21–30 of 81 posts
Wait, 64 million applicants, not applications? That's like 20% of the US population!
I just looked it up 13 of the 40k francises are in the US. Assuming linearity, thats about 21 million US applicants since they started keeping centralized, digital records.
20% of Americans younger than 40 is not a bad guess.
It's funny how mcdonalds did everything in their power to make it almost impossible to run their mcdonalds app on a rooted phone, but their backend infrastructure is beyond broken (security wise)
Btw, I wondered why they flight root on the phone at all?
suhide in magisk makes my banking app work, but not mcdonalds :)
It sounds like there were two separate problems: The first was that 123456 was the credentials for the admin panel. The second was an insecure direct object reference, where the lead_id querystring parameter can be changed on an API call to retrieve another applicant's data.
> The first was that 123456 was the credentials for the admin panel.
No. 123456 was the credentials for the test setup, which contained nothing. But you could use the IDOR to access data from the test setup.
If 123456 had been the credentials to the admin panel, there would have been no point in exploiting an IDOR - as an admin, you can just look at whatever you want.
Earlier quoted context omitted.
Not impossible, just more difficult to guess. "Security through obscurity" isn't really good enough.
Yes and… UUIDs aren’t “just more difficult to guess.” They are inconceivably harder to guess. > Put another way, one would need to generate 1 billion v4 UUIDs per second for 85 years to have a 50% chance of a single collision.
It sounds like there were two separate problems: The first was that 123456 was the credentials for the admin panel. The second was an insecure direct object reference, where the lead_id querystring parameter can be changed on an API call to retrieve another applicant's data.
123456 was both the username & password, they were hit by CWE-1392 because someone failed to change the default credentials.
Earlier quoted context omitted.
Not impossible, just more difficult to guess. "Security through obscurity" isn't really good enough.
Yes and… UUIDs aren’t “just more difficult to guess.” They are inconceivably harder to guess. > Put another way, one would need to generate 1 billion v4 UUIDs per second for 85 years to have a 50% chance of a single collision.
Wait, sixty-four MILLION people actually wanted to work there? Are they counting everybody since 1954?
There should be no surprise here.
Earlier quoted context omitted.
A third problem that senior engineers might recognize: using numeric IDs on an outward facing object. UUIDs would have made this impossible as well
Using numeric IDs on an outward facing object is, for the most part, totally fine. It's a serious tradeoff to ditch the nice properties of numerical IDs and the legibility they provide in order to cargo-cult a "we must reveal nothing" approach, as you would here via UUID. It also misses the point of the actual security lesson: no matter the identifier, you need to be applying access controls to your data. Even if you…
Incredible! That’s the combination to my matched luggage!
Wait, sixty-four MILLION people actually wanted to work there? Are they counting everybody since 1954?