Security: Getting Free Food at a Fast-Food Drive-In

It's easy. Find a fast-food restaurant with two drive-through windows: one where you order and pay, and the other where you receive your food.

This won't work at the more-common U.S. configuration: a microphone where you order, and a single window where you both pay and receive your food.

Wait until there is someone behind you and someone in front of you. Don't order anything at the first window. Tell the clerk that you forgot your money and didn't order anything. Then drive to the second window, and take the food that the person behind you ordered.

It's a clever exploit. Basically, it's a synchronization attack. By exploiting the limited information flow between the two windows, you can insert yourself into the pay-receive queue.

It's relatively easy to fix. The restaurant could give the customer a numbered token upon ordering and paying, which he would redeem at the next window for his food. Or the second window could demand to see the receipt. Or the two windows could talk to each other more, maybe by putting information about the car and driver into the computer. But, of course, these security solutions reduce the system's optimization.

So if not a lot of people do this, the vulnerability will remain open.