https://hackernoon.com/how-i-hacked-modern-vending-machines-43f4ae8decec
When vending machines started rolling out ways to pay through electronic means it was just a matter of time before hackers found ways to pay for their midday snack through more unscrupulous means. A certain brand of vending machines had a mobile app which allowed you to pay through your phone, this is the start of the hack. In general, if one where to download the APK for the app onto their machine, decompile it, take the java sources, enable debugging, rebuild it, create a new key, sign it, zip-align it, they would be able to find the database which houses the goods. The database is password protected, obviously, but there is one flaw, the encryption key for the password can be traced back to the phone’s IMEI, which gives you access to the database. At this point you can edit the wallet balance to whatever you desire and it would work with the vending machines. It is mind boggling how simple this hack is, along with the fact that there is no security or authorization which attempts to check the local balance with an online balance. This entire hack is a good lesson in what not to do in developing a mobile app with purchasing capabilities.
