Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

81–90 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#81

Post by lukevp »

resolutebat wrote: post #59
quickthrower2 wrote: post #49

Firebase is a shitshow. I say this as someone who really tried to like it and sadly built a project for a client using it. Other than this security vuln, the issues vs. just using postgres are: * It is more work! Despite being a backend as a service it is much less code to just write a simple API backend for your thing both in time to do it and time to learn how to do it. Think of Firebase as being on the abstraction…

Firebase's whole premise is seamless syncing between locally cached data and your backend. If you "just use Postgres", life is simpler until your user goes offline/runs out of mobile data/whatever, and then they're immediately screwed.

Most apps are online by default these days and don’t even gracefully degrade without internet. Firebase does have the offline DB, but it had a ton of more features and I wouldn’t say the offline db is the only selling point of FB.

Re: I pwned half of America's fast food chains simultaneously

#83

Post by pests »

KomoD wrote: post #58
cedws wrote: post #56

It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan. If it is indeed the latter, I wonder how they are so brazen about it. Does chattr.ai have a responsible disclosure policy? In my eyes people should be free to pentest whatever as long as there is no intent to cause harm and any findings are reported. Sadly, many companies will freak out and get the law involved, even if you are…

> It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan Pretty clear to me, "it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups.", running a script to scan hundreds of startups > Sadly, many companies will freak out and get the law involved, even if you are a good samaritan. Yeah, but that also ends with that company being shamed a lot of…

What is wrong with shaming when it's warranted?

Re: I pwned half of America's fast food chains simultaneously

#84

Post by cedws »

nkrisc wrote: post #74
cedws wrote: post #69

Earlier quoted context omitted.

I salute you for it. Take caution though. The bad guys don't play by the rules so the rules only hinder the good guys from helping. I think Internet security would be in a better position if we had legislation to protect good samaritan pentesters. Even moreso if they were appropriately rewarded.

Why, you’d never catch a black hat hacker again. The authorities would ust reeling in one Good Samaritan after another!

There is a big difference between discovering a vulnerability that allows you to forge tokens and immediately reporting it versus dumping terabytes of data on the darknet for sale.

Re: I pwned half of America's fast food chains simultaneously

#85

Post by KomoD »

simonebrunozzi wrote: post #71

> No contact or thanks has been received back so far WTF.

It's pretty common in my experience, especially from larger companies

Recently I reported an issue to a company valued at >$10bil issues were quietly fixed, not a single response back, not even a "thank you"

Re: I pwned half of America's fast food chains simultaneously

#86

Post by laurieg »

quickthrower2 wrote: post #49

Firebase is a shitshow. I say this as someone who really tried to like it and sadly built a project for a client using it. Other than this security vuln, the issues vs. just using postgres are: * It is more work! Despite being a backend as a service it is much less code to just write a simple API backend for your thing both in time to do it and time to learn how to do it. Think of Firebase as being on the abstraction…

The flakey firebase local emulator is the bane of my existence, and poorly documented to boot.

On top of the Googlized clickops, there's the whole Firebase vs Google cloud situation, where you end up having to drop down to "real" google cloud for certain specific features. The docs appear to be detailed but you often end up with more questions than answers.

If you are ever thinking about using firebase, give Supabase a try. The emulator works well, the dashboard is there for prototyping but you can just write SQL to clearly define your database and migrations. Since it's just postgres you have a clear route to leave Supabase if you should ever want to.

Re: I pwned half of America's fast food chains simultaneously

#87

Post by redcobra762 »

pests wrote: post #83
KomoD wrote: post #58

Earlier quoted context omitted.

> It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan Pretty clear to me, "it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups.", running a script to scan hundreds of startups > Sadly, many companies will freak out and get the law involved, even if you are a good samaritan. Yeah, but that also ends with that company being shamed a lot of…

What is wrong with shaming when it's warranted?

It’s an ineffective tool if your goal is change.

Re: I pwned half of America's fast food chains simultaneously

#88

Post by refulgentis »

n2d4 wrote: post #79
Sai_ wrote: post #72

Earlier quoted context omitted.

Don’t believe tables are readable by default even if you have defined any RLS policies for that table. I’m building something on SB right now and have been burned more than once because I thought that the absence of policy meant open access to everyone.

I just checked, and newly created tables without RLS are accessible to anyone: After running `CREATE TABLE x` in my SQL client (which succeeds with no warning), if I go back to the table UI on Supabase it says "WARNING: You are allowing anonymous access to your table". (It's good that there's a warning in the official interface, at least, but what if I use my own SQL client? What if my ORM is creating tables?) Your c…

The "when I create a table via SQL statements at shell it does what I say" isn't a vulnerability, I don't think.

The comment chain went long enough that I got confused and thought I was missing something, I started a brand new account, brand new project, brand new table, RLS is enabled by default, has a big recommended next to it highlighted, it is checked, the entire section is highlighted, and has documentation right below it. Source: https://imgur.com/a/X9oJ2i9

It's enabled by default, quite forcefully so

but I'm not a Postgres admin, maybe there's a stronger way you know of to enforce it, so you can prevent the footgun of CREATE TABLE?

Re: I pwned half of America's fast food chains simultaneously

#89

Post by [deleted] »

cedws wrote: post #84
nkrisc wrote: post #74

Earlier quoted context omitted.

Why, you’d never catch a black hat hacker again. The authorities would ust reeling in one Good Samaritan after another!

There is a big difference between discovering a vulnerability that allows you to forge tokens and immediately reporting it versus dumping terabytes of data on the darknet for sale.

[deleted]

Re: I pwned half of America's fast food chains simultaneously

#90

Post by borissk »

MrBruh wrote: post #13
intern4tional wrote: post #4

This isn’t owning fast food chains; rather compromising some AI startup that has some of them as a customer. Title is misleading.

It exposed PII of the managers & employees of ~half of the most popular fast food companies. Personally I feel the title is justified but I understand and respect your viewpoint. Also keep in mind that trying to clarify the such would also make the title much longer than I desired.

Aren't you afraid one of the companies involved may file a complain with FBI or police and get you arrested?
Post reply on HN