8 ms·

I wrote a program that emails me when one of my friends orders Domino's

84 points by danjoc 10y ago

accountface 10y ago
Probably an extreme case of paranoia on my part, but Domino's should probably close this as a vulnerability, right? If I knew someone's phone number I could potentially use this to impersonate a delivery driver to gain access to someone (at a residential address or business)... I mean sure, I could just knock on a door or walk in impersonating someone else... but expecting a pizza delivery is different than ignoring/alerting someone to an unknown solicitor. OR you could also potentially use it to locate someone based on phone number by following a delivery driver from the local Domino's? You could also just use it to steal pizza. Just find the contact information of a bunch of people in a nearby condo building and wait at the door and say "Oh is that for John Doe? That's me, I'll take it"
- TheSwordsman 10y ago
  Depending on the location, you could just stand outside of the person's house and end up with an almost free pizza. Almost free because you shouldn't forget to tip the driver you're stealing the pizza from!
  - azeirah 10y ago
    Tipping is not customary in many countries outside the US. Here in The Netherlands it would be free :D
  - jabsters 10y ago
    Depends on the payment method. I haven't been able to pay for Domino's online.
- rudolf0 10y ago
  Should be pretty easy to fix. Just HMAC (or just concatenate pepper and hash, honestly) the phone number and use that as the identifier.
- LyndsySimon 10y ago
  ... or, you could pull out a phone directory and get the landline numbers for everyone in a nice wealthy neighborhood. Wait until someone orders a pizza, and when the driver gets there you rob him. No connection to the neighborhood makes it very difficult to track down the perpetrator, and doing it in nice neighborhoods means that the driver is less likely to suspect trouble and more likely to be carrying cash.
nsxwolf 10y ago
Better use a burner phone if you don't want your friends to find out you like terrible pizza.
coldcode 10y ago
What an idiotic url scheme. Learn a few people's phone numbers and steal their pizza orders. I bet you can learn all sorts of things about people from their pizza orders.
kevinschumacher 10y ago
This is hilarious. Apparently Dominos exposes active order tracking information with only a phone number needed. The code in the OP just requests https://order.dominos.com/orderstorage/GetTrackerData?Phone=5555555555 https://order.dominos.com/orderstorage/GetTrackerData?Phone=... for each phone number of input. (Also, this is the original post, may want to edit the link: http://www.technologyversus.com/pizza/ http://www.technologyversus.com/pizza/ )
wimagguc 10y ago
How did you know? I mean, is it a habit of the author to sniff for unprotected/useful APIs, or was the word on the street about Domino's crap privacy?
- djrogers 10y ago
  Probably got an email with a link to his own order status and saw the phone number in the URL...
  - bpicolo 10y ago
    It's somewhat obvious when all you need to do is submit your phone number to track: https://www.dominos.com/en/pages/tracker/#/track/order/ https://www.dominos.com/en/pages/tracker/#/track/order/
anfractuosity 10y ago
That seems a rather big privacy issue on Domino's part. I wonder if it also opens the doors to some kind of social engineering attack, with someone pretending to be Domino's asking for money over the phone. As an aside I thought this is rather cool - Pizza Party a CLI for Domino's https://www.youtube.com/watch?v=J691aLfkWP0 https://www.youtube.com/watch?v=J691aLfkWP0 (One day I'd like to be able to afford to cron job something like that ;)
bnj 10y ago
I've struggled with Domino's design in the past when attempting to order after disabling a VPN connection in the same browser session- last I checked Dominos offered no way to not redirect to the country they detect for the IP address. Incredibly frustrating.
agentgt 10y ago
Funny related story. When I was at GaTech my dorm room (actually a 4 room suite) phone number was 4046. Now GaTechs area code happens to be 404 and there are few biz that share that area code. One notable one was a Papa Johns 404-6xx and some more numbers you can google. The key thing is if you have a dorm phone you have to dial 9 to dial out... you see where I'm going with this... My junior and senior and +.5 super senior year (alas that is another GT thing) I took hundreds of orders with credit card numbers. Now I never did anything bad with those credit cards but there sure were a lot of angry people that didn't get their pizza (some I would call back and tell them but it got pretty annoying so....). The really funny thing was there were even faculty and staff that made this mistake. You could say they got shafted (another GT thing). I strangely miss that Papa Johns. Their garlic sauce was so glorious and yet so disgusting. It was like liquid cocaine transfat.
- logfromblammo 10y ago
  If you were going to take the credit card info, why couldn't you just MitM the whole order and ask the restaurant to spell out "9 to dial out" with some anchovies?
  - agentgt 10y ago
    We did do stuff like that. There was Chinese restaurant that we forwarded an order too but pretended to be the Chinese restaurant. We actually tried to talk them out of the order yet they kept ordering. We said things like "oh that tastes like dog and smells like skunk... you still want?" (apologies if I offend anyone with terrible stereotypes). They preceded to still order though!
kafkaesq 10y ago
Job well done. In the spirit of "Friends don't let friends", I suppose. Seriously, against my better instincts I had more than a few slices of their "product" at a meetup the other night. My innards are still cursing me for it.
danielhunt 10y ago
It looks like HN and Reddit combined just DDOS'd Dominos. Wow.
skissane 10y ago
Dominos Australia uses a UUID instead: https://internetorder.dominos.com.au/eStore/en/Tracker?order=bcceddc4-58a9-4398-8ce2-dc983dfdb678 https://internetorder.dominos.com.au/eStore/en/Tracker?order... (That's a random UUID so it doesn't work. I've got some working UUIDs in my browser history, but not sharing them since they tell you my home address..)
xg15 10y ago
Next step: Make a Telegram bot that you invite in a group and that posts a message whenever a group member ordered something. The magic will be real.
orf 10y ago
Funny this comes up! Dominoes used to use a single integer ID per order, and I wrote a tool to find out how many orders they process each day[1]. After contacting them (and receiving no reply!) they switched to a proper implementation involving GUID's. Good work though, I had no idea the dominoes USA website lets you just enter a phone number to get order details. That's pretty poor 1. http://tomforb.es/counting-pizza-with-python http://tomforb.es/counting-pizza-with-python
- dogma1138 10y ago
  I'm actually surprised that they can fit their daily order number into a standard integer.
  - OJFord 10y ago
    > I'm actually surprised that they can fit their daily order number into a standard integer. What's a 'standard integer'? The ID in the URL is just a string of digits, and you don't have to be that careful (in simple scripts like this at least) for Python not to care how high you go.
    - dogma1138 10y ago
      Commonly 65535 (for uint) :) A string of digits doth not an integer make.
      - OJFord 10y ago
        My point is - where do you think the problem is? > A string of digits doth not an integer make. The URL contains a string of digits as the order ID, if that's not where you think the problem is, where? > Commonly 65535 (for uint) Not in Python, as I said: > ... you don't have to be that careful (in simple scripts like this at least) for Python not to care how high you go.
        dogma1138 10y ago

