29 ms·
Stealing passwords from McDonald's users
- ascotan 10y agoSo someone wrote an angular app that stores your password in a cookie in your own browser that is encrypted client-side using cryptojs... Hmm. Seems on par with the security of pretty much every angularjs site i've seen. Moving on.
- dotancohen 10y agoWhy the downvote? This is extremely relevant. There is no 100% security, there is no reason to store sensitive information (even "encrypted"). Had this been a session token the problem would have been less severe (session tokens won't be reused on the user's Gmail account for instance), easier to detect, and easier to mitigate once discovered.
- LukeB_UK 10y ago> Why the downvote? Probably because of this: > Hmm. Seems on par with the security of pretty much every angularjs site i've seen. Moving on.
- martinald 10y agoThat disclosure timeline is very aggressive over the holiday period. Did they ever get in touch with you after the 5th?
- cyberferret 10y agoAgreed - the timeline is over the most popular period of the year when most 'back office' people (i.e. IT teams, management, and others not involved in direct customer service) are away. The least the OP could have done is waited until mid-January to release to public to allow them time to get some resources onto the problem IMO.
- ekianjo 10y agoWould be surprised if a company like McDonalds had no emergency crisis procedure to handle issues that would damage their reputation anytime, anywhere and recall people even when they are off on holidays. Maybe they thought it was not worth taking it seriously.
- Nition 10y agoEdit: Realised I was being dumb here. I get it now.
- trelliscoded 10y agoIf you can sniff other users' cookies, you can get their passwords. Good thing no one reuses passwords across sites!
- caf 10y agoWhere the proof-of-concept shows the password in an alert box, a malicious implementation can send it to a remote server. What his proof-of-concept page does, any website can do.
- cyberferret 10y agoI agree, but like someone else pointed out on this thread, this was probably a third party agency who built the site. If they had closed shop for the holidays, and everyone at the agency was overseas visiting family etc., then the response would be difficult. At best, perhaps a programmer could be pulled away from his Christmas pudding to hack a patch remotely on his laptop, or take down the site entirely until they could handle it properly? Just speaking from my own experience here - I run a small web dev agency, and I know that during the Christmas break, we can only offer rudimentary patch up work for our clients, and that is only depending on the internet connection at wherever our team members are.
- Deestan 10y agoJust a reply of "Hi, our IT staff confirms this is a security issue. We intend to fix it as soon as possible. Thank you for your help." doesn't need to wait for the 3rd party agency to come back from holiday.
- beedogs 10y agoNo excuse. It's the middle of January now, the holidays are long over, and they're one of the biggest companies on the planet. They had plenty of time to respond.
- largehotcoffee 10y ago>Public Disclosure: 05 Jan 2017 23:31:42 GMT Which was roughly 2-3 days after returning from New Year's. Public release was way too early, author should have waited.
- trimbo 10y ago> they're one of the biggest companies on the planet Yeah, making hamburgers! Out of 420,000 employees, they have all of 17 IT jobs on their career site. They deserve a break today.
- deleted 10y ago[deleted]
- sneak 10y ago> Yeah, making hamburgers! Out of 420,000 employees, they have all of 17 IT jobs on their career site. How many credit cards get swiped/waved per day at their PoS terminals? If they don't have a 24/7 infosec team they're Doing It Wrong™.
- MichaelBurge 10y agoI'm not sure that agrees with the franchise model. McDonald's corporate owns the real estate, but not most of the businesses. So most of those terminals aren't actually theirs.
- i336_ 10y agoOh wow. That model is atrocious in terms of providing decent security.
- 10y ago
- kdazzle 10y agoYeah, the disclosure comes close to violating their own Responsible Disclosure policy, which is 3 business days. If McDonald's enployees get the holidays off and go back to work on the 3rd, they would have had 2 days to respond. Meaning that if McDonald's disclosed a vulnerabilty to Finnwea.com over the same time period, finnwea.com says they might have sued them. So maybe that guy was a little trigger happy. Great hack, though.
- sneak 10y agoYes, because a company at #109 on the Fortune 500 shouldn't bother spending money on 24/7 infosec. "Responsible disclosure" is simply a meme to reframe "instant full disclosure" as irresponsible, which is dishonest. Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act? Look at this bug, in particular. This is not about this bug; this is about basic negligence. It would have been completely appropriate to blog about this on day zero of discovery. This is not about "time to patch", this is about "time to convince the widest number of people that you should never trust McDonalds with your data".
