This isn’t owning fast food chains; rather compromising some AI startup that has some of them as a customer. Title is misleading.
I think it’s incomplete. The startup needs to be named and shamed on the title.
I pwned half of America's fast food chains simultaneously
21–30 of 513 posts
Re: I pwned half of America's fast food chains simultaneously
#22No contact or thanks has been received back so far :)
I wasn't expecting a bug bounty, but not even a 'thank you' does hurt my soul :(
Often when pointing out how people fell victim to a con they won’t thank the person who tells them about the con but rather attack them.
Basically they can’t admit to being so stupid as to have bought into a con.
On some level you can be happy they didn’t come after you or something.
I totally understand how you feel though.
Re: I pwned half of America's fast food chains simultaneously
#23Full permissions for a user is blatant negligence. For anyone who's never used Firebase before this is as simple as a single piece of logic that appears basically as: if authUserID is UserDirectoryID That simple.
I've never used firebase before. But are you saying that, in it's default configuration, anyone who registers a firebase account has R/W access to any firebase database as long as the database owner forgot to put that line in there somewhere?
That seems like an insane design...
Re: I pwned half of America's fast food chains simultaneously
#24Full permissions for a user is blatant negligence. For anyone who's never used Firebase before this is as simple as a single piece of logic that appears basically as: if authUserID is UserDirectoryID That simple.
[deleted]
Re: I pwned half of America's fast food chains simultaneously
#25Who's to say they're the first to discover this? They're the first to discover it and do something to fix it.
I thought there was a US law now where breaches like this have to be reported?
Re: I pwned half of America's fast food chains simultaneously
#26The timeline omits when the article was put online
According to the Wayback Machine, it first appeared January 10 2024. http://web.archive.org/web/20240000000000*/https://mrbruh.co...
Re: I pwned half of America's fast food chains simultaneously
#27Earlier quoted context omitted.
I wasn't expecting a bug bounty, but not even a 'thank you' does hurt my soul :(
Well, they're incompetent - is it a big surprise that they have poor manners too?
Yea, and if they were actually breached and there were victims, the first thing they would do is issue a press release telling the world "We Take Security Very Seriously."
Re: I pwned half of America's fast food chains simultaneously
#28Full permissions for a user is blatant negligence. For anyone who's never used Firebase before this is as simple as a single piece of logic that appears basically as: if authUserID is UserDirectoryID That simple.
I've never used firebase before. But are you saying that, in it's default configuration , anyone who registers a firebase account has R/W access to any firebase database as long as the database owner forgot to put that line in there somewhere? That seems like an insane design...
When you create the database, you're asked whether you want to give everyone access (development mode), or whether no one gets it (production mode). If you choose the development mode, it will automatically disable that access after a certain timestamp, so you don't forget to update it before shipping. This of course doesn't stop people who don't care about security from just manually giving out public R/W, or extending the timestamp.
Re: I pwned half of America's fast food chains simultaneously
#29Who's to say they're the first to discover this? They're the first to discover it and do something to fix it. I thought there was a US law now where breaches like this have to be reported?
> I thought there was a US law now where breaches like this have to be reported?
Yes.
> Will they report it?
Probably not (unless forced imo).
Re: I pwned half of America's fast food chains simultaneously
#30Full permissions for a user is blatant negligence. For anyone who's never used Firebase before this is as simple as a single piece of logic that appears basically as: if authUserID is UserDirectoryID That simple.
I've never used firebase before. But are you saying that, in it's default configuration , anyone who registers a firebase account has R/W access to any firebase database as long as the database owner forgot to put that line in there somewhere? That seems like an insane design...
No, the default is no access to anything. You have to write rules that allow access to each record in the database.
It sounds like the rule that they wrote only checked that the request _is logged in_, because they assumed that visitors can't create their own accounts.