Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

351–360 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#351

Post by weinzierl »

weinzierl wrote: post #311
lulznews wrote: post #235

>With an upbeat pling my console alerted me that my script had finished running Forget the pwn how do I do this Also, HN used to think this was cool now there are 20 posts blaming the hacker…

Debian (and derivatives like Ubuntu) come with a handy shell alias called `alert` . It is meant to be used after a command or a chain of commands to give feedback about success or failure. The alias by itself doesn't issue a ping, but can easily be amended to do so. What worked for me is to add an invocation of `paplay` . Actually it is two different invocations, one sound for success and another one for failure. In…

That being said, there might be an easier way by configuring the desktop environment to make a noise on notification, but that is route I did not want to go.

Re: I pwned half of America's fast food chains simultaneously

#352

Post by albuic »

oh_sigh wrote: post #330
prmoustache wrote: post #156

Earlier quoted context omitted.

A closer analogy would be your friendly neighbour warning you that you left your garage door open. And yes I would appreciate him telling me.

Still missing something - the garage would have to be on your private property, not visible from public property, and the only way he could check for you is if he entered your property and tried to get into your garage.

On the contrary, I would say that this is a garage you rent on a public space. The internet is open and I can do requests to any server. If you don't want your system to answer me, make sure it does not. If I am in front of an ATM on the public street, it doesn't give me money without authorization. Make sure your server does the same.

Re: I pwned half of America's fast food chains simultaneously

#353

Post by jacobsenscott »

troupe wrote: post #335
simonebrunozzi wrote: post #71

> No contact or thanks has been received back so far WTF.

I'm curious if the best monetary approach for a white hat hacker would be to show them the problem, give them time to fix it, and then give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed). The idea being the showing what you have found on other sites has marketing value for a white hat hacker, but had the company hired you to discover the f…

The best approach is not to do it. Demanding money from someone that didn't hire you is never ethical - just childish. Would you like it if I showed up at your house, mowed your lawn, and then started banging on your door demanding $100 for mowing your lawn?

Also, what marketing value - if you're just pwning random web sites rather than getting hired to test a site's security you aren't in any market.

Re: I pwned half of America's fast food chains simultaneously

#354

Post by logifail »

bitexploder wrote: post #326
KomoD wrote: post #58

Earlier quoted context omitted.

> It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan Pretty clear to me, "it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups.", running a script to scan hundreds of startups > Sadly, many companies will freak out and get the law involved, even if you are a good samaritan. Yeah, but that also ends with that company being shamed a lot of…

The issue is it is often impossible to distinguish from a white hat or a black hat hacking your live systems. It can trigger expensive incident response and be disruptive to the business. Ethically, I think it crosses a line when you are wasting resources like this, live hacking systems. There is usually a pretty clear and obvious point where you can stop, not trigger IR, and notify the companies. Not saying that was…

> There is usually a pretty clear and obvious point where you can stop [..] sometimes the juice isn't worth the squeeze to keep going as you often have proven the thing you needed to or found the critical defect

Those who are tasked - and are being paid(!) - to "[do] a cybersecurity assessment" will typically be given a brief.

For those who aren't tasked - or being paid(!) - to do this stuff, things are much less clear. There's no defined target, no defined finish line, no flag you have been requested to capture.

(I don't work in cybersecurity now, but I did get root on the school network way back when, and man, that took some explaining..)

Re: I pwned half of America's fast food chains simultaneously

#355

Post by redcobra762 »

Eisenstein wrote: post #215
redcobra762 wrote: post #190

Earlier quoted context omitted.

Nope, shame is ineffective as a tool for change. More often people shut down or ignore you if you attempt to shame them than actually make the change you want. Besides, it's frequently just about vengeance anyway. Shame is really hate of other, for the most part. As a tool for oppression however, yes it's quite effective.

There are different types of shame. Shame related to a decision situation (endogenous) and shame not related to a decision situation (exogenous). In the endogenous case the shame is said to be a 'pro-social' emotion. This is backed by studies. "Using three different emotion inductions and two different dependent measures, we repeatedly found that endogenous shame motivates prosocial behavior. After imagining shame wi…

There’s a reason your citations are nearly a decade old at best; the science has changed.