- ceejayoz 10y ago> Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act? I've worked at a newspaper. Your framing of the question is deliberately silly - they'd sit on it to prevent innocents from being harmed, not to protect the guilty. Once it's fixed (or after a reasonable amount of time not getting fixed), then they happily nail the guilty people to the wall.
- nmstoker 10y agoI could be wrong but it sounds like your comment is confused about what a business day is. If a firm decides to let some individuals have the whole time off during the holiday period, that doesn't mean those aren't business days from an external perspective.
- flukus 10y agoThis isn't a buffer overrun that's hard to detect though, this seems like something that should have been found using more proactive measures.
- mmaunder 10y agoAgreed. It can take months to connect with some big companies. Reported via Twitter? Come on. Tip: InMail on LinkedIn can be quite effective if you're having trouble. Start at the ceo and work your way down.
- erichurkman 10y agoIs your hit rate on LinkedIn for security issues that high? Mine's in the single digits, almost as bad as email. What do you say in your InMail messages that give you a higher response rate? Are you using premium services?
- mmaunder 10y agoYes you have to pay for InMail. Just be clear and concise. Worked for a Freshdesk vuln we reported. I pinged the ceo.
- MertsA 10y agoThat brings up an interesting question though. How long is long enough for disclosure in cases where the company has made it impossible to notify them of a vulnerability? If someone tries 10 different ways to get in touch and makes absolutely no progress it would seem that it would be better to disclose sooner rather than later. Giving companies plenty of time to fix a vulnerability is one thing but if the company isn't even working on the issue because they've isolated all external contact at least if disclosure happens sooner that's less time that an unknown attacker can use that vulnerability without anyone being aware of the issue.
- revelation 10y agoLove the CryptoJS. This is how I store all my own text files on my own computer. It's just so bizarre. What were they expecting that to achieve?
- wnevets 10y agoIt was probably a bullet point that helped sale the agency that built the site to a McDonalds executive/manager.
- Deestan 10y ago> What were they expecting that to achieve? we added a crypto for security measures. this seemed like a good place to add a crypto. it is now more secure. In my basement I have a fingerprint+PIN protected blastproof safe bolted to the foundation. I use it to store my house keys, so that if anyone breaks into my house, they won't get access to my house.
- nommm-nommm 10y agoSomeone said "we need crypto" but didn't understand it as a concept.
- deleted 10y ago[deleted]
- nihonium 10y agoBiggest problem here is their architectural design. They're mixing server side code with front end. They're printing angular code using back end, but they are not filtering {} characters. Basically, user can execute any angular code, therefore any javascript.
- rtpg 10y agoYeah, this problem is basically unsolvable if you wish to have { characters anywhere in your page from server-side rendering. - Have the possibility of {{ and }} in your server-side output (or whatever symbols you configured Angular for) - Have Angular.JS on a page with server-side output Choose one. It's important to realize that this affects things like user input as well. So form initials/form defaults can also be affected by this issue! A bit of a silly way to fix this problem is to modify your server-side escaping function (surely you have this!) to "escape" {{ with {<zero-width space>{. This will mess up things that need to be equal to each other, and can poison user input (because of form initials) but will protect you from this issue.
- catmanjan 10y agoIf you're displaying user input you could just encode to their matching HTML entities... { or the human friendlier one &rcurb (?)
- rtpg 10y agothat doesn't work because the HTML entity decoding happens before Angular does the scanning of the DOM for the brackets. So even if you use &rcurb; output from the server, Angular will still interpret the brackets "properly" As to why this works this way, consider the following: do you have to do HTML entity decoding when getting an input value from Javascript?
- 52-6F-62 10y agoCorrect me if I'm wrong but it appears they are now filtering the {} characters by URI encoding them upon submitting a search. This isn't to say they've fixed anything else yet (I haven't looked), but it may mitigate the efforts of the lazy (like me in this instance).
- ams6110 10y agoProbably unlikely that McDonalds built that themselves. I would guess they contracted it out. It's been a long time since I knew anyone in their in-house IT division but it was entirely back office stuff not public facing.
- matchagaucho 10y agoTrue. Very likely an interactive creative agency built the app. In-house IT typically controls the DNS 'A' record and reviews/oversees deployment of provided assets.
- rccrv 10y agoThey own the company that develops their software[1] as far as I know. It's a subsidiary. [1]: This company: https://www.rdisoftware.com/ https://www.rdisoftware.com/
- jgust 10y agoThey only work on POS & POS data related applications for McDonald's. They were purchased because of this fact.
- teknologist 10y agoGiven this grammatical error: > "Do you want to search <query> in news section?" I'd guess it was built by an Eastern European agency.
