Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I pwned half of America's fast food chains simultaneously

mrbruh.com

Post reply on HN
Print view View original

201–210 of 513 posts

Re: I pwned half of America's fast food chains simultaneously

#201

Post by Gabrys1 »

kelnos wrote: post #153
LeoPanthera wrote: post #134

Earlier quoted context omitted.

I don't think it was an unreasonable assumption given that the article talks specifically about American fast food chains.

I guess three clues: * They were just trolling Firebase accounts for anything left open, and the first hit was a company that works with a bunch of American fast food chains. That doesn't require OP to live in the US. * They specified "America's fast food chains"; someone living in the US probably wouldn't qualify it with "America's". * They used a $DAY/$MONTH date format, which is uncommon in the US.

> * They specified "America's fast food chains"; someone living in the US probably wouldn't qualify it with "America's".

I call that US-centrism. Quite annoying to non-Americans living in the States.

Re: I pwned half of America's fast food chains simultaneously

#202

Post by quickthrower2 »

habosa wrote: post #116
laurieg wrote: post #86

Earlier quoted context omitted.

The flakey firebase local emulator is the bane of my existence, and poorly documented to boot. On top of the Googlized clickops, there's the whole Firebase vs Google cloud situation, where you end up having to drop down to "real" google cloud for certain specific features. The docs appear to be detailed but you often end up with more questions than answers. If you are ever thinking about using firebase, give Supabase…

Just curious, what’s flakey about it? I’m not at Google anymore but I was a core contributor to the Firebase emulators project when I was. I can think of many flaws with the emulators but flakey is a new one to me

It often just crashed with an error. Now I am a Windows user, so MMMV, and this might be the reason. In some places the behaviour was slightly different and I had to work around that. I don't recall the specifics. And the idea of a test suite that starts the emulator, runs the tests and gives a result, that can reliably run.... well I gave up on that.

Re: I pwned half of America's fast food chains simultaneously

#203

Post by quickthrower2 »

SkyMarshal wrote: post #111
eddiewithzato wrote: post #102

Earlier quoted context omitted.

All roads lead back to RDBMS, it's amazing how this piece of theory just works.

> this piece of theory Key words right there. The relational model is a timeless mathematical model for data that gains both logical consistency and adaptability as a result. It has and will continue to stand the test of time.

And in practice it has a superpower: agility. The pointy haired boss wants your OLTP to be an OLAP, and you can kind of hack it. You want to put the user's birthday on the settings page this quarter? Sure. Even if that is in another table. You can even make it efficient.

Re: I pwned half of America's fast food chains simultaneously

#204

Post by [deleted] »

MrBruh wrote: post #61
cedws wrote: post #56

It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan. If it is indeed the latter, I wonder how they are so brazen about it. Does chattr.ai have a responsible disclosure policy? In my eyes people should be free to pentest whatever as long as there is no intent to cause harm and any findings are reported. Sadly, many companies will freak out and get the law involved, even if you are…

> Good Samaritan The web is insecure enough as it is, I just want to do my part to make it that little bit safer :)

[deleted]

Re: I pwned half of America's fast food chains simultaneously

#205

Post by jb1991 »

az226 wrote: post #195
counterpartyrsk wrote: post #167

This is the most perfect blog post. ZERO fluff, straight to the point. Win.

Except it is almost perfect — it would have been perfect had he been thanked and rewarded. Of course that is not on him, but felt so disappointed reading that at the end.

"Perfect" is referring to the blog post, not the outcome.

Re: I pwned half of America's fast food chains simultaneously

#206

Post by jampekka »

busterarm wrote: post #197
Aurornis wrote: post #110

> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some particip…

The incentives in infosec are weird. Full disclosure is the only honest way to operate. For everyone involved. Much smarter folks than me have been saying it for decades.

Why should you be honest and open with companies? They for sure aren't with you.

Re: I pwned half of America's fast food chains simultaneously

#207

Post by darthvervet »

redcobra762 wrote: post #190
Eisenstein wrote: post #187

Earlier quoted context omitted.

Shame is absolutely a valuable tool for change. Without it society would not function since many of our 'rules' are self-enforced.

Nope, shame is ineffective as a tool for change. More often people shut down or ignore you if you attempt to shame them than actually make the change you want. Besides, it's frequently just about vengeance anyway. Shame is really hate of other, for the most part. As a tool for oppression however, yes it's quite effective.

[dead]

Re: I pwned half of America's fast food chains simultaneously

#208

Post by urbandw311er »

theonething wrote: post #189

> If you grab the list of admin users from /orgs/0/users, you can splice a new entry into it giving you full access to their Administrator dashboard. I'm not clear on this. Splice a new entry into what? The list of admin users? And then do what with it?

I read this as worse - splice being a client side JavaScript function to add items to arrays. My concern here is whether the “is admin user” perms checks were done solely on the client side and not enforced on the API endpoint!

Re: I pwned half of America's fast food chains simultaneously

#209

Post by quickthrower2 »

endisneigh wrote: post #76
quickthrower2 wrote: post #68

Earlier quoted context omitted.

There is no such thing as “relational data” here. There is the data I need to store to implement my app. No matter how I shaped it, it was suboptimal. Where it might shine is a subsystem like chat with just messages. Oh just got a flashback about Firebase rules. That alone is a time sink where you could have got the project done in Rails already :-) The hard work of using Firebase’s apis, libraries, reading it’s docs…

From this post I can tell you’re not really understanding how Firebase is supposed to be used, which is fine. For you it’s better to use the traditional approach with database and app server. And yes, there is such a thing as relational data. If you do not believe this then you really shouldn’t use Firebase (or dynamodb for that matter).

I know I am holding it wrong etc! But I really tried in earnest, as a fanboy of firebase, for quite a long time. The problems I had were with basic things. You have companies, a company can have many users, users might belong to more than one company (hello Slack...) and then there can be relationship between users.

Putting aside the problem between chair & keyboard.

Another difference is more if you make a mistake in your relational schema, you can SQL your way out of it - add an extra join or group by. And you can also fairly easily migrate you way out of it to a new schema that is the right structure.

This requires actual code with firebase, and a lot of patience, and probably a lot more downtime. So you need more of a waterfall approach, I would suggest, to design a schema ahead of time, and know all of your requirements. NoSQL document-oriented schemas just aren't flexible (unless the DB supports something like materialized views to help you get out of it)

Re: I pwned half of America's fast food chains simultaneously

#210

Post by 8organicbits »

I would have stopped once I confirmed the leaked keys were valid. Looking at what types of data you had access to wasn't required. Downloading plaintext passwords of other people is probably too far. Impacted users may need to be notified about a breach. If needed, create an account of your own and target only that.

If there was a pentester agreement, safe harbor, or other protection that's different. Be careful out there.

Post reply on HN