Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

91–100 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#91

Post by n2d4 »

refulgentis wrote: post #88
n2d4 wrote: post #79

Earlier quoted context omitted.

I just checked, and newly created tables without RLS are accessible to anyone: After running `CREATE TABLE x` in my SQL client (which succeeds with no warning), if I go back to the table UI on Supabase it says "WARNING: You are allowing anonymous access to your table". (It's good that there's a warning in the official interface, at least, but what if I use my own SQL client? What if my ORM is creating tables?) Your c…

The "when I create a table via SQL statements at shell it does what I say" isn't a vulnerability, I don't think. The comment chain went long enough that I got confused and thought I was missing something, I started a brand new account, brand new project, brand new table, RLS is enabled by default, has a big recommended next to it highlighted, it is checked, the entire section is highlighted, and has documentation rig…

I mean, I don't disagree, but what I'm saying is that SQL/Postgres (hence also Supabase) was not designed for databases accessed from untrusted clients, instead, it's an afterthought and it shows.

Whether it's a "vulnerability" or by design is another question, but it's definitely a footgun (particularly for new Supabase users that use an ORM like Prisma, which has its own UI and creates tables by itself).

The solution might just be to not let untrusted clients access your DB.

Re: I pwned half of America's fast food chains simultaneously

#92

Post by nigamanth »

MrBruh wrote: post #61
cedws wrote: post #56

It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan. If it is indeed the latter, I wonder how they are so brazen about it. Does chattr.ai have a responsible disclosure policy? In my eyes people should be free to pentest whatever as long as there is no intent to cause harm and any findings are reported. Sadly, many companies will freak out and get the law involved, even if you are…

> Good Samaritan The web is insecure enough as it is, I just want to do my part to make it that little bit safer :)

Does this bug work across all applications that use Firebase? Or just those that didn't push the update with security?

Re: I pwned half of America's fast food chains simultaneously

#93

Post by pstuart »

I was looking at jobs for my son at Safeway supermarkets and lazily put https://www.safeway.com/jobs in the browser.

That redirects to https://www.careersatsafeway.com/desktop/home -- which is very much not about jobs at safeway -- appears to be an Indonesian gambling/gaming site.

Safeway.com has zero email contacts published and expects communication to be via phone call or chatbot. I found their domain admin email and sent them info with no response, and no change to their site behavior.

This makes me think that they might be ripe for more monkey business but that's not my thing. Oh well.

Re: I pwned half of America's fast food chains simultaneously

#94

Post by lolinder »

curtisf wrote: post #30
akersten wrote: post #23

Earlier quoted context omitted.

I've never used firebase before. But are you saying that, in it's default configuration , anyone who registers a firebase account has R/W access to any firebase database as long as the database owner forgot to put that line in there somewhere? That seems like an insane design...

No, the default is no access to anything. You have to write rules that allow access to each record in the database. It sounds like the rule that they wrote only checked that the request _is logged in_, because they assumed that visitors can't create their own accounts.

Which, even if that assumption were true, is still bonkers, because from what I see in the article they had no partitioning between tenants or permissions checks for different user roles. So even if they hadn't accidentally allowed creating new accounts, any account on any one of their existing customers had full access to every row in the database.

Re: I pwned half of America's fast food chains simultaneously

#95

Post by itsdrewmiller »

speps wrote: post #25

Who's to say they're the first to discover this? They're the first to discover it and do something to fix it. I thought there was a US law now where breaches like this have to be reported?

You're probably thinking of recent SEC regulations requiring disclosure for public companies - https://www.sec.gov/news/statement/gerding-cybersecurity-dis...