- deleted 10y ago[deleted]
- quizotic 10y agoCurious! Ten days after a public disclosure, and no statement from McDonald's? Have they fixed the problem? Do they not know?
- opcon 10y agoArchive/mirror: https://web.archive.org/web/20170115144533/https://finnwea.com/blog/stealing-passwords-from-mcdonalds-users https://web.archive.org/web/20170115144533/https://finnwea.c...
- vortico 10y agoBefore reading, I thought this about was stealing information from public WiFi. After reading, I realize this is for the McDonalds website, but why do people need a password for their website?
- sbassi 10y agoLast time I check was for press, to get PRs before they are public (in the embargo period)
- deathanatos 10y agoMcD's has embargoed press releases? …about… what?
- mseebach 10y agoYeah. Beats me too. What would an publicly traded firm with 30+k restaurants and half a million employees world wide be doing with a professional PR operation?
- mwill 10y agoMaybe for delivery? I believe some McDonalds deliver, right?
- pierrec 10y agoThey still haven't fixed it. I'm only getting it to work in Chrome though, seems like the Angular sandbox escape doesn't work in Firefox. See for yourself (I'm only posting the more harmless alert demo, but the others work too): https://www.mcdonalds.com/us/en-us/search-results.html?q=%20{{x%20%3D%20{'y':''.constructor.prototype};%20x['y'].charAt%3D[].join;$eval('x%3Dalert(1)');}} Then again, I wouldn't expect them to fix it very fast, considering how abysmal it is to basically store a user's password in a cookie in the first place.
- teemothunder420 10y agoADs are getting smarter
- ribs 10y agoWhat are those?
- beardog 10y agoThey use the same key and iv for every user What dev sits down, starts writing code, and thinks something like this is a good idea? Not to mention all the other problematic choices.
- kk_cz 10y ago- hey dude, what is this "key" parameter? - IDK, just copy this code from the stackoverflow, it works for me
- blowski 10y agoDevelopers at agencies with extremely tight deadlines. 'Caring' brings no revenue and if it means you miss the deadline, it actually means less revenue. Thus agency developers tend to implement the bare minimum to show it working. Everything else is chargable later.
- ianamartin 10y agoYou ask this question, but it seems like you don't know how the real world works. In a lot of places, you aren't asked to build a product. Especially if your core isn't technology. You are on a tech team that exists within the structure of a large organization that really doesn't care about technology at all. It's just a thing they want on a check list. So you get asked to throw something together to see if people like it. So you do. And you don't in your wildest dreams think that this piece of shit is going to see the light of day. It's just concept. And then the next thing you know, some assclown decides it's good. Okay great. But you didn't hear about it because the company is the size of McDonalds. Not a small startup with 6 people who all know what they are doing. So ops and infra get together and deploy this toy shit that you thought was just a joke mostly, and now you have incredible security problems. That's one way this happens. There are many others. Reality is a lot more complicated than what you are trying to suggest.
- mmahemoff 10y agoAlso, that tech team might in another large organization (not McDonald's) in another part of the world, where any work they do has to be budgeted for, agreed on, spec'd, tested, and released through a tedious process. Someone might be casually thinking "hmmm this doesn't seem quite right" but there would be a dozen hurdles to jump from that suspicion to getting anything done about it, so they keep quiet and move onto the next project. They might never even know or care if their code went live.
- pimlottc 10y agoSo the attack vector here is to send someone a link to the search results page with a malicious query that injects JS into the page to decode the users password and then submit it to the attacker's backend collection server? Is that right?
- pierrec 10y agoThat's the basic principle of XSS. A few years ago an XSS epidemic broke out where dozens of major websites were found to be vulnerable to cookie theft. Attackers could make a single page with dozens of sneaky iframes, one per vulnerability. Usually the contents of the cookie allows you to continue a user's session, though there can be all kinds of stuff idiotically stored directly in the cookie, as can be seen in this prime example.
- xyzzy4 10y agoNo. A more effective vector would be to send them to a funny video page to watch, that has nothing to do with McDonalds. And inside that video page you have a hidden iframe pointing to the malicious query which submits the McDonald's password to another backend server.
- rasz_pl 10y agomeh, make a mcdonalds.com search link that generates "Congratulations, you won a free mechanically deboned meat product!!1" and share it on bookface.
- iancarroll 10y agoTheir mobile application does or did send their Google GCM API keys to the client, along with a bunch of other bizarre server configuration information. I had no way to report it; I tried sending an email to their WHOIS contact to no avail. If anyone has successfully reported a vulnerability to them, let me know!
