Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

451–460 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#451

Post by jimz »

devwastaken wrote: post #375
cedws wrote: post #56

It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan. If it is indeed the latter, I wonder how they are so brazen about it. Does chattr.ai have a responsible disclosure policy? In my eyes people should be free to pentest whatever as long as there is no intent to cause harm and any findings are reported. Sadly, many companies will freak out and get the law involved, even if you are…

Lack of proper regulations, engineering standards, and tangible fines means that the only democracy that exists is the people themselves taking action. The corps being hacked have plenty of malicious intent, perhaps focus on that.

In the American case, the interpretation of the CFAA under Van Buren (2021) would provide at least the defense that one does not violate the law if there is no meaningful authorization scheme in place to determine what constitutes "exceeds authorized access". This may sound pedantic but when reporting on the decision much of the non-specialist media seemed to have failed to appreciate that in order to determine what conduct exceeds authorized access, it's necessary to be able to determine where authorized access starts and ends in every case as a factual matter, and the courts essentially threw out the theory that one can simply use a non-technological solution (like a very broad ToS) as a backstop and require some sort of notice and specificity. I don't think the mere fact that such a technological scheme can be erected is relevant since in theory you can put in some sort of basic authorization scheme - including basic HTTP authorization - around pretty much anything accessible via the protocol, but anything beyond a showing of actually putting such an authorization scheme in place, there's no real way to determine the unimplemented intent of some company in a way with any certainty. It's Orin Kerr's "gate-up-gate-down" theory - you need to have a gate in place to start with, instead of just a space where a gate can go or the assumption where a gate should be to figure out whether the gate is up or down, and without that determination one cannot meet all of the elements required to prove a violation of the statute.

I wouldn't even consider this "hacking" really. If prosecuted a defense attorney familiar with both the technology and the admitted niche area of computer crime law can readily conduct some very effective cross-examination against whoever the state is bringing out as a witness. The government does frequently rely on the lack of tech-competent and accessible counsel as a way to exert coercion (and usually resulting in a plea), and it doesn't help that the layperson has a very difficult time figuring out what qualities constitute competency when looking for attorneys (hence the enduring popularity of jingles since being memorable is frequently mistaken for being competent), but they are out there.

Re: I pwned half of America's fast food chains simultaneously

#452

Post by Dah00n »

bitexploder wrote: post #436
troupe wrote: post #333

Earlier quoted context omitted.

The potential downside of stopping once you find a critical defect is that the company may not take it seriously unless you go just a bit further and show what you can do with the defect. In this case, showing that it gives you access to the admin dashboard.

Generally, hacking into a live system without permission is strictly illegal. Once you have discovered some surface level vulnerability you are legally obligated to stop, at a minimum. You can't just keep hacking and exploiting things that cross a certain, generally clear threshold, without permission. Intent definitely matters, but you can still end up in jail if a prosecutor has a hair up their ass and decides they…

It is illegal as soon as you break in. Going as far as possible, without destroying anything, is no more illegal than stopping early, but gives less proof of security problems.

Re: I pwned half of America's fast food chains simultaneously

#454

Post by monsieurgaufre »

digitcatphd wrote: post #401
monsieurgaufre wrote: post #382

Earlier quoted context omitted.

Pretty sure that poking around for holes/exploits is part of the definition of what is a hacker. They notified the relevant organization as well. Not sure why you take that stance.

And then posted it online? If his intentions were good he wouldn’t post their name.

After the fix as been deployed, i don't see why it should not be. It might be useful to someone else.

If security is mostly an afterthought, maybe naming and shaming might help them take it seriously.

I do not understand your stance at all. Why are you defending corps that were negligent?

Re: I pwned half of America's fast food chains simultaneously

#455

Post by redcobra762 »

Dah00n wrote: post #453
redcobra762 wrote: post #87

Earlier quoted context omitted.

It’s an ineffective tool if your goal is change.

It is? I'd say shaming is the best tool there is.

Positive interactions trump negative interactions when your goal is to encourage lasting change.

Re: I pwned half of America's fast food chains simultaneously

#456

Post by pnutjam »

gosub100 wrote: post #437
Eisenstein wrote: post #187

Earlier quoted context omitted.

Shame is absolutely a valuable tool for change. Without it society would not function since many of our 'rules' are self-enforced.

It ends up leading to "word-inflation" where you have to keep shouting louder, stretching the truth to be acknowledged. The word "racist" changing meaning over the last 30-40 years is a great example.

Please elaborate on the change in meaning?

