Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

471–480 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#471

Post by randomdata »

int_19h wrote: post #458
randomdata wrote: post #324

Earlier quoted context omitted.

> Roads lead back to SQL because it became a de facto industry standard for "relation-like" stuff. But what was in question is why SQL is the standard. Did it take that position because of its deviation? If so, that would suggest the theory doesn't just work. Without actually profiling, I suspect that the deviation allows some real-world optimizations to take place, enabling SQL databases to be faster than something…

It took that position because it was what the first viable RDBMS used, pretty much. Similar to how JavaScript became the standard PL for browsers. The simplest SQL queries map perfectly to relational algebra, so I'm still unclear as to what you had in mind. The two major deviations that SQL has over strict relational algebra are non-uniqueness of rows in a table, and NULL. The first one rarely comes up in practice, a…

> It took that position because it was what the first viable RDBMS used

Then wouldn't we be using LINUS today rather than SQL? "Viable" is quite hand wavy, so maybe you don't consider MRDS to have been viable enough for some reason. But even once relational databases were moving into the mainstream, there was no clear winner between SQL and QUEL for quite a long time. Even what is arguably the most beloved DBMS of all time, Postgres, picked the QUEL horse originally.

But SQL was generally considered easier to understand for the layman, perhaps in large part because it was less strict with respect to the theory. This may be another reason why it won.

> Similar to how JavaScript became the standard PL for browsers.

I don't know how similar that is. I'm not sure there was ever another realistic alternative you could have ever chosen. The only real attempt to change that, VBScript, was likely to not work half the time due to not having the right dependencies on the host system, making it impractical for real-world use.

Maybe not anymore, but for a time there were practical alternatives to SQL.

> The first one rarely comes up in practice

The first one is the most common source of SQL bugs I see out in the wild. Complex joins can become quite unintuitive because of it. Nothing you can't learn around, and of course work around, but something you have to always be mindful of. As such, I'm not sure I agree that it rarely comes up in practice.

Not to mention I see a lot of people making use of that fact. It is a useful quality in practical applications. It also comes up quite a bit in practice because, frankly, often you don't want rows to be unique.

Re: I pwned half of America's fast food chains simultaneously

#472

Post by buffington »

hospitalJail wrote: post #390
black3r wrote: post #262

Earlier quoted context omitted.

Since this is a post about security, this is your daily reminder to update your browser to stay safe on the internet. Up-to-date versions of Safari support AVIF images, and there have been multiple RCE vulnerabilities with known exploits fixed last year in Safari...

iphones are the scariest device to do anything important on. I had a moment of total freakout when I realized the person across from me at lunch had an iPhone on the table. Actually he had an Android, and we continued talking like no big deal. To be clear, we were talking about a 10-100M dollar problem, this wasnt small potatoes. Too many exploits, I can't imagine having anything of value on an iphone.

Please, tell us more about each of these points you make, in detail. I'm compelled to know.

Re: I pwned half of America's fast food chains simultaneously

#473

Post by buffington »

borissk wrote: post #90
MrBruh wrote: post #13

Earlier quoted context omitted.

It exposed PII of the managers & employees of ~half of the most popular fast food companies. Personally I feel the title is justified but I understand and respect your viewpoint. Also keep in mind that trying to clarify the such would also make the title much longer than I desired.

Aren't you afraid one of the companies involved may file a complain with FBI or police and get you arrested?

Arrested for what? The system gave them permissions, they didn't exfil data, and they disclosed it to the company. He did those companies a favor by showing them how vulnerable they are by outsourcing every operation and process in pursuit of profits.

Re: I pwned half of America's fast food chains simultaneously

#474

Post by pests »

Eisenstein wrote: post #465
redcobra762 wrote: post #422

Earlier quoted context omitted.

Did you read them? If your goal is to effect change, hurting people's self esteem is a negative effect that is entirely unnecessary to change. And criminals aren't some ungovernable animals...

> If your goal is to effect change, hurting people's self esteem is a negative effect that is entirely unnecessary to change. Yes, your self esteem will likely be harmed if you do something bad and it gets found out. > And criminals aren't some ungovernable animals... ?

I'm confused too. People live inside such safe spaces now. The thought of a negative emotion is to be avoided at all costs.

Shame makes people feel bad, so we must do all we can do avoid making anyone feel that.

What's next? Is "disappointment" next? Having someone disappointed in you feels bad, therefore no one can ever show disappointment to others?

Re: I pwned half of America's fast food chains simultaneously

#475

Post by pests »

redcobra762 wrote: post #425
boredtofears wrote: post #419

Earlier quoted context omitted.

Nope: > According to cultural anthropologist Ruth Benedict, shame arises from a violation of cultural or social values while guilt feelings arise from violations of one's internal values. https://en.wikipedia.org/wiki/Shame#Comparison_with_guilt

Yep: > In sum, shame and guilt refer to related but distinct negative “self-conscious” emotions. Although both are unpleasant, shame is the more painful self-focused emotion linked to hiding or escaping. Guilt, in contrast, focuses on the behavior and is linked to making amends. [0] [1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3328863/

Why is a painful emotion a bad thing?

Re: I pwned half of America's fast food chains simultaneously

#476

Post by AnthonyMouse »

bitexploder wrote: post #461
AnthonyMouse wrote: post #439

Earlier quoted context omitted.