- akjainaj 10y agoGCM keys means you can send notifications to other users of the app?
- ipince 10y agoPardon my ignorance, but how are the passwords actually stolen? If I understand correctly, this exploit lets you execute arbitrary code on the search results page. And in this case, the code will load up an iframe from a separate place in McD's domain, get the 'penc' cookie and decrypt your own password. So you would still need to send a link to a McD registered user, who clicked in Remember Password, and then presumably send his/her decrypted password to your own servers (how?). And also somehow steal their username/email. Is that correct?
- dogshoes 10y agoIt's pretty simple to exfiltrate data from the JavaScript sandbox once it has been compromised via XSS. The simplest way is probably appending an img tag to the page's DOM, with a src pointing to a server you control and send the user's password as the image name.
- Orangeair 10y ago> Is that correct? Yes, that's the classic XSS attack pattern. It's like phishing, but better since you're sending the person a link to the actual website. And once they've clicked on it, they're already screwed; they don't even need to manually enter any information. > how? Once you have the cookie, its as simple as something like making an XMLHttpRequest to your own server that includes the decrypted email and password from the cookies.
- chadscira 10y agoIf they don't have X-Frame-Options the attacker can also just use a 1x1 iframe on a popular website or shitty ad network to trigger that page to load
- gjkood 10y agoAs we close the barn doors after the horses have left, we are left to ponder these two valuable resources for further edification. [1]https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_... [2]https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet
- quaz3l 10y agoThis is a real cool way to explain XSS in an easy concrete way. Love the thought process and actual code examples.
- emmab 10y agoBetter title would be "Non-persistent XSS on McDonald's website through AngularJS misuse"
- mholt 10y agoI like how the page title changes to "Are you still there?" when you switch to a different tab.
- nrjdhsbsid 10y agoHN next week: "stealing voucher tickets from Chuck E. Cheese" Sweet sweet karma from some low hanging fruit never hurt eh? :)
- icoder 10y agoThe explanation on itself, regardless of 'impact', is already instructive and worth an HN post, in my opinion. The timeline at the bottom was informative as well; it shows that even (or maybe 'especially') for an organisation as big as theirs it is hard to actually get the problem at the right location in the enterprise, and / or respond to it and / or solve it.
- jasonkester 10y agoThis seems to be a common practice, storing UserIDs, Usernames, etc. in cookies rather than a unique SessionID that can be used to look those things up (and will expire). I'm curious as to where people are getting the idea to build things that way. Because it never would have occurred to me to do so. Or rather, had it occurred, it would have immediately begged the question of "what happens when the user monkeys with their cookie". Surely everybody else thinks the same way. If so, how do we end up with this? Are there really "Teach yourself in 21 Days" books that have examples with this pattern that people are following? Or does everybody just assume that they're going to be Facebook with 4000 servers and no way to quickly generate or store or manage or look up those keys for millions of simultaneous users, and that it's worth the tradeoff?
- agmcleod 10y agoIt's something i've steered away from, or I would encrypt the id before saving it in the session. I don't exactly recall where I picked it up, but i know i've seen it in example tutorials in books with Rails apps.
- nateberkopec 10y agoFWIW, all session information (`session[:user_id]`) is stored in an encrypted cookie starting with Rails 4.
- deleted 10y ago[deleted]
- Ensorceled 10y agoIt's literally used on hundreds of websites. I'm sure there is a developer out there right now going "How does McDonald's do this?"
- ecopoesis 10y agoI don't think everyone assumes they're going to be Facebook, but they probably do assume (correctly not my opinion) that scaling session management up is a painful, and are doing their best to avoid it. Consider it a teaching moment and show folks how simple it is to store all your session-like stuff in cookies, along with a timeout and a version hashed with the server's secret.
- three14 10y agoI tried decrypting my password on the search page using a malicious search payload, but it didn't work. Somehow, the cookies contain hidden characters on the search page causing the getCookie method to fail. The getCookie method tries to trim whitespaces from cookie values. In the images below you can see .charAt(0) returns a strange string when executed on the search page. Note that the author doesn't seem to have checked what the sandbox escape itself does: it redefines the charAt function to be Array.join, so of course it produces garbage!
- macygray 10y agoInteresting, how many users with password like '123' or 'monkey' has McDonald's, like 50% ? Because, who will give such a website a normal password?! ;)
- taken_username 10y agoIs it legal to publicly post a website security vulnerability? Or in other words, what is the legal process (let say in US) to notify a website/vendor that their app/website is vulnerable, without being accused of hacking?
