5 ms·

That disclosure timeline is very aggressive over the holiday period. Did they ever get in touch with you after the 5th?

cyberferret 10y ago
Agreed - the timeline is over the most popular period of the year when most 'back office' people (i.e. IT teams, management, and others not involved in direct customer service) are away. The least the OP could have done is waited until mid-January to release to public to allow them time to get some resources onto the problem IMO.
- ekianjo 10y ago
  Would be surprised if a company like McDonalds had no emergency crisis procedure to handle issues that would damage their reputation anytime, anywhere and recall people even when they are off on holidays. Maybe they thought it was not worth taking it seriously.
  - Nition 10y ago
    Edit: Realised I was being dumb here. I get it now.
    - trelliscoded 10y ago
      If you can sniff other users' cookies, you can get their passwords. Good thing no one reuses passwords across sites!
    - caf 10y ago
      Where the proof-of-concept shows the password in an alert box, a malicious implementation can send it to a remote server. What his proof-of-concept page does, any website can do.
  - cyberferret 10y ago
    I agree, but like someone else pointed out on this thread, this was probably a third party agency who built the site. If they had closed shop for the holidays, and everyone at the agency was overseas visiting family etc., then the response would be difficult. At best, perhaps a programmer could be pulled away from his Christmas pudding to hack a patch remotely on his laptop, or take down the site entirely until they could handle it properly? Just speaking from my own experience here - I run a small web dev agency, and I know that during the Christmas break, we can only offer rudimentary patch up work for our clients, and that is only depending on the internet connection at wherever our team members are.
    - Deestan 10y ago
      Just a reply of "Hi, our IT staff confirms this is a security issue. We intend to fix it as soon as possible. Thank you for your help." doesn't need to wait for the 3rd party agency to come back from holiday.
beedogs 10y ago
No excuse. It's the middle of January now, the holidays are long over, and they're one of the biggest companies on the planet. They had plenty of time to respond.
- largehotcoffee 10y ago
  >Public Disclosure: 05 Jan 2017 23:31:42 GMT Which was roughly 2-3 days after returning from New Year's. Public release was way too early, author should have waited.
- trimbo 10y ago
  > they're one of the biggest companies on the planet Yeah, making hamburgers! Out of 420,000 employees, they have all of 17 IT jobs on their career site. They deserve a break today.
  - deleted 10y ago
    [deleted]
  - sneak 10y ago
    > Yeah, making hamburgers! Out of 420,000 employees, they have all of 17 IT jobs on their career site. How many credit cards get swiped/waved per day at their PoS terminals? If they don't have a 24/7 infosec team they're Doing It Wrong™.
    - MichaelBurge 10y ago
      I'm not sure that agrees with the franchise model. McDonald's corporate owns the real estate, but not most of the businesses. So most of those terminals aren't actually theirs.
      - i336_ 10y ago
        Oh wow. That model is atrocious in terms of providing decent security.
      - 10y ago
kdazzle 10y ago
Yeah, the disclosure comes close to violating their own Responsible Disclosure policy, which is 3 business days. If McDonald's enployees get the holidays off and go back to work on the 3rd, they would have had 2 days to respond. Meaning that if McDonald's disclosed a vulnerabilty to Finnwea.com over the same time period, finnwea.com says they might have sued them. So maybe that guy was a little trigger happy. Great hack, though.
- sneak 10y ago
  Yes, because a company at #109 on the Fortune 500 shouldn't bother spending money on 24/7 infosec. "Responsible disclosure" is simply a meme to reframe "instant full disclosure" as irresponsible, which is dishonest. Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act? Look at this bug, in particular. This is not about this bug; this is about basic negligence. It would have been completely appropriate to blog about this on day zero of discovery. This is not about "time to patch", this is about "time to convince the widest number of people that you should never trust McDonalds with your data".
  - ceejayoz 10y ago
    > Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act? I've worked at a newspaper. Your framing of the question is deliberately silly - they'd sit on it to prevent innocents from being harmed, not to protect the guilty. Once it's fixed (or after a reasonable amount of time not getting fixed), then they happily nail the guilty people to the wall.
- nmstoker 10y ago
  I could be wrong but it sounds like your comment is confused about what a business day is. If a firm decides to let some individuals have the whole time off during the holiday period, that doesn't mean those aren't business days from an external perspective.
flukus 10y ago
This isn't a buffer overrun that's hard to detect though, this seems like something that should have been found using more proactive measures.
mmaunder 10y ago
Agreed. It can take months to connect with some big companies. Reported via Twitter? Come on. Tip: InMail on LinkedIn can be quite effective if you're having trouble. Start at the ceo and work your way down.
- erichurkman 10y ago
  Is your hit rate on LinkedIn for security issues that high? Mine's in the single digits, almost as bad as email. What do you say in your InMail messages that give you a higher response rate? Are you using premium services?
  - mmaunder 10y ago
    Yes you have to pay for InMail. Just be clear and concise. Worked for a Freshdesk vuln we reported. I pinged the ceo.
MertsA 10y ago
That brings up an interesting question though. How long is long enough for disclosure in cases where the company has made it impossible to notify them of a vulnerability? If someone tries 10 different ways to get in touch and makes absolutely no progress it would seem that it would be better to disclose sooner rather than later. Giving companies plenty of time to fix a vulnerability is one thing but if the company isn't even working on the issue because they've isolated all external contact at least if disclosure happens sooner that's less time that an unknown attacker can use that vulnerability without anyone being aware of the issue.

