The blog post by Egor describing the exploit: http://sakurity.com/blog/2015/05/21/starbucks.html