Extra cheese, pepperoniâŚ.and software vulnerabilities?
Paul Price, a computer security researcher based in the United Kingdom, three years ago hit the pizza jackpot. He found a computer bug affecting a Dominoâs mobile app on Google (GOOG) Android that allowed him to place orders free of charge.
After requesting a pepperoni, mushroom, and pineapple pie through the app, Price decided to poke around the source code, he writes on his personal blog. Thatâs when he discovered a poorly contrivedâand easily exploitableâpayment process.
Get Data Sheet, Fortuneâs technology newsletter.
All Price had to do to hack the system was to input some obviously fake debit card information (Visa (V) number: 4111111111111111), intercept the traffic between his phone and Dominoâs (DPZ) computer servers, and tweak the data that typically turns up an error message, he says. Literally, he rewrote some code to read âacceptedâ instead of âdeclined,â which green-lit the order.
âErrr, what? It looks like my order was placed without a valid payment,â he writes, recalling his incredulous reaction. Price then contacted the store to confirm that the pie was in the oven and would be delivered shortly, at which point he realized that he would have to set the matter aright.
For more on pizza watch this video.
âMy first thought: awesome. My second thought: shit,â Price recounts his internal dialogue. When the delivery person arrived, he explained that there had been a problem with his card. He reimbursed the courier in cash.
A Dominoâs spokesperson emailed Fortune a statement attributed to Rod Brooks, the restaurant chainâs head of IT, who said the company had âdiscovered this issue last year during one of our frequent reviews. We are pleased to say it was resolved very quickly.â
This is not the first time Dominoâs has accidentally given away free pizza. In March 2009, the restaurant chain mistakenly offered up 11,000 pies at no cost due to a website glitch.
No one may ever know how many slices hackers made off with as a result of the most recent flaw.