A 2021 meta-analysis showed that, “shame correlates negatively with self-esteem and is large effect size.” [0] So unless the goal of your shame is to actively harm the people involved, then no, shame is not an effective tool at behavior change, given the damage it causes.

You may be thinking of “guilt” rather than shame:

> In sum, shame and guilt refer to related but distinct negative “self-conscious” emotions. Although both are unpleasant, shame is the more painful self-focused emotion linked to hiding or escaping. Guilt, in contrast, focuses on the behavior and is linked to making amends. [1]

[0] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC8768475/

[1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3328863/

Re: I pwned half of America's fast food chains simultaneously

#356

Post by ziddoap »

forward1 wrote: post #332
j-bos wrote: post #8

Earlier quoted context omitted.

It's kind of wild that when businesses lose control of people's personal info, they get no punishment. And when someone saves them from losing people's personal info, they give no thanks. Seems well funded companies are immune from data liability or responsiblity.

"Wild" is the unreasonable expectation your data is "personal" after sharing it with a third party, under a terms of service agreement no less.

>terms of service agreement

Are those the documents, often dozens of pages of barely understandable legalese word salad, that we've conditioned nearly everyone to click past?

While I certainly agree that people share way too much data, I personally think hiding behind "it's in the terms of service agreement" is getting quite tired when they are designed in such a way that you are encouraged to skip past it, and they are worded in such a way that a lay-person doesn't have a chance of understanding what the ramifications of agreeing to the agreement is.

Not to mention that, quite often, you don't really have a choice in the matter if you want to have a relatively normal life (e.g. being forced to agree to the terms of service of some random service to submit an application to a job, and not having a job isn't an option).

Re: I pwned half of America's fast food chains simultaneously

#357

Post by wt__ »

MrBruh wrote: post #3
mellosouls wrote: post #2

No contact or thanks has been received back so far :)

I wasn't expecting a bug bounty, but not even a 'thank you' does hurt my soul :(

If it's any consolation, people these days frequently ignore (or read but don't bother acknowledging) pretty much any email that was intended to be helpful, not just security disclosures.

Re: I pwned half of America's fast food chains simultaneously

#358

Post by anticorporate »

bitexploder wrote: post #326
KomoD wrote: post #58

Earlier quoted context omitted.

> It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan Pretty clear to me, "it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups.", running a script to scan hundreds of startups > Sadly, many companies will freak out and get the law involved, even if you are a good samaritan. Yeah, but that also ends with that company being shamed a lot of…

The issue is it is often impossible to distinguish from a white hat or a black hat hacking your live systems. It can trigger expensive incident response and be disruptive to the business. Ethically, I think it crosses a line when you are wasting resources like this, live hacking systems. There is usually a pretty clear and obvious point where you can stop, not trigger IR, and notify the companies. Not saying that was…

> Ethically, I think it crosses a line when you are wasting resources like this, live hacking systems.

I agree with everything you wrote except this sentence. There is no ethical obligation not to waste a company's time.

Re: I pwned half of America's fast food chains simultaneously

#359

Post by dataflow »

xpe wrote: post #316
Eisenstein wrote: post #215

Earlier quoted context omitted.

There are different types of shame. Shame related to a decision situation (endogenous) and shame not related to a decision situation (exogenous). In the endogenous case the shame is said to be a 'pro-social' emotion. This is backed by studies. "Using three different emotion inductions and two different dependent measures, we repeatedly found that endogenous shame motivates prosocial behavior. After imagining shame wi…

Would you care to summarize what "related to a decision situation" means for those of us who don't have access to those articles?

Just a guess, but I imagine it's the difference between "I'm ashamed I can't make enough money to save anything" vs. "I'm ashamed I blew all my savings on crypto". One is shame about your situation (which are likely to be out of your own desires and control too), the other is shame about your decision (which you likely had better control over).

Re: I pwned half of America's fast food chains simultaneously

#360

Post by jacobsenscott »

Aurornis wrote: post #110

> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some particip…

> The incentives in infosec are weird.

Well - only the amateur infosec world where you try and force someone to be your client after you do the work, and then get butthurt when they don't become your client.

In the professional infosec world the clients choose to hire you first.

Post reply on HN