Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

321–330 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#321

Post by mathverse »

crooksey wrote: post #268
andrecarini wrote: post #160

How much would this leak go for in the darknet?

Deciding to sell this on the darknet is a life changing decision, white to black overnight and imagine not really something most would contemplate. Payment in BTC probably from an already compromised address so loads of factors. Probably an easy + quick 2BTC though

This is an easy and obvious exploit so an attacker would need to extract the data from all sources ASAP. High risk of getting caught and ending in jail to be honest for measly 2BTC. Not worth it for anyone in the US or even Europe.

Re: I pwned half of America's fast food chains simultaneously

#322

Post by internetter »

refulgentis wrote: post #312
Sparkyte wrote: post #239

Ethical hacking is a good thing. Nice to see someone doing good.

They reworded things since yesterday: Before, one collaborator had them in a chat sneering about chattr, checking their Javascript, then getting a GUI pwn tool for firebase. i.e targeted attack with malice, followed up a blog post wildly exaggerating what happened, with a disclosure policy of 'we emailed them once and they fixed and didn't email us back so we'll just publish' Only spelling this out because it's impor…

> Before, one collaborator had them in a chat sneering about chattr

"Wow this thing looks crappy"

> checking their Javascript

"I wonder if it is crappy"

> then getting a GUI pwn tool for firebase.

"Huh, it seems crappy. Let's just check to be sure"

> with a disclosure policy of 'we emailed them once and they fixed ...'

"Well, this thing is really crappy. we don't want to harm people. Let's tell them about how crappy it is to avoid harm"

> and didn't email us back so we'll just publish'

"They fixed the thing, nobody will be harmed. We still think it's crappy so let's talk about it"

Why wouldn't they go public at this point? They've gotten nothing else out of it, and since the issue has been fixed there is zero harm to customers. Do you propose they go like

"Hey company, we found this really embarrassing thing you did. I see you fixed it now, so can we talk about it"

silence

"Oh well the company didn't say anything so we won't talk about it. So sad"

In what world do we not hold companies accountable? In what world do we blame the people who find these issues for free?

Re: I pwned half of America's fast food chains simultaneously

#324

Post by randomdata »

int_19h wrote: post #200
randomdata wrote: post #122

Earlier quoted context omitted.

In my experience, the roads lead back to SQL. It deviates from the relational model. It may even be that SQL was successful because it deviated from the relational model. Perhaps the theory doesn't just work?

Roads lead back to SQL because it became a de facto industry standard for "relation-like" stuff. Can you give an example of a query that cannot be expressed well in relational algebra, but can be in SQL because it deviates from that?

> Roads lead back to SQL because it became a de facto industry standard for "relation-like" stuff.

But what was in question is why SQL is the standard. Did it take that position because of its deviation? If so, that would suggest the theory doesn't just work. Without actually profiling, I suspect that the deviation allows some real-world optimizations to take place, enabling SQL databases to be faster than something with strict adherence to the theory. That would be a good reason why you might have to choose SQL over a strict alternative.

> Can you give an example of a query that cannot be expressed well in relational algebra

Seems not. CloudFlare blocked the submission, complaining that I was submitting a SQL query, which it thinks is a security concern for some reason...

In lieu, just think about what a relation is and how SQL is not relational. Even some of the simplest select queries you can imagine can demonstrate your request.

Re: I pwned half of America's fast food chains simultaneously

#325

Post by internetter »

Narkov wrote: post #11
mellosouls wrote: post #2

No contact or thanks has been received back so far :)

To be fair, it looks like it was only patched in the last 24 hours so not totally unreasonable...yet.

it is 11:26:45 EST. Ready. Go.

"Hi, we have fixed the issue you reported to us. Thank you so much. We are willing to offer a reward of dollars to you, because you have protected our customers. Please reach out with a payment address or any other questions you might have. Thanks again, Tim from "

and... stop timer. 11:27:38

was that so hard?

