We hacked Burger King: How auth bypass led to drive-thru audio surveillance

We’ll use an influencer for example. A false dmca claim has costs for them. Immediate costs in time, demonetizing, and reputation. It also has longer term risks - e.g., copyright strikes become bans. They are incentivized to pushback but have limited tools to do so.

When dealing with a company whose business is filing dmca complaints using an automated system, the business model isn’t a lawsuit - it’s a settlement where the influencer is made whole and you get paid. The risk to the company is existential if you have enough clients using you to push back and risking them getting a platform ban or an injunction against them filing automated dmca complaints. Say they file a thousand complaints a day against a thousand YouTube channels. If even 50 of those channels file a counter claim it’s going to set off alarm bells.

All that being said the most toxic part of this is the company calling itself a cyber security company and trying to obfuscate seemingly pretty responsible disclosures using dmca.

> It's DMCA abuse because that process is only legal to use in case of actual copyright infringement, not just any content you might have a moral claim over.

I will reply to this comment because it's the easier to address, you're really hitting on the main misconception :D

It is incorrect to think that the DMCA form is only valid for copyright.

You need to contact the other party to start a legal dispute, you can do so by any available communication channels. The website is hidden behind cloudflare which purposefully hides the identity of the author and prevents any contact, except via a DMCA form. Burger King filled the DMCA form to get in touch with the author. It's merely a mean to legally contact the author and start a dispute, in the absence of better options.

It worked, cloudflare forwarded the form to the author (and the author decided to take down the article on their own). I really can't think of any reason why it would not be considered a reasonable and legitimate use of the form. All the better because it's an official legal form.

CEO was once annoyed with me while I worked IT (we handled facilities/security, too; was It wasn't enough to just shove a folder through the gap of the doors; you had to ensure the folder opened up as it was falling, changing more of the pixels to get to the trigger threshold. It took me around 5 minutes to get it to consistently trigger. CEO was displeased dev & design team now knew how to bypass the door lock from the outside; he wasn't going to pay to fix it.

Maybe best to internalize Have It Your Way like BK's teams did.

This is written like an LLM trying to be witty and it's nearly unbearable.