Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We hacked Burger King: How auth bypass led to drive-thru audio surveillance

bobdahacker.com

Post reply on HN
Print view View original

221–230 of 239 posts

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#221

Post by bobmcnamara »

bigiain wrote: post #172
bobmcnamara wrote: post #106

Earlier quoted context omitted.

This seems to presume the company is ready and willing to take feedback. Maybe things are better now. Years ago the only contact for many companies was through customer service. "What do you mean you're in our computer? You're obviously on the phone!"

> This seems to presume the company is ready and willing to take feedback. Near the bottom of the blog post it says: > When | What Happened > Day 1, same day | RBI fixes everything faster than you can say "code red" > Credit where it's due – RBI's response time was impressive.

Oops. I mean that generally my experiences have been less good

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#225

Post by aspenmayer »

12_throw_away wrote: post #165
aspenmayer wrote: post #99

Earlier quoted context omitted.

More info here: https://iowacapitaldispatch.com/2023/06/23/lawsuit-over-auth...

Oh, this is a rabbit hole. As far as I can tell the pentesters' suit against the sheriff is still ongoing, but back in Iowa courts. The federal court's ruling is ... not good [1]: 1) The court found that the county sheriff had the pentesters arrested and encouraged their prosecution _not_ because he believed there was any crime, but instead that was angry at some state official. (Which, y'know, sounds like a pretty s…

Thanks for finding the court docs!

Darknet Diaries has an episode on this (#59), with interviews from the parties involved.

https://www.youtube.com/watch?v=Y0AbHKcIQxk

https://darknetdiaries.com/episode/59/

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#226

Post by MangoToupe »

parineum wrote: post #48
michaelt wrote: post #36

Earlier quoted context omitted.

> They're getting paid $6 an hour. [...] Why write software to micromanage minimum wage employees? Ironically, the less a job pays, the harsher and more demanding the bosses tend to be. Earning six figures as a software developer, working from home, and you have to take a week off sick? No problem, take as long as you like, hope you feel better soon. Earning minimum wage at a call centre? Missing a shift without 48 h…

That's a correlation to how easily replaced you are.

On the other hand, i can't imagine it's easy to find a legal citizen willing to work for that wage. Especially when school's open.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#227

Post by A4ET8a8uTh0_v2 »

I am mildly amused, but it only now makes me want to dig through internnet archive ( I believe another poster already helpfully provided ). GL BK. It sounds like Streisand will strike again.

edit: Good read btw. I am curious as to why employees are in that database though.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#228

Post by A4ET8a8uTh0_v2 »

baobabKoodaa wrote: post #194
jeroenhd wrote: post #139

Earlier quoted context omitted.

They heard back from the company alright, they DMCA'd the post: https://infosec.exchange/@bobdahacker/115158347003096276 The screenshot of the email lacks detail so I don't know what part of the DMCA the author breached here, but this feels a lot like your standard DMCA abuse. This AI generated takedown was funded in part by a Y-Combinator: https://cyble.com/press/cyble-recognized-among-ai-startups-f...

I did not know Cloudflare treats fake DMCAs the same way as Youtube. Since when!?

Can we start discussing 'you can run your own website/cloudflare/isp/backbone' conversation all over again instead of addressing some basic level of fair play?

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#229

Post by danielheath »

baobabKoodaa wrote: post #194
jeroenhd wrote: post #139

Earlier quoted context omitted.

They heard back from the company alright, they DMCA'd the post: https://infosec.exchange/@bobdahacker/115158347003096276 The screenshot of the email lacks detail so I don't know what part of the DMCA the author breached here, but this feels a lot like your standard DMCA abuse. This AI generated takedown was funded in part by a Y-Combinator: https://cyble.com/press/cyble-recognized-among-ai-startups-f...

I did not know Cloudflare treats fake DMCAs the same way as Youtube. Since when!?

DMCA penalties are so severe that all parties are incentivised to run/use a parallel scheme.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#230

Post by nerdsniper »

flimflamm wrote: post #200
nerdsniper wrote: post #69

Earlier quoted context omitted.

There’s no liability or exposure for recording non-consensually. It’s a public space. There’s not even an edge case. If a random member if the public could walk into the drive-thru (which they can) then anything can be recorded without notification or consent. Edit: Another commenter has made me aware that some states do ban non-consensual audio recordings in public: https://www.dmlp.org/legal-guide/massachusetts-rec…

Creating a database of recordings without user being able to know/influence is clearly violation of GDPR IF there is PII. That's going to be costly for BK.

GDPR only exists in Europe. Are they doing this there too?
Post reply on HN