Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

331–340 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#331

Post by pierat »

mapster wrote: post #291
pierat wrote: post #78

And folks, this is why you sell your exploits to the highest bidder. Being "good" and giving companies free work is a HORRIBLE idea. They're never gonna pay, or even than you. If they're not willing to treat security researchers properly, I see no reason to return the favor. Remember security groups: if your company wont pay, there are others that will.

Did you not see the part where applicants info was exposed? Make a few bucks by selling their data to is 10000x worse than the chatr dev not securing the files.

Selling exploits (the words explaining how to) is a 1st amendment protected act.

Actually downloading the data from a hack and selling it is expressly illegal.

Now if the person/group you're selling to expresses illegal actions as a result, you have a duty not to sell. So, don't ask, and dont tell!

The real solution: companies all should allow for bug bounties and good-faith reporting and proper compensation for reported issues. But as long as they don't another group WILL pay.

Re: I pwned half of America's fast food chains simultaneously

#332

Post by forward1 »

j-bos wrote: post #8
mellosouls wrote: post #2

No contact or thanks has been received back so far :)

It's kind of wild that when businesses lose control of people's personal info, they get no punishment. And when someone saves them from losing people's personal info, they give no thanks. Seems well funded companies are immune from data liability or responsiblity.

"Wild" is the unreasonable expectation your data is "personal" after sharing it with a third party, under a terms of service agreement no less.

Re: I pwned half of America's fast food chains simultaneously

#333

Post by troupe »

bitexploder wrote: post #326
KomoD wrote: post #58

Earlier quoted context omitted.

> It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan Pretty clear to me, "it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups.", running a script to scan hundreds of startups > Sadly, many companies will freak out and get the law involved, even if you are a good samaritan. Yeah, but that also ends with that company being shamed a lot of…

The issue is it is often impossible to distinguish from a white hat or a black hat hacking your live systems. It can trigger expensive incident response and be disruptive to the business. Ethically, I think it crosses a line when you are wasting resources like this, live hacking systems. There is usually a pretty clear and obvious point where you can stop, not trigger IR, and notify the companies. Not saying that was…

The potential downside of stopping once you find a critical defect is that the company may not take it seriously unless you go just a bit further and show what you can do with the defect. In this case, showing that it gives you access to the admin dashboard.

Re: I pwned half of America's fast food chains simultaneously

#334

Post by troupe »

prmoustache wrote: post #156
idiotsecant wrote: post #142

Earlier quoted context omitted.

OK, make the comparison more direct, then. Say you have a filing cabinet with all of your important and \ or embarrassing documents in it. Are you OK with houseguests giving the handle a little wiggle when they come over to check if its locked? What about the neighborhood kids?

A closer analogy would be your friendly neighbour warning you that you left your garage door open. And yes I would appreciate him telling me.

What if he says that he has discovered that if he stands on one foot in the street in front of your house, holds anyone's garage door opener above his head, and clicks it 25 times at precisely 9:01am while shining a laser pointer at the top of the door, your garage door will open.

Re: I pwned half of America's fast food chains simultaneously

#335

Post by troupe »

simonebrunozzi wrote: post #71

> No contact or thanks has been received back so far WTF.

I'm curious if the best monetary approach for a white hat hacker would be to show them the problem, give them time to fix it, and then give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed). The idea being the showing what you have found on other sites has marketing value for a white hat hacker, but had the company hired you to discover the flaw, you wouldn't be publishing it.

Re: I pwned half of America's fast food chains simultaneously

#336

Post by zelon88 »

redcobra762 wrote: post #87
pests wrote: post #83

Earlier quoted context omitted.

What is wrong with shaming when it's warranted?

It’s an ineffective tool if your goal is change.

Security is at a point where shame is required. You deserve to feel shame if you have an unjustifiable security posture like plain text passwords. The time for politely asking directors to do their job has passed. This is even the governments take at this point. Do it right or stop doing it at all.

Re: I pwned half of America's fast food chains simultaneously

#337

Post by thatwasunusual »

habosa wrote: post #119

Sad that in 2024 people continue to set their Firebase security rules to be wide open. Back in maybe 2015-2019 that was excusable because that was the default but now it’s just lazy. Don’t expose your database / api / blob storage bucket / etc to the public! It’s not that hard to do it right, or at least “right enough” that you can’t get owned by someone scanning a whole TLD.

> Sad that in 2024 people continue to set their Firebase security rules to be wide open. [...] Don’t expose your database / api / blob storage bucket / etc to the public!

What is additionally sad, is that your comment - in 2024 - is being downvoted.

Re: I pwned half of America's fast food chains simultaneously

#339

Post by unoti »

I worked with Firebase for a while, lured in because of how easy it was to do certain things. It makes certain kinds of operations essentially zero effort, such as getting realtime updates on the frontend when something changes. But it also creates a huge amount of effort that is trivial with other frameworks, such as creating a huge effort for security. I found that what I gained in convenience, I lost by needing to do so much work continuously battling with security rules. I left it behind and never looked back, and it made me much more cheerful about the work that I needed to do to establish and maintain more conventional backend data systems.

Re: I pwned half of America's fast food chains simultaneously

#340

Post by pstuart »

namdnay wrote: post #236
pstuart wrote: post #141

Earlier quoted context omitted.

Technically it's not my problem (or on any other basis), but it bothers me because I'm weird. I was tempted to find their CTO on linked in and post a message there, along with the fact that there was no reply to my outreach nor a proper channel to do so. I think the only think in their defense is that they must get a lot of angry customer messages and they just don't want to deal with that.

I very much doubt it's got anything to do with their CTO - the management of a corporate website is usually jealously guarded by marketing/corporate communications

Yes, the CTO hopefully has nothing to do with lower level operations like that. But if they get a public burn they're going to issue a decree that will be addressed.
Post reply on HN