> The issue is it is often impossible to distinguish from a white hat or a black hat hacking your live systems. It can trigger expensive incident response and be disruptive to the business. If your servers are connected to the internet, you can expect that people from countries that won't prosecute them will try to break in. This will happen, almost immediately, as soon as they're connected to the internet. If your s…

> This is obviously not the case. It really is though. People just don't understand the ethics of white hat hacking. > Suppose you suspect the company could be using a default admin password Putting in that password on a system you don't own without any sort of permission to do so is very clearly against the law. You are accessing the system without permission. You just walk away if you want to be ethical about it. T…

> People just don't understand the ethics of white hat hacking.

People just think they understand ethics, even if they don't.

"Don't break the law" is an incredibly poor foundation. Many laws are ill-conceived, ambiguous, overly broad and widely ignored or manifestly unjust. Using this as the basis for ethical behavior would require you to be unreasonably conservative and pedantic while regarding complicity in an injustice as ethical behavior. (It also implies that you could never use ethics to inform what the law should be, since it would just tautologically be whatever you make it.)

"Don't knowingly cause net harm" is at least as valid, but then admits the possibility of curiosity-based shenanigans that could lead to the revelation of a vulnerability that saves innocent people from the consequences of it being later exploited by someone nefarious.

> Putting in that password on a system you don't own without any sort of permission to do so is very clearly against the law.

Driving 1 MPH over the speed limit is very clearly against the law, even if the orphanage is relying on you to have the funding letter postmarked by end of day.

Walking your date home while you're intoxicated is very clearly against the law (public intoxication), even if the alternative is that they drive themselves home while intoxicated.

Ethics is something else.

> The only ethical path is to let them know you have some reason to believe they are not using secure passwords or whatever.

But you don't, really. Your belief may even be purely statistical -- suppose you expect that if you try the default on many servers at different companies, there will be at least one where it works, and you'd like to report it to them, but you have no idea which ones unless you try.

> It just isn't the white hats problem.

If you have the capacity to prevent likely harm and instead do nothing, what color is your hat?

Re: I pwned half of America's fast food chains simultaneously

#477

Post by 1vuio0pswjnm7 »

redcobra762 wrote: post #87
pests wrote: post #83

Earlier quoted context omitted.

What is wrong with shaming when it's warranted?

It’s an ineffective tool if your goal is change.

"Change" could mean a careless, incompetent or reckless company going out of business, a net positive for possible future victims of their conduct.

Re: I pwned half of America's fast food chains simultaneously

#478

Post by Topfi »

8organicbits wrote: post #468
Topfi wrote: post #277

Earlier quoted context omitted.

> [...] may cause the companies to spend money notifying customers and harm their reputation. I'm sorry, but I don't quite understand. Are you saying that you feel a company should not notify customers when exposing passwords in plaintext and furthermore, that this fact alone isn't harmful to their reputation? Not notifying customers, in my eyes, would destroy any semblance of reputation further. > Typically the comp…

I'm not really commenting on the company side, but yes: plaintext passwords are bad, companies should notify customers when legally required, and I'd like companies to go further. Legally, bypassing security controls, using credentials that are not yours, and accessing data without authorization is a crime[1]. I see no indication that this blog post was authorized. Others should not consider this blog post as a good…

> [...] reported the leaked credentials and stopped.

But, and this can be a significant differentiator from a legal standpoint in multiple jurisdictions[0], they did not use leaked credentials, nor did they circumvent any barriers. They used a publicly accessible endpoint to create their own, completely new user that just had access rights from the get-go.

[0] Sticking solely with US examples, most notably United States v. Auernheimer which was in part overturned on jurisdictional issues, in part due to the following: "We also note that in order to be guilty of accessing “without authorization, or in excess of authorization” under New Jersey law, the Government needed to prove that Auernheimer or Spitler circumvented a code-or password-based barrier to access. See State v. Riley, 412 N.J.Super. 162, 988 A.2d 1252, 1267 (N.J.Super.Ct.Law Div.2009). Although we need not resolve whether Auernheimer's conduct involved such a breach, no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier. The account slurper simply accessed the publicly facing portion of the login screen and scraped information that AT & T unintentionally published."

Re: I pwned half of America's fast food chains simultaneously

#479

Post by pnutjam »

gosub100 wrote: post #466
pnutjam wrote: post #464

Earlier quoted context omitted.

https://www.pbs.org/race/000_About/002_04-experts-02-02.htm

I didn't ask what GPT or 3 random people said. why can't you articulate your own position?

Well you didn't answer my question. But I'm going to assume you're hinting at the false equivalency conservative line to trot out about prejudice against poor it rural people.

Prejudice is rooted in lack of knowledge and unfamiliarity. Racism is familiar and has it's own body of knowledge; all wrong, but vehemently defended. Racists try to build their own narrative.

Re: I pwned half of America's fast food chains simultaneously

#480

Post by logifail »

bitexploder wrote: post #460
logifail wrote: post #354

Earlier quoted context omitted.

> There is usually a pretty clear and obvious point where you can stop [..] sometimes the juice isn't worth the squeeze to keep going as you often have proven the thing you needed to or found the critical defect Those who are tasked - and are being paid(!) - to "[do] a cybersecurity assessment" will typically be given a brief. For those who aren't tasked - or being paid(!) - to do this stuff, things are much less cle…

If you aren't being tasked and you aren't being paid it is still really clear. Go look at almost any bug bounty and they will give you really clear "when to stop terms" Often the moment you access data you aren't supposed to access (exposing PII) or come to a point where you could even potentially disrupt the operation of the system you need to stop. When we begin any assessment on a production system we have a very…

> Gaining root to any network you don't own or have authorization to operate is clearly crossing the line

Q: As an attacker - whatever colour your hat - how are you supposed to know if any particular action may gain you root unless/until you try it?

Post reply on HN