5 ms·

McDonalds India is leaking 2.2M users data

59 points by madmax108 10y ago

r_singh 10y ago
Three years ago when I was learning web development, I noticed McDelivery in India stores the plaintext password for each user — and it's still the same . I know this because you can recover your password from them in plaintext. I find it hard to believe.
- r_singh 10y ago
  Does anyone know about more apis in India that are so porous?
  - anilgulecha 10y ago
    Yes, Axis Bank's MF. I made a full-disclosure here (plaintext passwords). https://medium.com/@anilgulecha/axismf-coms-bad-security-practice-c9a1cb60110 https://medium.com/@anilgulecha/axismf-coms-bad-security-pra...
bluedino 10y ago
Who developed this thing? Who approved it at McDonalds corporate?
- tyingq 10y ago
  Typical in a Fortune 500 company it would be the marketing department, since it's their money that pays. Company culture, though, varies, on how much involvement would come from a privacy or IT security area of the company. In my experience, very few companies would have an a privacy or IT security department that had something like veto power. They typically only have a limited influence, like being able to add some terms to a contract before it's signed.
brianbreslin 10y ago
My GF works at burger king corporate with their digital team, and this is one of their biggest nightmares. Most of these firms use a company called Tillster[1] who has the most market share in apps for QSR industry. 1.http://www.tillster.com/ http://www.tillster.com/
koolba 10y ago
> The McDonald’s India app, McDelivery is leaking personal data for more than 2.2 million of its users which includes name, email address, phone number, home address, accurate home co-ordinates and social profile links. I'm sure I'm not the only one wondering where this app was developed... Marginally on topic, if they do any encryption within the app I wonder if they name the variable to store the authentication code a "bigMac".
driverdan 10y ago
Just a warning, gathering user data from an API endpoint like this is illegal in the US, even if it doesn't require auth. Be safe!
- manquer 10y ago
  Any citation ? My understanding was that under CFAA unless you are explicitly circumventing security provisions it not illegal ?
  - rohan404 10y ago
    I suppose that whole incident with Weev and AT&T would serve as legal precedent.
nojvek 10y ago
Security is expensive, why pay all that money when you're unlikely to get sued because you're too big to be sued with your army of lawyers. We need more of the class action lawsuits like WeVibe. But even as a user who got affected, I am unlikely to get compensated. There needs to be a startup for filing class action suits against companies abusing privacy and security, and ensuring the average Joe can go against a fat Corp.
dahart 10y ago
> This is published under our responsible disclosure policy Honest question because I don't know what responsible disclosure protocols are -- is it considered responsible to report large vulnerabilities directly to the public when the company is too slow? Are there no intermediates? No security organizations or advocates, or even businesses in the vulnerability market, who can help to escalate an important issue without potentially making the situation worse temporarily? I realize this might be a stupid question, and that I need to assume hackers are already ahead of the public, but my armchair security instincts are that real true harm could come from announcing unpatched vulnerabilities to the public, inviting otherwise lazy or opportunist hackers to jump in. Only based on what I can see here, the timeline in the article is 6 weeks since discovery, and it went from reporting directly to the app maker, who did respond once, then straight to the public. It just seems like there are a metric ton of intermediate steps one could take before announcing publicly.
- anilgulecha 10y ago
  This is the standard.. from 30-90 days of initial report to no intent/comment on fixing. If they did show intent of fixing the issue (by responding to his last 2 requests), then most researchers hold off on full-disclosure for some more time (depends usually on if they think the issue is being exploited in the wild or not). In this particular case, given the sequence of events, the disclosure would be considered responsible by the security industry.
  - dahart 10y ago
    Thank you. I can accept full public disclosure is currently considered responsible, and is standard practice. My question might be too presumptuous, and I didn't mean to suggest hackernoon did anything wrong here. What I'm really wondering is why there aren't intermediate third party steps between direct contact and public disclosure? Are there no agencies, public or private, that can help escalate the response times? Are there reasons that the security community has come to believe that third parties don't help, or reasons that public disclosure is seen as the safest alternative?
jbuzbee 10y ago
McDelivery is leaking personal data for more than 2.2 million of its users which includes name, email address, phone number, home address, accurate home co-ordinates and social profile links. I know the world has changed, but many of us remember being given a list of everyone in our city's name, home address, and phone number. The Phone Book. And I recall it was unusual not be be listed in the phone book. My father was prominent in our community, and we were always in it. We'd occasionally get calls from a someone angry at my father, but it wasn't a problem. Different times...
- killerpopiller 10y ago
  that was before ones personal contacts (and every personal information one can think of ) could get into silos of spammers, fraudulent marketers, annoying cold-callers, malware-distributer, who don't have to pay to contact and do so with click - not with a letter nor a dial phone. May I again mention Cambridge Analytics manipulating voters by making use of such silos automated?
jessaustin 10y ago
We need to get a bit smarter as consumers. Who really thinks it's a good idea to give McDonald's all her/his PII?
- bluesign 10y ago
  People who orders from mcdonalds? I guess they have delivery in India
  - jessaustin 10y ago
    As I recall from my travels there, in India it would be very cheap to simply hire a guy on the street to run down to McDonald's for you. There are always people hanging around looking for odd jobs. In general I'm more and more hesitant to assume that since I'm paying someone, they should know enough about me to be able to take out loans in my name. I'm resigned to the fact that e.g. Amazon and PayPal know that much about me, but at this point I would rather not give complete or true details to a restaurant, hotel, or grocery store.

