71–80 of 81 posts
My favourite part form the original report was that paradox had no way to find their security team ( to contact) and their security page just had "We worry about security, so you don't have to." https://web.archive.org/web/20250208000940/https://www.parad...
Your favorite part? Are you sick? I can't imagine having a "favorite part" of any of this.
It's funny how mcdonalds did everything in their power to make it almost impossible to run their mcdonalds app on a rooted phone, but their backend infrastructure is beyond broken (security wise)
Why does one even need an app for a fast food restaurant?
My favourite part form the original report was that paradox had no way to find their security team ( to contact) and their security page just had "We worry about security, so you don't have to." https://web.archive.org/web/20250208000940/https://www.parad...
Your favorite part? Are you sick? I can't imagine having a "favorite part" of any of this.
Earlier quoted context omitted.
UUIDv4 may or may not use a cryptographically secure random number generator. Python's UUID library, for example, falls back to the insecure 'random' module. Given a handful of outputs, it's possible to predict future ones.
Uh... Come again? def uuid4(): """Generate a random UUID.""" return UUID(bytes=os.urandom(16), version=4) https://github.com/python/cpython/blob/3.13/Lib/uuid.py
Earlier quoted context omitted.
Using numeric IDs on an outward facing object is, for the most part, totally fine. It's a serious tradeoff to ditch the nice properties of numerical IDs and the legibility they provide in order to cargo-cult a "we must reveal nothing" approach, as you would here via UUID. It also misses the point of the actual security lesson: no matter the identifier, you need to be applying access controls to your data. Even if you…
Yes it makes very little difference if I can see all your public published blog posts on a WordPress site by iterating the number.
> Moreover, when Carroll attempted to alert Paradox to the breach, he was unable to find a security disclosure contact. The company's security page mostly consists of a simple assurance that users shouldn't need to worry about security. Eventually, after the researchers emailed "random people," Paradox and McDonald's confirmed that they resolved the issue in early July.
Shouldn't need to worry indeed. McDonald's evidently doesn't either.
Can someone tell them to put "Set a password a five-year-old child can't guess" onto their deployment checklist?
Earlier quoted context omitted.
Uh... Come again? def uuid4(): """Generate a random UUID.""" return UUID(bytes=os.urandom(16), version=4) https://github.com/python/cpython/blob/3.13/Lib/uuid.py
Nice. Looks like I was looking at an old version of the file. https://github.com/python/cpython/commit/09ba98436444d2a4e11...
So there really shouldn't be anyone using that today, thankfully.
Earlier quoted context omitted.
You could also "just" have an internal-use only numeric ID, or use a UUIDv7.
TIL about UUIDv7 -- thanks!
Earlier quoted context omitted.
123456 was both the username & password, they were hit by CWE-1392 because someone failed to change the default credentials.
The writeup never claimed that 123456:123456 were default credentials?
> During a cursory security review of a few hours, we identified two serious issues: the McHire administration interface for restaurant owners accepted the default credentials 123456:123456, and an insecure direct object reference (IDOR) on an internal API allowed us to access any contacts and chats we wanted. Together they allowed us and anyone else with a McHire account and access to any inbox to retrieve the personal data of more than 64 million applicants.