Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'123456' password exposed chats for 64M McDonald's job applicants

bleepingcomputer.com

Post reply on HN
Print view View original

1–10 of 81 posts

Re: '123456' password exposed chats for 64M McDonald's job applicants

#3

Post by bsuvc »

It sounds like there were two separate problems:

The first was that 123456 was the credentials for the admin panel.

The second was an insecure direct object reference, where the lead_id querystring parameter can be changed on an API call to retrieve another applicant's data.

Re: '123456' password exposed chats for 64M McDonald's job applicants

#7

Post by bigfatkitten »

Volundr wrote: post #5
micw wrote: post #4

Wait, 64 million applicants, not applications? That's like 20% of the US population!

Maybe it includes applications outside the US?

They use this site for hiring globally. The number of privacy regulators they will have to notify and deal with is going to make this messy.

Re: '123456' password exposed chats for 64M McDonald's job applicants

#9

Post by hardwaresofton »

bsuvc wrote: post #3

It sounds like there were two separate problems: The first was that 123456 was the credentials for the admin panel. The second was an insecure direct object reference, where the lead_id querystring parameter can be changed on an API call to retrieve another applicant's data.

A third problem that senior engineers might recognize: using numeric IDs on an outward facing object. UUIDs would have made this impossible as well
Post reply on HN