Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

281–290 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#281

Post by iamhamm »

pstuart wrote: post #93

I was looking at jobs for my son at Safeway supermarkets and lazily put https://www.safeway.com/jobs in the browser. That redirects to https://www.careersatsafeway.com/desktop/home -- which is very much not about jobs at safeway -- appears to be an Indonesian gambling/gaming site. Safeway.com has zero email contacts published and expects communication to be via phone call or chatbot. I found their domain admin email…

Hi Albertsons/Safeway VP of Security Engineering here. Thank you for disclosing this. I’ll have it fixed along with the fact our VDP submission link is missing from the Safeway site. Here it is for future reference https://albertsons.responsibledisclosure.com/hc/en-us

Re: I pwned half of America's fast food chains simultaneously

#282

Post by pge »

orpheansodality wrote: post #248
lulznews wrote: post #235

>With an upbeat pling my console alerted me that my script had finished running Forget the pwn how do I do this Also, HN used to think this was cool now there are 20 posts blaming the hacker…

I've appended `; tput bel` to the end of long-running scripts to get the same effect. Fun fact: the `bell` control character is part of the ascii standard (and before that the baudot telegraph encoding!) and was originally there to ring a literal bell on a recipient's telegraph or teletype machine, presumably to get their attention that they had an incoming message. To keep backwards compatibility today's terminal em…

The Apple II+ still had a ‘bell’ key on the keyboard (I can’t think of a more recent computer that had that)

Re: I pwned half of America's fast food chains simultaneously

#283

Post by pineaux »

wuiheerfoj wrote: post #145
idiotsecant wrote: post #142

Earlier quoted context omitted.

OK, make the comparison more direct, then. Say you have a filing cabinet with all of your important and \ or embarrassing documents in it. Are you OK with houseguests giving the handle a little wiggle when they come over to check if its locked? What about the neighborhood kids?

If I left my filing cabinet on the pavement outside my house, I ought to expect it to happen, and would thank a good samaritan telling me if I left it open

But you would leave it on the pavement right? Little honeypot for nosey punks.

Re: I pwned half of America's fast food chains simultaneously

#284

Post by pge »

didntcheck wrote: post #261
lwhi wrote: post #247

It seems crazy that no thanks or recognition has been given. Is this because doing so might be seen as an admission of liability, and could be used in any legal cases that are brought?

To give the benefit of the doubt, it appears he only contacted them less than 48 hours ago. Their first priority should correctly be to fix the problem. They could be discussing a bug bounty right now and just haven't finalized the email yet

American readers may not have noticed that the dates are in European DD/MM format, so they thought disclosure was Sept 1 rather than Jan 9.

Re: I pwned half of America's fast food chains simultaneously

#285

Post by nop_slide »

n2d4 wrote: post #137
nop_slide wrote: post #114

Earlier quoted context omitted.

I don’t understand the RLS is disabled warning thing. I also have that warning on a project where I migrated to Supabase from a sql dump/restore from another PG instance. I’m using supabase as “just Postgres” at the moment and the only access to the data comes from a server I control. Could you explain how my data is being “blasted to the internet”? Genuinely concerned if I’m grossly overlooking something.

If you don't use the client library (and never expose the anon key) you're most likely fine. If you do (even if just for Supabase Auth or so) your data is exposed and you need to enable RLS on all affected tables ASAP or an attacker can access the entire database, in a similar fashion in which OP did that with Firebase.

Gotcha, yeah I’m not using the client lib at all. Good to know.

Re: I pwned half of America's fast food chains simultaneously

#286

Post by Topfi »

8organicbits wrote: post #267
zilti wrote: post #242

Earlier quoted context omitted.

That is not just negligence, that is stupidity on an order of magnitude that the responsible people should never again be allowed to work on a software project.

Every company I've worked for, and every pentest contract I've done has found plaintext passwords or credentials stored somewhere they shouldn't. It's unfortunately very common.

Customer credentials as in this example? I'll be totally frank, I'm having some trouble reconciling that with Article 34 of the GDPR and 1798.150 of the CCPA. Do none of these organizations have EU/CA customers or is the approach they take to laws the same as the one they employ for database security?

Re: I pwned half of America's fast food chains simultaneously

#287

Post by FrustratedMonky »

lulznews wrote: post #235

>With an upbeat pling my console alerted me that my script had finished running Forget the pwn how do I do this Also, HN used to think this was cool now there are 20 posts blaming the hacker…

Yeah, what happened to the "Hacker" in Hacker News. (responding to people blaming the 'hacker', not the sites).

This guy just grabbed publicly available information, and by 'public' I mean put out onto the web un-protected, just put out there. If you can just basically browse to something, is it really his fault for finding it.

It's like if I have a front door on my house, and just in the front hallway I have a huge naked picture of my wife. If I leave the door open, can I get mad at pedestrians walking by, for seeing the picture. Maybe they walkup to ring the door bell just to get closer look, walking up to the door, but not going in, is allowed.

Re: I pwned half of America's fast food chains simultaneously

#289

Post by MrDunham »

pge wrote: post #284
didntcheck wrote: post #261

Earlier quoted context omitted.

To give the benefit of the doubt, it appears he only contacted them less than 48 hours ago. Their first priority should correctly be to fix the problem. They could be discussing a bug bounty right now and just haven't finalized the email yet

American readers may not have noticed that the dates are in European DD/MM format, so they thought disclosure was Sept 1 rather than Jan 9.

I 100% saw it as MM/DD and was wondering why it took them three months to write up the vulnerability and a month to patch it.

Thanks for the clarification

Re: I pwned half of America's fast food chains simultaneously

#290

Post by Aurornis »

MrBruh wrote: post #120
Aurornis wrote: post #110

> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some particip…

I feel I should clarify, the writeup was not the blog but rather than vulnerability disclosure report (PDF) I sent to them directly.

Yes, I understand, but that’s my point: In my experience, the detailed write-ups that external pentesters sent us could have been replaced by a 1-2 paragraph email for our engineers to read and fix ASAP.
Post reply on HN