Re: I pwned half of America's fast food chains simultaneously

#326

Post by bitexploder »

KomoD wrote: post #58
cedws wrote: post #56

It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan. If it is indeed the latter, I wonder how they are so brazen about it. Does chattr.ai have a responsible disclosure policy? In my eyes people should be free to pentest whatever as long as there is no intent to cause harm and any findings are reported. Sadly, many companies will freak out and get the law involved, even if you are…

> It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan Pretty clear to me, "it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups.", running a script to scan hundreds of startups > Sadly, many companies will freak out and get the law involved, even if you are a good samaritan. Yeah, but that also ends with that company being shamed a lot of…

The issue is it is often impossible to distinguish from a white hat or a black hat hacking your live systems. It can trigger expensive incident response and be disruptive to the business. Ethically, I think it crosses a line when you are wasting resources like this, live hacking systems. There is usually a pretty clear and obvious point where you can stop, not trigger IR, and notify the companies. Not saying that was the case here, but I have been doing cybersecurity assessment work for 17+ years. Even when you have permission sometimes the juice isn't worth the squeeze to keep going as you often have proven the thing you needed to or found the critical defect. There is a balance to whtie hat activities and using good sense to not waste resources.

Re: I pwned half of America's fast food chains simultaneously

#327

Post by forward1 »

iamhamm wrote: post #281
pstuart wrote: post #93

I was looking at jobs for my son at Safeway supermarkets and lazily put https://www.safeway.com/jobs in the browser. That redirects to https://www.careersatsafeway.com/desktop/home -- which is very much not about jobs at safeway -- appears to be an Indonesian gambling/gaming site. Safeway.com has zero email contacts published and expects communication to be via phone call or chatbot. I found their domain admin email…

Hi Albertsons/Safeway VP of Security Engineering here. Thank you for disclosing this. I’ll have it fixed along with the fact our VDP submission link is missing from the Safeway site. Here it is for future reference https://albertsons.responsibledisclosure.com/hc/en-us

It's definitely not fixed: the (likely malicious?) redirect still happens for me now. How embarassing (for you).

Re: I pwned half of America's fast food chains simultaneously

#328

Post by mnw21cam »

orpheansodality wrote: post #248
lulznews wrote: post #235

>With an upbeat pling my console alerted me that my script had finished running Forget the pwn how do I do this Also, HN used to think this was cool now there are 20 posts blaming the hacker…

I've appended `; tput bel` to the end of long-running scripts to get the same effect. Fun fact: the `bell` control character is part of the ascii standard (and before that the baudot telegraph encoding!) and was originally there to ring a literal bell on a recipient's telegraph or teletype machine, presumably to get their attention that they had an incoming message. To keep backwards compatibility today's terminal em…

I always used to just have 'echo "^G"' instead (where ^G is typed as CTRL-V CTRL-G).

Re: I pwned half of America's fast food chains simultaneously

#329

Post by zelon88 »

adrr wrote: post #143
n2d4 wrote: post #44

Earlier quoted context omitted.

For more crucial PII (such as SSN, health data, payment info, etc), vendors are generally required to have certifications from a third-party auditor (such as SOC2). If the big companies fail to check that, then yes, they can be made liable.

No rules or laws that require it. Closest requirement would be PCI around credit cards but you need lots of volume to be required to do an audit. HIPPA just requires you to do risk analysis and implement risk management. SOX is up to the auditor, when I was CTO at a public company, they were fine with me signing at attestation of all things we had implemented. Same with banks, no explicit requirement in both glba and…

There are state laws that this runs afoul of. https://www.mass.gov/regulations/201-CMR-1700-standards-for-...

Re: I pwned half of America's fast food chains simultaneously

#330

Post by oh_sigh »

prmoustache wrote: post #156
idiotsecant wrote: post #142

Earlier quoted context omitted.

OK, make the comparison more direct, then. Say you have a filing cabinet with all of your important and \ or embarrassing documents in it. Are you OK with houseguests giving the handle a little wiggle when they come over to check if its locked? What about the neighborhood kids?

A closer analogy would be your friendly neighbour warning you that you left your garage door open. And yes I would appreciate him telling me.

Still missing something - the garage would have to be on your private property, not visible from public property, and the only way he could check for you is if he entered your property and tried to get into your garage.
Post reply on HN