During a recent flight through the Frankfurt Airport I saw that the airport had a promotion for Oktoberfest. You can win vouchers up to 120 Euro if you win a game of 2048 online.
Game start. No vouchers unlocked.
I played the game a couple of times. But there was something suspicious about how the interaction to 'claim your vouchers' felt. There was nothing about the url or interaction that felt secure.
console spam
I opened the dev tools and sure enough: console spam – the tell-tale sign of someone rushing development.
Checking out the network, you could see requests to an endpoint called '/poke' that seemed to pass along game state.
This looks suspicious...
This, plus the console spam tipped me off that the variable 'lucky'-something was probably floating around in the code somewhere.
And sure enough, the people contracted by the Frankfurt Airport took the path of least resistance and stored the game's state on the window
object.
The winning line.
Classic!
A new game, with all vouchers unlocked
And with a one-liner we have a brand new 2048 game... awarding me a 120 Euro voucher.