4 ms·

A similar flaw exists in the Denny's Canada app. Reveals usernames, email, full name and phone number. The API is entirely unauthenticated and account hijacking

by deft 9y ago

A similar flaw exists in the Denny's Canada app. Reveals usernames, email, full name and phone number. The API is entirely unauthenticated and account hijacking is very easy. The app is used for reward points that grant you free meals. I tried reaching out to them multiple times and was ignored. I tried contacting the firm that developed the app, and they ignored me. Maybe I should have made a pastebin dump :)

CiPHPerCoder 9y ago
You probably still could, if they ignored you then chances are they never fixed it.
papagg 9y ago
You should post your method. I could scrape it for data if you want
- deft 9y ago
  Would rather not. I've made scripts that take all the data possible, I'll probably post a dump and repro instructions some time later.
  - stevekemp 9y ago
    Might be worth getting in touch with Troy Hunt, over at https://haveibeenpwned.com/ https://haveibeenpwned.com/
dx034 9y ago
You should contact Troy Hunt or Krebs. They can make that public to get companies to actually change it.
SoylentOrange 9y ago
Hey, I work at Symantec Research Labs. If you still have not been able to get this looked at by someone from Denny's, I can probably have the right people take a look. e-mail me at daniel_kats [at] symantec [dot] com EDIT: please do not post your method publicly. That is a bad idea.