Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

341–350 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#341

Post by hexadec »

genewitch wrote: post #179
bushbaba wrote: post #169

Earlier quoted context omitted.

Yes, but that might also be caught by infosec users of said tool who have things similar to “littlesnitch” alerting them to the outbound API call attempt.

there used to be windows GUIs for forcing new connections to ask, but i haven't seen anything like it. I can't recall the name of the one i used to use, but it scored perfectly on shieldsUp - oh, Zone Alarm. Littlesnitch iirc is macos only, but it sounds lovely for this sort of thing.

You can set this with Windows' default firewall. Setting to strict mode with no whitelist causes a UAC alert every time a process attempts communication.

Re: I pwned half of America's fast food chains simultaneously

#342

Post by pstuart »

iamhamm wrote: post #281
pstuart wrote: post #93

I was looking at jobs for my son at Safeway supermarkets and lazily put https://www.safeway.com/jobs in the browser. That redirects to https://www.careersatsafeway.com/desktop/home -- which is very much not about jobs at safeway -- appears to be an Indonesian gambling/gaming site. Safeway.com has zero email contacts published and expects communication to be via phone call or chatbot. I found their domain admin email…

Hi Albertsons/Safeway VP of Security Engineering here. Thank you for disclosing this. I’ll have it fixed along with the fact our VDP submission link is missing from the Safeway site. Here it is for future reference https://albertsons.responsibledisclosure.com/hc/en-us

Hi! I was wondering if it would get noticed here ;-)

But as noted elsewhere, it's still not fixed.

And the link you shared is a good thing but is that going to be easy to find to someone who sees an issue with your websites? I'd recommend putting a link here: https://www.safeway.com/help/contactus

Re: I pwned half of America's fast food chains simultaneously

#343

Post by jacobsenscott »

Eisenstein wrote: post #188
eyegor wrote: post #138

Earlier quoted context omitted.

Unfortunately, door 1 is maybe $200 bounty and weeks or months of back and forth (if the corp doesn't have a clear bounty program) whereas door 2 has infinite upside. Honestly, it might make sense for a gov group to run a standardized bounty program for exploits with notable financial / privacy impact.

The solution is to have fines in place for insecurities and award them to discoverers.

This is an awesome idea. The next time a glibc CVE comes out every company in the world pays a fine, if they are impacted or not! Hey - you could even file 1000s of frivolous CVEs (which is already common) you know would affect your competition! (which is how that would pan out)

Re: I pwned half of America's fast food chains simultaneously

#344

Post by redcobra762 »

xpe wrote: post #315
redcobra762 wrote: post #190

Earlier quoted context omitted.

Nope, shame is ineffective as a tool for change. More often people shut down or ignore you if you attempt to shame them than actually make the change you want. Besides, it's frequently just about vengeance anyway. Shame is really hate of other, for the most part. As a tool for oppression however, yes it's quite effective.

The comment above lacks essential nuance and is overly confident.

The comment above lacks contributory value and is also (ironically) overly confident.

Re: I pwned half of America's fast food chains simultaneously

#345

Post by missblit »

urbandw311er wrote: post #208
theonething wrote: post #189

> If you grab the list of admin users from /orgs/0/users, you can splice a new entry into it giving you full access to their Administrator dashboard. I'm not clear on this. Splice a new entry into what? The list of admin users? And then do what with it?

I read this as worse - splice being a client side JavaScript function to add items to arrays. My concern here is whether the “is admin user” perms checks were done solely on the client side and not enforced on the API endpoint!

He's using the word as meaning "insert", not the JS function. He is saying he inserted a new row into a database to get admin access to a dashboard.

'splice" means to join two things as if by weaving them together. If used as "splice into" or "splice in" there is a sense of breaking something apart, inserting something into the gap, and joining it back together.

This all makes a bit more sense if you look up the etymology which was about ropes (despite splicing being about uniting, it's closely related to the word 'split').

Re: I pwned half of America's fast food chains simultaneously

#346

Post by robertlagrant »

unoti wrote: post #339

I worked with Firebase for a while, lured in because of how easy it was to do certain things. It makes certain kinds of operations essentially zero effort, such as getting realtime updates on the frontend when something changes. But it also creates a huge amount of effort that is trivial with other frameworks, such as creating a huge effort for security. I found that what I gained in convenience, I lost by needing to…

I made an app in Firebase once and did it so that people could collaborate but they used per-session IDs that were linked to their real IDs behind the scenes, so people couldn't spot trends of activity over time.

I found it a little tricky to start with while getting familiar with the rules, but it worked really well after I got the hang of it.

Re: I pwned half of America's fast food chains simultaneously

#347

Post by prmoustache »

troupe wrote: post #334
prmoustache wrote: post #156

Earlier quoted context omitted.

A closer analogy would be your friendly neighbour warning you that you left your garage door open. And yes I would appreciate him telling me.

What if he says that he has discovered that if he stands on one foot in the street in front of your house, holds anyone's garage door opener above his head, and clicks it 25 times at precisely 9:01am while shining a laser pointer at the top of the door, your garage door will open.

All in all, you will still be thanksfull he found out and warned you about it before someone malicious does.

Re: I pwned half of America's fast food chains simultaneously

#348

Post by prmoustache »

oh_sigh wrote: post #330
prmoustache wrote: post #156

Earlier quoted context omitted.

A closer analogy would be your friendly neighbour warning you that you left your garage door open. And yes I would appreciate him telling me.

Still missing something - the garage would have to be on your private property, not visible from public property, and the only way he could check for you is if he entered your property and tried to get into your garage.

See my reply above.

Re: I pwned half of America's fast food chains simultaneously

#349

Post by j0hnyl »

Aurornis wrote: post #294
biosboiii wrote: post #171

Earlier quoted context omitted.

When you turn actual, creative and exhausting work (vulnerability research) into some kind of high stakes gig job you deserve this problem. I am not against bug hunting by any means, but if you want to me act like I care about your product and not about my money, pay me monthly.

> When you turn actual, creative and exhausting work (vulnerability research) into some kind of high stakes gig job you deserve this problem. You don’t make HackerOne your primary source of security testing. It’s a fun thing you do in addition to your formal security work internally. The reason people do it is because so many people expect or even demand payment and public recognition for submitting security issues t…

Furthermore, companies that don't already have very mature security programs will not benefit from bug bounties. I've run a bug bounty program before on H1, and it was a nightmare. No one reads the scope and you're inundated with 99/100 really trashy reports. Managing such a program is a full time job for one or more people especially if it's a big company.

Re: I pwned half of America's fast food chains simultaneously

#350

Post by Hrun0 »

genewitch wrote: post #179
bushbaba wrote: post #169

Earlier quoted context omitted.

Yes, but that might also be caught by infosec users of said tool who have things similar to “littlesnitch” alerting them to the outbound API call attempt.

there used to be windows GUIs for forcing new connections to ask, but i haven't seen anything like it. I can't recall the name of the one i used to use, but it scored perfectly on shieldsUp - oh, Zone Alarm. Littlesnitch iirc is macos only, but it sounds lovely for this sort of thing.

You are looking for simplewall
Post reply on HN