Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

41–50 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#41

Post by hot_gril »

curtisf wrote: post #30
akersten wrote: post #23

Earlier quoted context omitted.

I've never used firebase before. But are you saying that, in it's default configuration , anyone who registers a firebase account has R/W access to any firebase database as long as the database owner forgot to put that line in there somewhere? That seems like an insane design...

No, the default is no access to anything. You have to write rules that allow access to each record in the database. It sounds like the rule that they wrote only checked that the request _is logged in_, because they assumed that visitors can't create their own accounts.

Yeah, the whole design of Firebase is that the client interacts directly with Firebase, not via your server. Which makes sense for auth since you don't want to be handling that manually, but the database? That makes me uneasy.

Re: I pwned half of America's fast food chains simultaneously

#42

Post by refulgentis »

MrBruh wrote: post #13
intern4tional wrote: post #4

This isn’t owning fast food chains; rather compromising some AI startup that has some of them as a customer. Title is misleading.

It exposed PII of the managers & employees of ~half of the most popular fast food companies. Personally I feel the title is justified but I understand and respect your viewpoint. Also keep in mind that trying to clarify the such would also make the title much longer than I desired.

[flagged]

Re: I pwned half of America's fast food chains simultaneously

#44

Post by n2d4 »

j-bos wrote: post #10

If this had been exploited and the job applicants to Target, Subway, Dunkin et al, had bank/credit fraud committed in their name's, would the big companies be liable for not performing due dilligence on chatter.ai? To be clear, I'm asking from a legal standpoint not a practical one.

For more crucial PII (such as SSN, health data, payment info, etc), vendors are generally required to have certifications from a third-party auditor (such as SOC2). If the big companies fail to check that, then yes, they can be made liable.

Re: I pwned half of America's fast food chains simultaneously

#46

Post by n2d4 »

smegger001 wrote: post #37
MrBruh wrote: post #29

Earlier quoted context omitted.

> I thought there was a US law now where breaches like this have to be reported? Yes. > Will they report it? Probably not (unless forced imo).

i seem to recall a case of hackers anonymously reporting a data breech when a the company they hacked refused to pay up and didn't report it as required by law.

Yes, ALPHV/Blackcat blackmailed MeridianLink by hacking them and then filing a SEC whistleblower complaint [1]. As always, Matt Levine has a wonderful article on it: https://archive.ph/Yffbh

[1] https://www.burr.com/cyber-security-law-blog/ALPHV-extort-Me...

Re: I pwned half of America's fast food chains simultaneously

#47

Post by throwaway0665 »

akersten wrote: post #23
MattDaEskimo wrote: post #17

Full permissions for a user is blatant negligence. For anyone who's never used Firebase before this is as simple as a single piece of logic that appears basically as: if authUserID is UserDirectoryID That simple.

I've never used firebase before. But are you saying that, in it's default configuration , anyone who registers a firebase account has R/W access to any firebase database as long as the database owner forgot to put that line in there somewhere? That seems like an insane design...

I've seen many many firebase projects with rules disabling access only if "auth != null" instead of implementing some kind of even rudimentary access controls. It's a very dangerous habit that seems to come straight from the firebase docs[1]:

> When the user requesting access isn't signed in, the auth variable is null. You can leverage this in your rules if, for example, you want to limit read access to authenticated users — auth != null. However, we generally recommend limiting write access further.

[1]: https://firebase.google.com/docs/rules/rules-and-auth

Re: I pwned half of America's fast food chains simultaneously

#48

Post by ethbr1 »

ryandrake wrote: post #27
PopePompus wrote: post #5

Earlier quoted context omitted.

Well, they're incompetent - is it a big surprise that they have poor manners too?

Yea, and if they were actually breached and there were victims, the first thing they would do is issue a press release telling the world "We Take Security Very Seriously."

Is it legally differentiated if they respond to the reporter?

Or is there some weird loophole of "We didn't take action because of your message. We just happened to patch the same vulnerability after you mentioned it. We are not aware of any penetrations, because we didn't notice your message"?

Re: I pwned half of America's fast food chains simultaneously

#49

Post by quickthrower2 »

Firebase is a shitshow. I say this as someone who really tried to like it and sadly built a project for a client using it.

Other than this security vuln, the issues vs. just using postgres are:

* It is more work! Despite being a backend as a service it is much less code to just write a simple API backend for your thing both in time to do it and time to learn how to do it. Think of Firebase as being on the abstraction level of Sinatra or express and you may as well just use those. Things like Firebase and Parse etc. are more complicated. For the same reason it is more complicate to walk to work with just your arms and no legs (even though there are fewer limbs to deal with and no backend!).

* Relational is king. Not being able to do joins really sucks. Yes you need to make async calls in a loop. NoSQL is premature optimisation.

* Lots of Googlization. This means lots of weird, hard to find out clickops configuration steps to get anything working. Probably why this security flaw existed(?).

* Emulator is flakey, so for local dev you need another cloud DB, and yes all that Googlized setup RSI inducing clickops.

* I reckon it is slower than postgres at the scale of starting a project. Traditional architecture are blitz fast on modern hardware and internet. Like playing a 90s game on your laptop.

* Apparently as you scale it gets pretty pricey.

The main thing is: it actually slows you down! The whole premise is this should speed you up.

Re: I pwned half of America's fast food chains simultaneously

#50

Post by [deleted] »

throwaway0665 wrote: post #47
akersten wrote: post #23

Earlier quoted context omitted.

I've never used firebase before. But are you saying that, in it's default configuration , anyone who registers a firebase account has R/W access to any firebase database as long as the database owner forgot to put that line in there somewhere? That seems like an insane design...

I've seen many many firebase projects with rules disabling access only if "auth != null" instead of implementing some kind of even rudimentary access controls. It's a very dangerous habit that seems to come straight from the firebase docs[1]: > When the user requesting access isn't signed in, the auth variable is null. You can leverage this in your rules if, for example, you want to limit read access to authenticated…

[deleted]
Post reply on HN