Chattr is a private company - https://www.crunchbase.com/organization/chatrr

Re: I pwned half of America's fast food chains simultaneously

#96

Post by alwa »

SoftTalker wrote: post #63

At this point I would not apply for a job if the employer used a third party online service. Seek out employers who do their own hiring and talk to candidates face-to-face. If they steer you to one of these third party services, send your resume by snail mail directly to the HR director with a cover letter highlighting all the data breaches such as this one, LinkedIn, Indeed, etc. You'll stand out as someone who pays…

Not to be pessimistic, but consider the applicant pool MrBruh targets here. One wonders how widely people with the sort of research skills and communication habits you describe are represented in the population applying for a fry cook position at a Checkers franchise. Or even amongst the franchisees themselves...

And for that matter, how that kind of initiative would be received by your potential future manager at the drive-thru.

I feel like I sound a little patronizing, but my broader point is it’s not other people’s job to be responsible for this kind of data security, especially in a relationship so imbalanced as that between a job seeker and the potential employer who offers only one pathway to gainful employment.

As to the remedy you propose, I’m reminded of the inimitable @patio’s Seeing Like A Bank [0], where he points out that banks (like other firms) use techniques like the paper letter that you described as subtle shibboleths to distinguish people who are likely sophisticated customers from the rank and file.

[0] https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/

Re: I pwned half of America's fast food chains simultaneously

#97

Post by btown »

resolutebat wrote: post #59
quickthrower2 wrote: post #49

Firebase is a shitshow. I say this as someone who really tried to like it and sadly built a project for a client using it. Other than this security vuln, the issues vs. just using postgres are: * It is more work! Despite being a backend as a service it is much less code to just write a simple API backend for your thing both in time to do it and time to learn how to do it. Think of Firebase as being on the abstraction…

Firebase's whole premise is seamless syncing between locally cached data and your backend. If you "just use Postgres", life is simpler until your user goes offline/runs out of mobile data/whatever, and then they're immediately screwed.

https://supabase.com/blog/react-native-offline-first-waterme... may be of interest. https://supabase.com/blog/postgres-crdt seems to be abandoned but would be the next logical step beyond this.

Re: I pwned half of America's fast food chains simultaneously

#98

Post by intern4tional »

thaumasiotes wrote: post #14
intern4tional wrote: post #4

This isn’t owning fast food chains; rather compromising some AI startup that has some of them as a customer. Title is misleading.

> This isn’t owning fast food chains; rather compromising some AI startup that has some of them as a customer. By this argument, getting access by phishing a company employee also wouldn't count as an attack on the company.

No, as company employee is directly tied to and the responsibility of the company.

These companies are responsible for their employees behavior and data but they are not responsible for nor legally liable for (in most cases, some exceptions apply) the actions of a third party that they have retained to help with hiring.

In fact the contract they have with said third party likely absolves them of any liability.

The title should be: I owned an AI startup via Firebase misconfiguration.

You can even name the startup if you want. That’s not flashy though and this person wants marketing.

Re: I pwned half of America's fast food chains simultaneously

#99

Post by philsnow »

KomoD wrote: post #85
simonebrunozzi wrote: post #71

> No contact or thanks has been received back so far WTF.

It's pretty common in my experience, especially from larger companies Recently I reported an issue to a company valued at >$10bil issues were quietly fixed, not a single response back, not even a "thank you"

Some companies intentionally Gray Rock security reports, because they neither want to attract attention by giving bounties, nor do they want attention for not giving bounties. If they just say nothing, the researcher usually just leaves them alone.

One could speculate that these companies want to pretend that infosec isn't a problem for them, and if they ignore the "problem", it will go away.

Re: I pwned half of America's fast food chains simultaneously

#100

Post by intern4tional »

MrBruh wrote: post #13
intern4tional wrote: post #4

This isn’t owning fast food chains; rather compromising some AI startup that has some of them as a customer. Title is misleading.

It exposed PII of the managers & employees of ~half of the most popular fast food companies. Personally I feel the title is justified but I understand and respect your viewpoint. Also keep in mind that trying to clarify the such would also make the title much longer than I desired.

Title: I pwned Chattr.ai via Firebase misconfiguration

That’s what you should call it. It explains to readers what’s going on without over sensationalism.

That isn’t too long either.

Post reply on HN