84 points by danjoc 10y ago

Probably an extreme case of paranoia on my part, but Domino's should probably close this as a vulnerability, right? If I knew someone's phone number I could potentially use this to impersonate a delivery driver to gain access to someone (at a residential address or business)... I mean sure, I could just knock on a door or walk in impersonating someone else... but expecting a pizza delivery is different than ignoring/alerting someone to an unknown solicitor. OR you could also potentially use it to locate someone based on phone number by following a delivery driver from the local Domino's? You could also just use it to steal pizza. Just find the contact information of a bunch of people in a nearby condo building and wait at the door and say "Oh is that for John Doe? That's me, I'll take it"

TheSwordsman 10y ago
Depending on the location, you could just stand outside of the person's house and end up with an almost free pizza. Almost free because you shouldn't forget to tip the driver you're stealing the pizza from!
- azeirah 10y ago
  Tipping is not customary in many countries outside the US. Here in The Netherlands it would be free :D
- jabsters 10y ago
  Depends on the payment method. I haven't been able to pay for Domino's online.
rudolf0 10y ago
Should be pretty easy to fix. Just HMAC (or just concatenate pepper and hash, honestly) the phone number and use that as the identifier.
LyndsySimon 10y ago
... or, you could pull out a phone directory and get the landline numbers for everyone in a nice wealthy neighborhood. Wait until someone orders a pizza, and when the driver gets there you rob him. No connection to the neighborhood makes it very difficult to track down the perpetrator, and doing it in nice neighborhoods means that the driver is less likely to suspect trouble and more likely to be carrying cash.

nsxwolf 10y ago

Better use a burner phone if you don't want your friends to find out you like terrible pizza.

coldcode 10y ago

What an idiotic url scheme. Learn a few people's phone numbers and steal their pizza orders. I bet you can learn all sorts of things about people from their pizza orders.

kevinschumacher 10y ago

This is hilarious. Apparently Dominos exposes active order tracking information with only a phone number needed. The code in the OP just requests https://order.dominos.com/orderstorage/GetTrackerData?Phone=5555555555 https://order.dominos.com/orderstorage/GetTrackerData?Phone=... for each phone number of input. (Also, this is the original post, may want to edit the link: http://www.technologyversus.com/pizza/ http://www.technologyversus.com/pizza/ )

wimagguc 10y ago

How did you know? I mean, is it a habit of the author to sniff for unprotected/useful APIs, or was the word on the street about Domino's crap privacy?

