6 ms·

Good read outlining the timeline of events from the person who originally reported the leak: https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-security

Good read outlining the timeline of events from the person who originally reported the leak: https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-security-seriously-bf078027f815 https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-s... I found his initial interaction with their head of IT Security (very first initial response) laughably appalling: Dylan Houlihan <dylan@breakingbits.com> to Mike, Geri Haight - Hello Mike et al, Thank you for making yourselves available. There is a security vulnerability on the delivery.panerabread.com website that exposes sensitive information belonging to every customer who has signed up for an account to order Panera Bread online. This shows the customer's full name, email address, phone number and the last four digits of their saved credit card number. Moreover, the customers are easily enumerable which means an attacker could crawl through all the records. I can provide the specific details of the vulnerability over email once you respond, but if you prefer (for more security), I can also encrypt the information with a PGP key you provide me. Alternatively we can hop on a phone call. Best regards, Dylan Houlihan And their response: Mike Gustavison <Mike.Gustavison@panerabread.com> to dylan Dylan, My team received your emails however it was very suspicious and appeared scam in nature therefore was ignored. If this is a sales tactic I would highly recommend a better approach as demanding a PGP key would not be a good way to start off. As a security professional you should be aware that any organization that has a security practice would never respond to a request like the one you sent. I am willing to discuss whatever vulnerabilities you believe you have found but I will not be duped, demanded for restitution/bounty or listen to a sales pitch. Regards, Mike

mr_overalls 9y ago
"...demanding a PGP key" This kind of incompetence directly endangers the privacy and security of anyone who does business with Panera. And it's reminiscent of the kind of incompetence that characterized the Equifax breach and other recent high-profile hacks. Maybe it's time that a subset of IT workers become professionally licensed and liable, like engineers.
- crescentfresh 9y ago
  > IT workers become professionally licensed and liable, like engineers Except for software engineers, ironically.
  - mr_overalls 9y ago
    I suppose there are many ways to choose the subset. Maybe software engineers in specific verticals: medical technology, avionics, etc.? Given the number of security breaches lately, CSO seems like a no-brainer, too.
    - Spooky23 9y ago
      Solution Architecture is where I would go if I wanted to credential IT folks like engineers or CPAs. Require the license if you are accountable for implementing a solution that hits various thresholds. Infosec is an area where there is already a problem with credential collectors, and in many places it is just a dressed up audit/compliance function. It’s not a standalone vertical imo.
- vkjv 9y ago
  Ideally you wouldn't even need to ask for it. https://securitytxt.org https://securitytxt.org
- UberBoll 9y ago
  >it's reminiscent of the kind of incompetence that characterized the Equifax breach Go to Mike's LinkedIn and he is the former "ISO - Sr. Director of Security Operations" for Equifax.
  - sli 9y ago
    I tell you, if I was this incompetent, I'd be homeless. Not in a cushy, high paying corporate job.
    - praneshp 9y ago
gargravarr 9y ago
>Head of IT Security >'demanding a PGP key would not be a good way to start off'. Please tell me this man will be fired.
- deleted 9y ago
  [deleted]
FRex 9y ago
I've developed a joke law that says that the amount of genuine information in a statement is inversely proportional to how polite and wordy it is. I.e. the "we take security seriously" PR fluffs. Perhaps Mike knew that law and that's why he took Dylan's email as not genuine. Perhaps "yo fucka, I pwn'd your shit, tomorrow it's on the dark web if u no patch this link" would be the proper way to inform them of a leak. Then again some people say it's good they didn't try to get Dylan arrested for "hacking".

mr_overalls 9y ago

"...demanding a PGP key" This kind of incompetence directly endangers the privacy and security of anyone who does business with Panera. And it's reminiscent of the kind of incompetence that characterized the Equifax breach and other recent high-profile hacks. Maybe it's time that a subset of IT workers become professionally licensed and liable, like engineers.

crescentfresh 9y ago
> IT workers become professionally licensed and liable, like engineers Except for software engineers, ironically.
- mr_overalls 9y ago
  I suppose there are many ways to choose the subset. Maybe software engineers in specific verticals: medical technology, avionics, etc.? Given the number of security breaches lately, CSO seems like a no-brainer, too.
  - Spooky23 9y ago
    Solution Architecture is where I would go if I wanted to credential IT folks like engineers or CPAs. Require the license if you are accountable for implementing a solution that hits various thresholds. Infosec is an area where there is already a problem with credential collectors, and in many places it is just a dressed up audit/compliance function. It’s not a standalone vertical imo.
vkjv 9y ago
Ideally you wouldn't even need to ask for it. https://securitytxt.org https://securitytxt.org
UberBoll 9y ago
>it's reminiscent of the kind of incompetence that characterized the Equifax breach Go to Mike's LinkedIn and he is the former "ISO - Sr. Director of Security Operations" for Equifax.
- sli 9y ago
  I tell you, if I was this incompetent, I'd be homeless. Not in a cushy, high paying corporate job.
  - praneshp 9y ago

gargravarr 9y ago

>Head of IT Security >'demanding a PGP key would not be a good way to start off'. Please tell me this man will be fired.

deleted 9y ago
[deleted]

FRex 9y ago

I've developed a joke law that says that the amount of genuine information in a statement is inversely proportional to how polite and wordy it is. I.e. the "we take security seriously" PR fluffs. Perhaps Mike knew that law and that's why he took Dylan's email as not genuine. Perhaps "yo fucka, I pwn'd your shit, tomorrow it's on the dark web if u no patch this link" would be the proper way to inform them of a leak. Then again some people say it's good they didn't try to get Dylan arrested for "hacking".