Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We hacked Burger King: How auth bypass led to drive-thru audio surveillance

bobdahacker.com

Post reply on HN
Print view View original

61–70 of 239 posts

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#61

Post by akerl_ »

juujian wrote: post #53
weitendorf wrote: post #13

Reading between the lines, it looks like the story behind the story here is that this security researcher followed responsible disclosure policies and confirmed that the vulnerabilities were fixed before making this post, but never heard back anything from the company (and thus didn’t get paid, although that’s only a fair expectation if they’ve formally set expectations for paying out on stuff like this ahead of time…

I would argue that it is an ethical thing to do so if it sends a signal to pay whitehats appropriately.

Who is getting that signal?

Burger King is almost certainly going to experience no damage from this.

Their takeaway will likely be entirely non-existent. They’ll fix these bugs, they’ll probably implement zero changes to their internal practices, nor will they suddenly decide to spin up a bug bounty.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#62

Post by natebc »

JKCalhoun wrote: post #52
parineum wrote: post #47

Earlier quoted context omitted.

Audio cannot be recorded without consent in CA. Security cameras have an option to disable audio for this reason. People never do it but it's the case. It's related to wiretapping laws that are very broad.

California or Canada?

and removed so that i don't get sued for gross misinterpretation, ignorance and misinformation spreading.

What was here was a link to a California statute that is apparently misinformation somehow. Who knows, I'm just some igorant redneck apparently.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#63

Post by singleshot_ »

newhotelowner wrote: post #41
unyttigfjelltol wrote: post #37

Earlier quoted context omitted.

You don’t get to secretly record voices in public spaces.

Yes, You can in America. Video recording is permitted without consent in the public places. Example CCTVs.

I've had some challenges recording voices with video, but I salute your efforts.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#64

Post by chimpanzee »

akerl_ wrote: post #61
juujian wrote: post #53

Earlier quoted context omitted.

I would argue that it is an ethical thing to do so if it sends a signal to pay whitehats appropriately.

Who is getting that signal? Burger King is almost certainly going to experience no damage from this. Their takeaway will likely be entirely non-existent. They’ll fix these bugs, they’ll probably implement zero changes to their internal practices, nor will they suddenly decide to spin up a bug bounty.

The signal is for the hats. Black hats may be more likely to attack. White hats will find better things to do. Some might even swap hats.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#65

Post by akerl_ »

chimpanzee wrote: post #64
akerl_ wrote: post #61

Earlier quoted context omitted.

Who is getting that signal? Burger King is almost certainly going to experience no damage from this. Their takeaway will likely be entirely non-existent. They’ll fix these bugs, they’ll probably implement zero changes to their internal practices, nor will they suddenly decide to spin up a bug bounty.

The signal is for the hats. Black hats may be more likely to attack. White hats will find better things to do. Some might even swap hats.

You’ve described a totally different “signal” than the comment I replied to.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#66

Post by EvanAnderson »

newhotelowner wrote: post #41
unyttigfjelltol wrote: post #37

Earlier quoted context omitted.

You don’t get to secretly record voices in public spaces.

Yes, You can in America. Video recording is permitted without consent in the public places. Example CCTVs.

Different states have differing laws regarding recording conversations. In some states both parties in conversation must consent to recording: https://www.justia.com/50-state-surveys/recording-phone-call...

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#67

Post by nerdsniper »

nycpig wrote: post #49
newhotelowner wrote: post #41

Earlier quoted context omitted.

Yes, You can in America. Video recording is permitted without consent in the public places. Example CCTVs.

That is a farily broad statement. How would you reconcile your statement against state laws that require all-party consent for audio recordings? e.g. CISA, or FSCA

Those don’t apply to public spaces in the USA. This is super well-established law. If you needed consent to record in public there would be nearly zero YouTube videos recorded in public. And security cameras would generally not be allowed to record audio. And Tesla’s “Sentry mode” would be illegal.

In the USA, there is no right or legal expectation of privacy in public spaces, which includes fast food restaurants that are open to the public (indoors or outdoors)

Edit: Another commenter has made me aware that some states do ban non-consensual audio recordings in public: https://www.dmlp.org/legal-guide/massachusetts-recording-law

The laws prohibiting these recordings have neither been upheld nor overturned by the US Supreme Court.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#69

Post by nerdsniper »

techjamie wrote: post #17

The voice recordings at the drive thru without disclaimers of recording seem like maybe a two party state lawyer's wet dream? I guess they could argue shouting into a machine in public carries no expectation of privacy, but it seems like a liability to me.

There’s no liability or exposure for recording non-consensually. It’s a public space. There’s not even an edge case. If a random member if the public could walk into the drive-thru (which they can) then anything can be recorded without notification or consent.

Edit: Another commenter has made me aware that some states do ban non-consensual audio recordings in public: https://www.dmlp.org/legal-guide/massachusetts-recording-law

The laws prohibiting these recordings have neither been upheld nor overturned by the US Supreme Court.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#70

Post by nerdsniper »

EvanAnderson wrote: post #66
newhotelowner wrote: post #41

Earlier quoted context omitted.

Yes, You can in America. Video recording is permitted without consent in the public places. Example CCTVs.

Different states have differing laws regarding recording conversations. In some states both parties in conversation must consent to recording: https://www.justia.com/50-state-surveys/recording-phone-call...

Thats only for private phone calls not for public spaces.

Edit: Another commenter has made me aware that some states do ban non-consensual audio recordings in public: https://www.dmlp.org/legal-guide/massachusetts-recording-law

The laws prohibiting these recordings have neither been upheld nor overturned by the US Supreme Court.

Post reply on HN