Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

141–150 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#141

Post by pstuart »

0xDEADFED5 wrote: post #126
pstuart wrote: post #93

I was looking at jobs for my son at Safeway supermarkets and lazily put https://www.safeway.com/jobs in the browser. That redirects to https://www.careersatsafeway.com/desktop/home -- which is very much not about jobs at safeway -- appears to be an Indonesian gambling/gaming site. Safeway.com has zero email contacts published and expects communication to be via phone call or chatbot. I found their domain admin email…

what the hell, i see the same thing. it's crazy to me when large companies don't even have an option for: in case of dumpster fire, send an email here.

Technically it's not my problem (or on any other basis), but it bothers me because I'm weird.

I was tempted to find their CTO on linked in and post a message there, along with the fact that there was no reply to my outreach nor a proper channel to do so.

I think the only think in their defense is that they must get a lot of angry customer messages and they just don't want to deal with that.

Re: I pwned half of America's fast food chains simultaneously

#142

Post by idiotsecant »

afterburner wrote: post #136
jjeaff wrote: post #130

Earlier quoted context omitted.

Do you feel the same about physical security? It's fine for people to walk around your building, peak in the windows, maybe pick the lock on the door, maybe even take a little walk inside, as long as they don't steal anything?

Weird, I don't feel nearly as touchy about some ones and zeros on a computer as I do my physical body's safety, without which I would not exist.

OK, make the comparison more direct, then. Say you have a filing cabinet with all of your important and \ or embarrassing documents in it. Are you OK with houseguests giving the handle a little wiggle when they come over to check if its locked? What about the neighborhood kids?

Re: I pwned half of America's fast food chains simultaneously

#143

Post by adrr »

n2d4 wrote: post #44
j-bos wrote: post #10

If this had been exploited and the job applicants to Target, Subway, Dunkin et al, had bank/credit fraud committed in their name's, would the big companies be liable for not performing due dilligence on chatter.ai? To be clear, I'm asking from a legal standpoint not a practical one.

For more crucial PII (such as SSN, health data, payment info, etc), vendors are generally required to have certifications from a third-party auditor (such as SOC2). If the big companies fail to check that, then yes, they can be made liable.

No rules or laws that require it. Closest requirement would be PCI around credit cards but you need lots of volume to be required to do an audit. HIPPA just requires you to do risk analysis and implement risk management. SOX is up to the auditor, when I was CTO at a public company, they were fine with me signing at attestation of all things we had implemented. Same with banks, no explicit requirement in both glba and fdic rules. Core bank systems are so old, none of that data is even encrypted neither is network traffic. Stuff is still in cobol.

Forcing function would be cyberinsurance policies that typically want to see audit results if you have multi-million dollar policy limits.

Re: I pwned half of America's fast food chains simultaneously

#144

Post by [deleted] »

quickthrower2 wrote: post #49

Firebase is a shitshow. I say this as someone who really tried to like it and sadly built a project for a client using it. Other than this security vuln, the issues vs. just using postgres are: * It is more work! Despite being a backend as a service it is much less code to just write a simple API backend for your thing both in time to do it and time to learn how to do it. Think of Firebase as being on the abstraction…

[deleted]

Re: I pwned half of America's fast food chains simultaneously

#145

Post by wuiheerfoj »

idiotsecant wrote: post #142
afterburner wrote: post #136

Earlier quoted context omitted.

Weird, I don't feel nearly as touchy about some ones and zeros on a computer as I do my physical body's safety, without which I would not exist.

OK, make the comparison more direct, then. Say you have a filing cabinet with all of your important and \ or embarrassing documents in it. Are you OK with houseguests giving the handle a little wiggle when they come over to check if its locked? What about the neighborhood kids?

If I left my filing cabinet on the pavement outside my house, I ought to expect it to happen, and would thank a good samaritan telling me if I left it open

Re: I pwned half of America's fast food chains simultaneously

#146

Post by sexy_seedbox »

LeoPanthera wrote: post #127
Aurornis wrote: post #110

> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some particip…

In what year was this? January 10 is tomorrow, even on the east coast, at the time of writing this comment.

Not everyone lives in the US of A. Half the day is over already in East Asia.

Re: I pwned half of America's fast food chains simultaneously

#147

Post by sailfast »

UberFly wrote: post #118
Aurornis wrote: post #110

> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some particip…

> "No contact or thanks has been received back so far, I will amend this comment if/when they do so :)" They couldn't even be bothered to send a proper thank you.

To be fair... that's today. Guessing something might be in the works but it's 1AM Eastern Time in the US.

Re: I pwned half of America's fast food chains simultaneously

#149

Post by pharrington »

MrBruh wrote: post #61
cedws wrote: post #56

It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan. If it is indeed the latter, I wonder how they are so brazen about it. Does chattr.ai have a responsible disclosure policy? In my eyes people should be free to pentest whatever as long as there is no intent to cause harm and any findings are reported. Sadly, many companies will freak out and get the law involved, even if you are…

> Good Samaritan The web is insecure enough as it is, I just want to do my part to make it that little bit safer :)

From one Paul to another, best of luck! For the goal of improving overall web security, widespread shame doesn't work. My hunch is that we need to be more prideful about having verifiably robust security practices. Kind of like getting corporations to realize that the data is more valuable if you can prove that nobody can breach it.

Re: I pwned half of America's fast food chains simultaneously

#150

Post by dailykoder »

LeoPanthera wrote: post #127
Aurornis wrote: post #110

> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some particip…

In what year was this? January 10 is tomorrow, even on the east coast, at the time of writing this comment.

That's what i was thinking too, not because it's not already 10th January in europe, but because i doubt you can except a 'thank you' in <8 hours. So I assume this might have been 2023?
Post reply on HN