djrogers 10y ago
Probably got an email with a link to his own order status and saw the phone number in the URL...
- bpicolo 10y ago
  It's somewhat obvious when all you need to do is submit your phone number to track: https://www.dominos.com/en/pages/tracker/#/track/order/ https://www.dominos.com/en/pages/tracker/#/track/order/

anfractuosity 10y ago

That seems a rather big privacy issue on Domino's part. I wonder if it also opens the doors to some kind of social engineering attack, with someone pretending to be Domino's asking for money over the phone. As an aside I thought this is rather cool - Pizza Party a CLI for Domino's https://www.youtube.com/watch?v=J691aLfkWP0 https://www.youtube.com/watch?v=J691aLfkWP0 (One day I'd like to be able to afford to cron job something like that ;)

bnj 10y ago

I've struggled with Domino's design in the past when attempting to order after disabling a VPN connection in the same browser session- last I checked Dominos offered no way to not redirect to the country they detect for the IP address. Incredibly frustrating.

agentgt 10y ago

Funny related story. When I was at GaTech my dorm room (actually a 4 room suite) phone number was 4046. Now GaTechs area code happens to be 404 and there are few biz that share that area code. One notable one was a Papa Johns 404-6xx and some more numbers you can google. The key thing is if you have a dorm phone you have to dial 9 to dial out... you see where I'm going with this... My junior and senior and +.5 super senior year (alas that is another GT thing) I took hundreds of orders with credit card numbers. Now I never did anything bad with those credit cards but there sure were a lot of angry people that didn't get their pizza (some I would call back and tell them but it got pretty annoying so....). The really funny thing was there were even faculty and staff that made this mistake. You could say they got shafted (another GT thing). I strangely miss that Papa Johns. Their garlic sauce was so glorious and yet so disgusting. It was like liquid cocaine transfat.

logfromblammo 10y ago
If you were going to take the credit card info, why couldn't you just MitM the whole order and ask the restaurant to spell out "9 to dial out" with some anchovies?
- agentgt 10y ago
  We did do stuff like that. There was Chinese restaurant that we forwarded an order too but pretended to be the Chinese restaurant. We actually tried to talk them out of the order yet they kept ordering. We said things like "oh that tastes like dog and smells like skunk... you still want?" (apologies if I offend anyone with terrible stereotypes). They preceded to still order though!

kafkaesq 10y ago

Job well done. In the spirit of "Friends don't let friends", I suppose. Seriously, against my better instincts I had more than a few slices of their "product" at a meetup the other night. My innards are still cursing me for it.

danielhunt 10y ago

It looks like HN and Reddit combined just DDOS'd Dominos. Wow.

skissane 10y ago

Dominos Australia uses a UUID instead: https://internetorder.dominos.com.au/eStore/en/Tracker?order=bcceddc4-58a9-4398-8ce2-dc983dfdb678 https://internetorder.dominos.com.au/eStore/en/Tracker?order... (That's a random UUID so it doesn't work. I've got some working UUIDs in my browser history, but not sharing them since they tell you my home address..)

xg15 10y ago

Next step: Make a Telegram bot that you invite in a group and that posts a message whenever a group member ordered something. The magic will be real.

orf 10y ago

Funny this comes up! Dominoes used to use a single integer ID per order, and I wrote a tool to find out how many orders they process each day[1]. After contacting them (and receiving no reply!) they switched to a proper implementation involving GUID's. Good work though, I had no idea the dominoes USA website lets you just enter a phone number to get order details. That's pretty poor 1. http://tomforb.es/counting-pizza-with-python http://tomforb.es/counting-pizza-with-python

dogma1138 10y ago
I'm actually surprised that they can fit their daily order number into a standard integer.
- OJFord 10y ago
  > I'm actually surprised that they can fit their daily order number into a standard integer. What's a 'standard integer'? The ID in the URL is just a string of digits, and you don't have to be that careful (in simple scripts like this at least) for Python not to care how high you go.
  - dogma1138 10y ago
    Commonly 65535 (for uint) :) A string of digits doth not an integer make.
    - OJFord 10y ago
      My point is - where do you think the problem is? > A string of digits doth not an integer make. The URL contains a string of digits as the order ID, if that's not where you think the problem is, where? > Commonly 65535 (for uint) Not in Python, as I said: > ... you don't have to be that careful (in simple scripts like this at least) for Python not to care how high you go.
      - dogma1138 10y ago