Deliveroo users are getting defrauded • Hacker News Board

Re: Deliveroo users are getting defrauded

#341

Post by mannykannot » Fri, Jan 25, 2019, 2:18 PM UTC

snowwolf wrote: post #312

mannykannot wrote: post #309

Earlier quoted context omitted.

'So if it's a small irrelevant website, there isn't likely to be a high or severe risk to that "breach", so they should be ok.' To be clear, no website, depending on passwords alone, can know if an access was authorized by the person who is the subject of the account. Therefore, it would seem that the only sites that can use password-only authentication without risk are those that hold no personal information about t…

>> According to your own interpretation of the law Look, I am not a laywer, and I am happy for someone to correct me here, but this is the wording of the law: "A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data." Is there anything in that sentence that means a successful credential stuffing atta…

I am not disagreeing with your position that such an access is not authorized by the person whose confidentially is compromised, but the phrases from the UK ICO that you quote in making your argument do not say that the mitigations you propose would provide an adequate defense for the website provider, either. Taken in isolation and at face value (which is what you do to make your case), those phrases lead inevitably to the conclusion that password-only authentication cannot possibly suffice as ICO-compliant authorization for access to any personal data whatsoever.

Re: Deliveroo users are getting defrauded

#342

Post by i_cant_speel » Fri, Jan 25, 2019, 2:33 PM UTC

glangdale wrote: post #316

i_cant_speel wrote: post #132

Earlier quoted context omitted.

> having a conscience What does having a conscience have to do with whether or not you use a food delivery service?

I think a lot of people object to the labour practices of most if not all of the food delivery services; this isn't particularly new news. In Australia the drivers/riders are not treated or paid very well and there is considerable controversy about whether they are really employees vs contractors. I'm surprised that this hasn't occurred to you already at least as an issue for someone (not necessarily you, or, for tha…

> In Australia the drivers/riders are not treated or paid very well

So they should do something else. Those drivers determined that delivering the food was the best use of their time. I don't think it's right to voluntarily choose this specific job and then make people feel immoral for using the service they signed up to provide.

Re: Deliveroo users are getting defrauded

#343

Post by DoctorOetker » Fri, Jan 25, 2019, 11:50 PM UTC

I don't understand? hungry people are buying leaked credentials? black-hat hackers are selling meals through a competing service to customers who then open the door for a Deliveroo guy? None of this is making sense!

Either the fraud is within Deliveroo (dig deeper!), or locating the served customer will result in the discovery of some kind of weird low-usage "stolen credential delivery of Deliveroo foods" service (dig deeper!)

This is not properly fleshed out IMHO... but yeah lets market and compare credit and debit cards and point systems and pffff

Re: Deliveroo users are getting defrauded

#344

Post by DoctorOetker » Sat, Jan 26, 2019, 1:40 AM UTC

MagicPropmaker wrote: post #286

> (Later – a lot later – a Deliveroo spokesman would tell me it was likely I had been the victim of a “credential stuffing” attack, in which hackers obtain lists of usernames and passwords and try them out on other platforms.) So this Tech Journalist uses the same password on every site?

the real issue IMHO is the "credential stuffing attack" makes no sense: hungry people getting their hands on leaked password dumps? a bunch of black hat hackers running a Delivery clone, getting clean money from customers, but really getting an innocent Delivery user get charged, and having the order be sent to the address of the customer? none of this makes sense!

It seems to me like the corruption or fraud is within Deliveroo.

Re: Deliveroo users are getting defrauded

#345

Post by DoctorOetker » Sat, Jan 26, 2019, 1:50 AM UTC

kami8845 wrote: post #34

philpem wrote: post #26

Earlier quoted context omitted.

Probably something like this: 1) People pay the fraudster for "discounted" food. 2) The fraudster places the order using the stolen account. 3) The fraudster tells the people who paid them: "Go to the pub car park at 9pm and wait for the Deliveroo driver. If he asks, your name is John Smith." 4) Profit.

Indeed, maybe there's an app called "Delilaloo" on the App Store that serves as the frontend for these scams

but then THAT should be the real story, why did the journalist stop digging?

it's also pretty hard to imagine it's worth the effort, you still need to advertise so people know about your service! the service would have suspiciously similar dishes advertised in menus corresponding to original restaurants etc... the unsuspecting customer gets to open the door for a Deliveroo person! there's just so many ways this would go wrong in the real world that it doesnt make sense to invest time and effort in MitM'ing Deliveroo from a limited set of compromised accounts...

