and could be expired very easily. Even original products or consumer items will be declared faked as a result of it to the people who will test it latter.

I want to know your expert opinions for the possible vulnerabilities in this approach.

Improve this question
  • 1
    The first thing that comes to mind is what happens if the coating is scratched during handling? Does the vendor throw the product out? Is the consumer supposed to make a decision? – schroeder♦ Jan 4 '16 at 18:06
  • 2
    I'm not sure I understand the end to end threat model. Suppose you randomly search numbers and find one. Now what? Do you try to build an exact replica of that particular product and try to pretend you are the original manufacturer by putting a scratch off code on the product with the number you found? Or are you suggesting that simply looking up a number makes that number no longer valid? – TTT Jan 4 '16 at 18:13
  • You can also purchase scratch-off stickers. – Neil Smithline Jan 4 '16 at 18:18
  • 1
    @TTT imagine that you make a look-a-like product, like pop/soda, and you label it with a Coke label. In some countries, this is a very real problem. This code idea means that consumers can verify that the product is "the real thing" (sorry, I had to do it). – schroeder♦ Jan 4 '16 at 18:18
  • 1
    This is fairly easy to do it yourself. Spiegen (smartphone case manufacturer)already does this but i think it's more of an gimmik – BlueWizard Jan 5 '16 at 21:19
7

Adding to Steffen Ullrich's excellent answer...

There's an opportunity for an attacker to get valid numbers off of unsold merchandise and then resticker those products so that they look unused. The attacker can then use these pirated numbers on counterfeit products.

This will likely only be profitable for expensive items (eg: profitable for designer clothes, but not for a can of coke) as it is a relatively costly and manual attack. You need to get the unsold products, scratch the silver off, record the code, resticker the item (stickers are readily available), put the item back into the original sales channel, and then sell your item before the original is sold so the code is still valid.

EDIT: Added mention of attack utility for expensive items based on @SteffenUllrich's comment.

Improve this answer
  • While this adds a considerable cost to the attack this might actually be tolerable for high price items. Which in a way adds an upper limit to the price of the products for which this kind of protection is useful. – Steffen Ullrich Jan 4 '16 at 18:35
  • Good point @SteffenUllrich - updated my answer. Thanks! – Neil Smithline Jan 4 '16 at 18:44
  • They just put the code inside rhe packaging. The cloth could be inside a bag together with the code. Then the thief would need to buy the expensive original product just to fake his own product (or destroy the packaging inside the shop) – BlueWizard Jan 5 '16 at 21:21
  • I'm not sure that I follow you @JonasDralle. In the attack I describe, I imagine a temporary redirection of goods somewhere in the supply chain. Say a shipper takes the real goods and opens them to get the codes. They would then repackage the goods and complete the shipping. – Neil Smithline Jan 5 '16 at 21:42
  • Oh sorry than I misunderstood – BlueWizard Jan 5 '16 at 21:43
2

From the description I've seen so far there is a 16 digit number associated with a product description and expire data. Given that the product description is much longer than this this number is only the key into some database, so it can be some random number.

Given that the producers must add this number somehow to their product they will probably buy a bulk of pre-allocated unique numbers and once the producer has associated a specific number with a specific product and expiration date (and maybe more information) it will sent this data together with the pre-allocated number. Once the number is associated with the product the binding can probably not be changed anymore, i.e. numbers can not be reused.

The aim of the attacker will probably be to associate its own products with such validated numbers. The attacker might try to add their own numbers to the fake products. But because of the huge amount of possible number the chance to come up with a number which is already associated with a product is near zero. And trying to brute force such a huge number against a public web site (which might implement rate limiting) will not be successful too. It is more likely that the attacker causes a denial of service attack when trying to invalidate numbers on a massive scale, but not because the numbers gets exhausted but because the load is too high to the validation web site.

The attacker might also try to get used numbers for the original products and put them on the fake products. But this can be defeated if each verification is logged and subsequent verification of the same number shows a history of previous validations. Thus one can quickly see if the number is really an original number or a copied number.

The attacker might also try to buy numbers and associate these with the original instead of the fake product. But I would assume that the the company accounts used to buy such numbers are associated with the name of the company and its products and that only this company will be able to associate any bought number with the companies products.

... Mass random numbers can be tested and could be expired very easily. Even original products or consumer items will be declared faked as a result of it to the people who will test it latter.

If the system is implemented as I've described I don't see any of these attacks as possible.

Improve this answer
  • Microsoft Windows might be regierstered trademark and thus they're the only ones who is able to buy tickets with his name. Someone might buy Tickets with the name Micorsoft Windwos which looks the same when glancing on it. – BlueWizard Jan 5 '16 at 21:17
  • Plus this whole mass testing or mass invaliding could be easily reduced by putting a chapra in front of the request – BlueWizard Jan 5 '16 at 21:22
  • @JonasDralle: I would assume that you have to prove who you are before you get accepted as customer and thus such simple naming confusions will not work. – Steffen Ullrich Jan 5 '16 at 21:53
  • I bet I could get an SSL cert for Micorsoft.com which also has a system where I need to prove ownership. But I think that large vendors like Microsoft or Amazon buy similar domains to redirect to themself and thus protect their customers. – BlueWizard Jan 5 '16 at 21:56
  • @JonasDralle: you might get a cheap DV certificate which has no real validation but I doubt that you would get an EV certificate where you not only need to prove that you own a domain but that you are an incorporated entity. And I think they will not automatically sell anybody tickets with any claimed name but will manually verify their customers - since otherwise the reputation of their verification method would be in danger. – Steffen Ullrich Jan 6 '16 at 5:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.