We hacked Burger King: How auth bypass led to drive-thru audio surveillance

Post by smcin » Sat, Sep 06, 2025, 8:02 PM UTC

thimkerbell wrote: post #87

techjamie wrote: post #30

Earlier quoted context omitted.

That's what I'm getting at with the expectation of privacy part. Talking into a drive thru speaker isn't really a private activity since everyone around can kinda hear it, but it'd probably be better to disclaim it anyway since someone attempting to file on you for it still costs money.

Is there an easy effective way to tell a company not to ask its customers' phone numbers if someone parked nearby can overhear them?

Post by bobmcnamara » Sat, Sep 06, 2025, 8:26 PM UTC

immibis wrote: post #115

bobmcnamara wrote: post #106

Earlier quoted context omitted.

This seems to presume the company is ready and willing to take feedback. Maybe things are better now. Years ago the only contact for many companies was through customer service. "What do you mean you're in our computer? You're obviously on the phone!"

Also "Oh, you hacked us? We'll call the police right away. You're going to jail." - followed by you actually going to jail for many years. Sometimes, anonymous, public, uncoordinated disclosure actually leads to the best security outcome in the long run, since security researchers in jail isn't that.

Post by beefnugs » Sat, Sep 06, 2025, 8:35 PM UTC

weitendorf wrote: post #13

Reading between the lines, it looks like the story behind the story here is that this security researcher followed responsible disclosure policies and confirmed that the vulnerabilities were fixed before making this post, but never heard back anything from the company (and thus didn’t get paid, although that’s only a fair expectation if they’ve formally set expectations for paying out on stuff like this ahead of time…

Post by import » Sat, Sep 06, 2025, 8:54 PM UTC

Post by Retric » Sat, Sep 06, 2025, 9:04 PM UTC

billy99k wrote: post #108

akerl_ wrote: post #34

Earlier quoted context omitted.

As a nitpick, you’re describing coordinated disclosure. Branding it as “responsible” puts the thumb on the scale that somehow not coordinating with the vendor is irresponsible.

It is irresponsible. It brings attention to an issue that has not yet been resolved, which will likely lead to users getting data stolen/scammed. Even the most security-aware companies have a process to fix vulnerabilities, which takes time. I would never hire someone that doesn't reaponsibly coordinate with the vendor. In most cases it's either malicious or shows a complete lack of good judgement. In the case of bob…