This all indicates the fraud is happening from within Deliveroo

Re: Deliveroo users are getting defrauded

#346

Post by DoctorOetker » Sat, Jan 26, 2019, 1:53 AM UTC

ams6110 wrote: post #206

unforeseen9991 wrote: post #31

Earlier quoted context omitted.

Put it in the fridge or freezer? Why would they ever sell it at a loss? Everyone needs food, so they get the value by consuming it themselves.

When you're not paying for it in the first place, there's no "loss." It's all profit.

what about time, effort and risk of finding leak dumps, thinking through how you can use the data, and then possibly get caught? none of this makes sense, should we blindly believe them there was any "credential stuffing" happening at all? was this explanatation not simply chosen to guilt-trip the customer?

Re: Deliveroo users are getting defrauded

#347

Post by DoctorOetker » Sat, Jan 26, 2019, 2:01 AM UTC

zaroth wrote: post #113

y04nn wrote: post #49

Earlier quoted context omitted.

You can find some places that would take fake order in exchange of easy money. Or create a shadow platform where people people can order on Deliveroo with crypto currencies.

Now you’ve gone from petty theft and wire fraud and tacked on criminal conspiracy and god knows what else. This could easily get someone 10 years in jail, right? Not even that hard to investigate because there’s a complete paper trail after a fraud is reported of what was ordered, who delivered it, and where it was delivered.

I agree that none of this is making any sense. They would have to advertise the service, and every single customer might report the service when he ens up accepting his food from a DELIVEROO guy! It's simply not sustainable, the hassle is not worth the effort etc... I think there was no "credential stuffing" involved, it's just to make customer feel guilty. Note how the article ends with an agreement they reached to jointly publish a statement (portraying the event as caused reckless password reuse), perhaps Deliveroo hopes to construe this common agreement to the statement as admision on the side of the journalist "if only I had used a different password".

To me all this suggests the fraud is happening within Deliveroo, at a level above the delivery people.

The only credential fraud outside of Deliveroo I can envision is if the black hat hackers contact the restaurants to conspire, the food is then never made but the profit is shared...

Re: Deliveroo users are getting defrauded

#348

Post by stuaxo » Sat, Jan 26, 2019, 8:28 AM UTC

entity345 wrote: post #5

Perhaps worth mentioning, since it's nowhere in the article, that the first thing to do is not to spend hours on the phone with Deliveroo (or whoever else) but to call your bank to report the transactions as fraudulent and to block your card. That will probably get you a refund quicker (the transactions will likely be held until clarified) and will stop any further fraud. As for Deliveroo's support team... Not very g…

Definitely worthwhile, I think a huge amount of people in the UK use Debit cards with Deliveroo and other services so no money will come back off these.

Re: Deliveroo users are getting defrauded

#349

Post by glangdale » Sat, Jan 26, 2019, 10:11 AM UTC

i_cant_speel wrote: post #342

glangdale wrote: post #316

Earlier quoted context omitted.

I think a lot of people object to the labour practices of most if not all of the food delivery services; this isn't particularly new news. In Australia the drivers/riders are not treated or paid very well and there is considerable controversy about whether they are really employees vs contractors. I'm surprised that this hasn't occurred to you already at least as an issue for someone (not necessarily you, or, for tha…

> In Australia the drivers/riders are not treated or paid very well So they should do something else. Those drivers determined that delivering the food was the best use of their time. I don't think it's right to voluntarily choose this specific job and then make people feel immoral for using the service they signed up to provide.

Well, some of the ways they are not treated well seem to be sailing pretty close to the wind in terms of Australian labour law or are outright illegal. It's also pretty hard to imagine these services being remotely workable without a steady supply of "students" who are in Australia supposedly earning degrees but in practice are a giant pool of cheap labour. You can make various libertarian quibbles about both Australian labour and immigration rules, but not everyone wishes to subscribe to your libertarian newsletter....

Re: Deliveroo users are getting defrauded

#350

Post by [deleted] » Sat, Jan 26, 2019, 12:52 PM UTC

gph wrote: post #223

iagooar wrote: post #98

Earlier quoted context omitted.

> It's really common practice for a citizen or someone with a work visa to register and then rent their phone to someone desperate with no work visa Do humans really have such low morality and ethics? I just can't picture a person who does this to another human being...

Did saying this make you feel better about yourself or something? Because it's a ridiculously naive statement at best. More likely just some sanctimonious BS you decided to post to signal how much of a good person you are. Like seriously, what world do you live in where you can't picture a person doing something to take advantage of another person? Have you read literally anything in history?

[deleted]