Agreed - the timeline is over the most popular period of the year when most 'back office' people (i.e. IT teams, management, and others not involved in direct customer service) are away. The least the OP could have done is waited until mid-January to release to public to allow them time to get some resources onto the problem IMO.

ekianjo 10y ago
Would be surprised if a company like McDonalds had no emergency crisis procedure to handle issues that would damage their reputation anytime, anywhere and recall people even when they are off on holidays. Maybe they thought it was not worth taking it seriously.
- Nition 10y ago
  Edit: Realised I was being dumb here. I get it now.
  - trelliscoded 10y ago
    If you can sniff other users' cookies, you can get their passwords. Good thing no one reuses passwords across sites!
  - caf 10y ago
    Where the proof-of-concept shows the password in an alert box, a malicious implementation can send it to a remote server. What his proof-of-concept page does, any website can do.
- cyberferret 10y ago
  I agree, but like someone else pointed out on this thread, this was probably a third party agency who built the site. If they had closed shop for the holidays, and everyone at the agency was overseas visiting family etc., then the response would be difficult. At best, perhaps a programmer could be pulled away from his Christmas pudding to hack a patch remotely on his laptop, or take down the site entirely until they could handle it properly? Just speaking from my own experience here - I run a small web dev agency, and I know that during the Christmas break, we can only offer rudimentary patch up work for our clients, and that is only depending on the internet connection at wherever our team members are.
  - Deestan 10y ago
    Just a reply of "Hi, our IT staff confirms this is a security issue. We intend to fix it as soon as possible. Thank you for your help." doesn't need to wait for the 3rd party agency to come back from holiday.

beedogs 10y ago

No excuse. It's the middle of January now, the holidays are long over, and they're one of the biggest companies on the planet. They had plenty of time to respond.

largehotcoffee 10y ago
>Public Disclosure: 05 Jan 2017 23:31:42 GMT Which was roughly 2-3 days after returning from New Year's. Public release was way too early, author should have waited.
trimbo 10y ago
> they're one of the biggest companies on the planet Yeah, making hamburgers! Out of 420,000 employees, they have all of 17 IT jobs on their career site. They deserve a break today.
- deleted 10y ago
  [deleted]
- sneak 10y ago
  > Yeah, making hamburgers! Out of 420,000 employees, they have all of 17 IT jobs on their career site. How many credit cards get swiped/waved per day at their PoS terminals? If they don't have a 24/7 infosec team they're Doing It Wrong™.
  - MichaelBurge 10y ago
    I'm not sure that agrees with the franchise model. McDonald's corporate owns the real estate, but not most of the businesses. So most of those terminals aren't actually theirs.
    - i336_ 10y ago
      Oh wow. That model is atrocious in terms of providing decent security.
    - 10y ago

kdazzle 10y ago

Yeah, the disclosure comes close to violating their own Responsible Disclosure policy, which is 3 business days. If McDonald's enployees get the holidays off and go back to work on the 3rd, they would have had 2 days to respond. Meaning that if McDonald's disclosed a vulnerabilty to Finnwea.com over the same time period, finnwea.com says they might have sued them. So maybe that guy was a little trigger happy. Great hack, though.

sneak 10y ago
Yes, because a company at #109 on the Fortune 500 shouldn't bother spending money on 24/7 infosec. "Responsible disclosure" is simply a meme to reframe "instant full disclosure" as irresponsible, which is dishonest. Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act? Look at this bug, in particular. This is not about this bug; this is about basic negligence. It would have been completely appropriate to blog about this on day zero of discovery. This is not about "time to patch", this is about "time to convince the widest number of people that you should never trust McDonalds with your data".
- ceejayoz 10y ago
  > Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act? I've worked at a newspaper. Your framing of the question is deliberately silly - they'd sit on it to prevent innocents from being harmed, not to protect the guilty. Once it's fixed (or after a reasonable amount of time not getting fixed), then they happily nail the guilty people to the wall.
nmstoker 10y ago
I could be wrong but it sounds like your comment is confused about what a business day is. If a firm decides to let some individuals have the whole time off during the holiday period, that doesn't mean those aren't business days from an external perspective.

flukus 10y ago

This isn't a buffer overrun that's hard to detect though, this seems like something that should have been found using more proactive measures.

mmaunder 10y ago

Agreed. It can take months to connect with some big companies. Reported via Twitter? Come on. Tip: InMail on LinkedIn can be quite effective if you're having trouble. Start at the ceo and work your way down.

erichurkman 10y ago
Is your hit rate on LinkedIn for security issues that high? Mine's in the single digits, almost as bad as email. What do you say in your InMail messages that give you a higher response rate? Are you using premium services?
- mmaunder 10y ago
  Yes you have to pay for InMail. Just be clear and concise. Worked for a Freshdesk vuln we reported. I pinged the ceo.

MertsA 10y ago

That brings up an interesting question though. How long is long enough for disclosure in cases where the company has made it impossible to notify them of a vulnerability? If someone tries 10 different ways to get in touch and makes absolutely no progress it would seem that it would be better to disclose sooner rather than later. Giving companies plenty of time to fix a vulnerability is one thing but if the company isn't even working on the issue because they've isolated all external contact at least if disclosure happens sooner that's less time that an unknown attacker can use that vulnerability without anyone being aware of the issue.