Re: I pwned half of America's fast food chains simultaneously

#457

Post by joshspankit »

sroussey wrote: post #109
joshspankit wrote: post #77

Earlier quoted context omitted.

This is the exact use-case I want to optimize for. Offline-first with robust and seamless syncing. Firebase keeps promising it but I would love to find more transparent tools that work better on mobile + web.

https://electric-sql.com/ https://www.powersync.com https://watermelondb.dev https://replicache.dev

Do you have direct experience with any of these and especially experience using them with mobile offline-first + sync?

Re: I pwned half of America's fast food chains simultaneously

#458

Post by int_19h »

randomdata wrote: post #324
int_19h wrote: post #200

Earlier quoted context omitted.

Roads lead back to SQL because it became a de facto industry standard for "relation-like" stuff. Can you give an example of a query that cannot be expressed well in relational algebra, but can be in SQL because it deviates from that?

> Roads lead back to SQL because it became a de facto industry standard for "relation-like" stuff. But what was in question is why SQL is the standard. Did it take that position because of its deviation? If so, that would suggest the theory doesn't just work. Without actually profiling, I suspect that the deviation allows some real-world optimizations to take place, enabling SQL databases to be faster than something…

It took that position because it was what the first viable RDBMS used, pretty much. Similar to how JavaScript became the standard PL for browsers.

The simplest SQL queries map perfectly to relational algebra, so I'm still unclear as to what you had in mind. The two major deviations that SQL has over strict relational algebra are non-uniqueness of rows in a table, and NULL. The first one rarely comes up in practice, and any bag of non-unique rows can be trivially mapped to a bag of unique tuples simply by adding synthetic IDs to them. And SQL NULL semantics is widely considered to be a mess even by many users of SQL itself. With respect to performance, NULLs can be implemented very cheaply while optimizing their relational equivalent (1:0-or-1 relation) requires a little bit more effort on the DB side, but it's still such a simple pattern that I don't see a problem here.

Re: I pwned half of America's fast food chains simultaneously

#459

Post by bitexploder »

Dah00n wrote: post #452
bitexploder wrote: post #436

Earlier quoted context omitted.

Generally, hacking into a live system without permission is strictly illegal. Once you have discovered some surface level vulnerability you are legally obligated to stop, at a minimum. You can't just keep hacking and exploiting things that cross a certain, generally clear threshold, without permission. Intent definitely matters, but you can still end up in jail if a prosecutor has a hair up their ass and decides they…

It is illegal as soon as you break in. Going as far as possible, without destroying anything, is no more illegal than stopping early, but gives less proof of security problems.

"Break in" in a modern web app pretty much happens the moment you access data you aren't supposed to access. Not damaging anything is irrelevant. I mean, no one destroyed anything in the Equifax hack. They just retrieved all the data.

Re: I pwned half of America's fast food chains simultaneously

#460

Post by bitexploder »

logifail wrote: post #354
bitexploder wrote: post #326

Earlier quoted context omitted.

The issue is it is often impossible to distinguish from a white hat or a black hat hacking your live systems. It can trigger expensive incident response and be disruptive to the business. Ethically, I think it crosses a line when you are wasting resources like this, live hacking systems. There is usually a pretty clear and obvious point where you can stop, not trigger IR, and notify the companies. Not saying that was…

> There is usually a pretty clear and obvious point where you can stop [..] sometimes the juice isn't worth the squeeze to keep going as you often have proven the thing you needed to or found the critical defect Those who are tasked - and are being paid(!) - to "[do] a cybersecurity assessment" will typically be given a brief. For those who aren't tasked - or being paid(!) - to do this stuff, things are much less cle…

If you aren't being tasked and you aren't being paid it is still really clear. Go look at almost any bug bounty and they will give you really clear "when to stop terms" Often the moment you access data you aren't supposed to access (exposing PII) or come to a point where you could even potentially disrupt the operation of the system you need to stop.

When we begin any assessment on a production system we have a very clear discussion about the rules of engagement. But we are often authorized to access data someone that is not authorized can't legally access with their unauthorized bug hunting. Once you have some experience and understand the relevant laws it is pretty clear when you should stop without violating the law. The general threshold when you are authorized is that you stop if it would risk the stability of the system. If you aren't being paid the general rule is once you have accessed others' PII you need to stop. If you broke an authorization control or accessed any functionality a regular user can't, you need to stop.

Gaining root to any network you don't own or have authorization to operate is clearly crossing the line. You went from finding issues to actively exploiting them. If you have to actively exploit to find an issue and you don't own the system and you don't have permission you don't do it.

Post reply on HN