- bertil 10y agoThere is not clear legal structure, but two practices are commonly advertised by white-hat professionals: - only test your access on your own (test) accounts; as long as then can’t prove that you accessed someone else’s information, you should be fine; anecdotally, I have worked for Facebook, where you are not supposed to create fake accounts; on the white-hat page, you can ask to have test accounts for that purpose exclusively: those are entirely independent from the rest of the graph and you are joyfully encourage to try to hack yours; - warn the security team ahead of time and tell them without feedback from them, you will publish the information in X weeks. If what you have found is valuable, you should hear back fast; if they do not respond, you can argue that it was their silence who let you know this was not their priority (a legally dubious argument but most of the community will be happy to criticise their silence). You are not bound by their response (some corporations can be very unreasonable) but specifying that you have not hacked any account except a test one should help you if they throw lawyerese at you. One way to avoid being caught off-guard by those is to have a bounty program, but that’s not in security consultants’ hands.
- fractal618 10y agoIs it true that having one set of usernames and passwords makes it easier to crack a set from another website? Does every crack, or leak, of usernames and passwords make it slightly easier to crack all other databases? because some people still use the same password for multiple accounts.
- nommm-nommm 10y agoYes this has been researched and is true. http://www.pcworld.com/article/219303/password_use_very_common_research_shows.amp.html http://www.pcworld.com/article/219303/password_use_very_comm...
- DonHopkins 10y agoMcDonalds should invent some new characters like the Hackburglar and Cap'n Crook to educate the public about computer security.
- RKearney 10y agoThe author of the article removed the disclosure timeline before this was posted to HN. The disclosure timeline was something around 5 business days before the author posted this article. Extremely unprofessional and irresponsible. EDIT: Original timeline can be found at https://web.archive.org/web/20170116061303/https://finnwea.com/blog/stealing-passwords-from-mcdonalds-users https://web.archive.org/web/20170116061303/https://finnwea.c... 24 Dec 2016 17:27:56 GMT Reported the vulnerability to McDonald's via Twitter multiple times (no response). 28 Dec 2016 21:28:39 GMT Reported the vulnerability to McDonald's NL via mcdonalds.nl (they couldn't help). 28 Dec 2016 21:36:12 GMT Requested disclosure assistance on HackerOne (no response). 30 Dec 2016 13:04:32 GMT Reported the vulnerability to McDonald's via phone (they would contact me ASAP). 05 Jan 2017 23:31:42 GMT Public disclosure.
- cocoa19 10y agoWhat are your thoughts on what a professional and responsible disclosure time is?
- btreesOfSpring 10y agoGoogle in their "Disclosure timeline for vulnerabilities under active attack,"[0] states 60 days for disclosure for discovered security vulnerabilities and seven days for critical, currently known in-the-wild security bugs under active exploit. [0] https://security.googleblog.com/2013/05/disclosure-timeline-for-vulnerabilities.html https://security.googleblog.com/2013/05/disclosure-timeline-...
- EdHominem 10y agoYeah, and it's absolutely uncorrelated to what the company feels comfortable with. Maybe 24h? If you can't respond and mitigate within that time frame you aren't operating on internet time. > From policy quote in sibling post: "[...] currently known in-the-wild security bugs under active exploit." Nonsense. Every bug you discover could have been discovered by an attacker, and attackers are constantly scanning. If the bug is in release software you have to assume it's known and being exploited. btw, for the downvoters - I know I speak the truth because I've worked dev in an internet-security company, and in security in a major cloud company. We can turn patches (or mitigations) out in hours and have them canaried and live in 24h. This is absolutely doable and should be expected. This months nonsense is when the company doesn't want to fix the bug. What it takes is the institutional will to disable a feature you bill for until you secure it. When a $millions/day loss is on the table you find that obstacles evaporate. If a company tries to keep their vulnerabilities under wraps there wouldn't be this cost, and thus no will to fix it, in an ever-worsening spiral.
- reiichiroh 10y agoI wonder if this affects MyMcDs.ca in Canada.
- jsunderland 10y agoHow do you know that they're not hashing the passwords server side? They could just be encrypting the password on the client
- DeAndre222 10y agoAs with any hackers site, it’s hard to really find a good hacker you can really trust with your daily task. I am an individual who always need the service of a Hacker. I find him so trustworthy I have no doubt that he will not try to cheat or miss lead me he is very reliable. Don’t say I didn’t warned you. Contact a legit hacker today deepdatashaft@gmail.com