59 points by madmax108 10y ago

Three years ago when I was learning web development, I noticed McDelivery in India stores the plaintext password for each user — and it's still the same . I know this because you can recover your password from them in plaintext. I find it hard to believe.

r_singh 10y ago
Does anyone know about more apis in India that are so porous?
- anilgulecha 10y ago
  Yes, Axis Bank's MF. I made a full-disclosure here (plaintext passwords). https://medium.com/@anilgulecha/axismf-coms-bad-security-practice-c9a1cb60110 https://medium.com/@anilgulecha/axismf-coms-bad-security-pra...

bluedino 10y ago

Who developed this thing? Who approved it at McDonalds corporate?

tyingq 10y ago
Typical in a Fortune 500 company it would be the marketing department, since it's their money that pays. Company culture, though, varies, on how much involvement would come from a privacy or IT security area of the company. In my experience, very few companies would have an a privacy or IT security department that had something like veto power. They typically only have a limited influence, like being able to add some terms to a contract before it's signed.

brianbreslin 10y ago

My GF works at burger king corporate with their digital team, and this is one of their biggest nightmares. Most of these firms use a company called Tillster[1] who has the most market share in apps for QSR industry. 1.http://www.tillster.com/ http://www.tillster.com/

koolba 10y ago

> The McDonald’s India app, McDelivery is leaking personal data for more than 2.2 million of its users which includes name, email address, phone number, home address, accurate home co-ordinates and social profile links. I'm sure I'm not the only one wondering where this app was developed... Marginally on topic, if they do any encryption within the app I wonder if they name the variable to store the authentication code a "bigMac".

driverdan 10y ago

Just a warning, gathering user data from an API endpoint like this is illegal in the US, even if it doesn't require auth. Be safe!

manquer 10y ago
Any citation ? My understanding was that under CFAA unless you are explicitly circumventing security provisions it not illegal ?
- rohan404 10y ago
  I suppose that whole incident with Weev and AT&T would serve as legal precedent.

nojvek 10y ago

Security is expensive, why pay all that money when you're unlikely to get sued because you're too big to be sued with your army of lawyers. We need more of the class action lawsuits like WeVibe. But even as a user who got affected, I am unlikely to get compensated. There needs to be a startup for filing class action suits against companies abusing privacy and security, and ensuring the average Joe can go against a fat Corp.

dahart 10y ago

> This is published under our responsible disclosure policy Honest question because I don't know what responsible disclosure protocols are -- is it considered responsible to report large vulnerabilities directly to the public when the company is too slow? Are there no intermediates? No security organizations or advocates, or even businesses in the vulnerability market, who can help to escalate an important issue without potentially making the situation worse temporarily? I realize this might be a stupid question, and that I need to assume hackers are already ahead of the public, but my armchair security instincts are that real true harm could come from announcing unpatched vulnerabilities to the public, inviting otherwise lazy or opportunist hackers to jump in. Only based on what I can see here, the timeline in the article is 6 weeks since discovery, and it went from reporting directly to the app maker, who did respond once, then straight to the public. It just seems like there are a metric ton of intermediate steps one could take before announcing publicly.

anilgulecha 10y ago
This is the standard.. from 30-90 days of initial report to no intent/comment on fixing. If they did show intent of fixing the issue (by responding to his last 2 requests), then most researchers hold off on full-disclosure for some more time (depends usually on if they think the issue is being exploited in the wild or not). In this particular case, given the sequence of events, the disclosure would be considered responsible by the security industry.
- dahart 10y ago
  Thank you. I can accept full public disclosure is currently considered responsible, and is standard practice. My question might be too presumptuous, and I didn't mean to suggest hackernoon did anything wrong here. What I'm really wondering is why there aren't intermediate third party steps between direct contact and public disclosure? Are there no agencies, public or private, that can help escalate the response times? Are there reasons that the security community has come to believe that third parties don't help, or reasons that public disclosure is seen as the safest alternative?

jbuzbee 10y ago

McDelivery is leaking personal data for more than 2.2 million of its users which includes name, email address, phone number, home address, accurate home co-ordinates and social profile links. I know the world has changed, but many of us remember being given a list of everyone in our city's name, home address, and phone number. The Phone Book. And I recall it was unusual not be be listed in the phone book. My father was prominent in our community, and we were always in it. We'd occasionally get calls from a someone angry at my father, but it wasn't a problem. Different times...

killerpopiller 10y ago
that was before ones personal contacts (and every personal information one can think of ) could get into silos of spammers, fraudulent marketers, annoying cold-callers, malware-distributer, who don't have to pay to contact and do so with click - not with a letter nor a dial phone. May I again mention Cambridge Analytics manipulating voters by making use of such silos automated?

jessaustin 10y ago

We need to get a bit smarter as consumers. Who really thinks it's a good idea to give McDonald's all her/his PII?

bluesign 10y ago
People who orders from mcdonalds? I guess they have delivery in India
- jessaustin 10y ago
  As I recall from my travels there, in India it would be very cheap to simply hire a guy on the street to run down to McDonald's for you. There are always people hanging around looking for odd jobs. In general I'm more and more hesitant to assume that since I'm paying someone, they should know enough about me to be able to take out loans in my name. I'm resigned to the fact that e.g. Amazon and PayPal know that much about me, but at this point I would rather not give complete or true details to a restaurant, hotel, or grocery store.