16 ms·
Discovering a security vulnerability in a major grocery delivery platform
- GrumpyNl 5y agoThe most basic mistakes were made here.
- unquietcode 5y agoIt's honestly quite pathetic, but not at all unexpected these days. I do sometimes wish that when the negligence is so gross (sending API keys in the response of an unsecured request?) that the government would issue a fine. If you don't feel that your developers are security minded, there are many computer security professionals around the globe available to help. Maybe using some of those hundreds of millions of VC dollars for a quick audit would be the norm if there were actual penalties for this kind of reckless behavior.
- patates 5y ago> I do sometimes wish that when the negligence is so gross that the government would issue a fine I also think that there must be a line between getting hacked because some 5th level transitional dependency had a memory overflow bug which made it possible for the attacker to push some sensitive data in the response headers vs "auth? what auth?". Very hard to exactly define it though, where it should lie, other than the extreme examples.
- _justinfunk 5y agoThis is a very good point. It reminds me of when the US FBI was "hacked". Where hacking meant that you could send emails from the client-side. https://www.theverge.com/2021/11/14/22781341/fbi-email-system-hacked-fake-cybersecurity-warnings https://www.theverge.com/2021/11/14/22781341/fbi-email-syste...
- Nextgrid 5y agoThe GDPR should cover this but it has a major enforcement problem.
- ho_schi 5y agoZerforschung is funny, if you want a fun ride read this about "making photobooks out of your personal messages": https://zerforschung.org/posts/zapptales/ https://zerforschung.org/posts/zapptales/ What could go wrong? Everything.
- Semaphor 5y agoFor non-Germans who wonder about the name: It’s a combination of the prefix "zer" [0] "denoting an aspect of dissolvement and asunderness" (similar to English "dis" solve - dissolve) and Forschung (Research). [0]: https://en.wiktionary.org/wiki/zer- https://en.wiktionary.org/wiki/zer-
- zufallsheld 5y agoAFAIK they searched for a German word for reverse engineering and came up with zerforschung.
- Semaphor 5y agoDoesn’t really work, but sounds a lot cooler than Rückwärtsforschung ;)
- LargoLasskhyfv 5y agoOf course it works. Extreme reversing by 'Zerlegung' in all its constituent parts by whichever means (not necessarily 'zerstörungsfrei') for the purpose of 'Forschung'.
- brokenmachine 5y agoIs there an English version? Couldn't find the link.
- baeschtl 5y agoThat article is from October 2021
- duijf 5y agoMore likely May 2021, the date format at the bottom of the post is probably YYYY-MM-DD as common in Germany where the author seems to be located. EDIT: If Germany has the same conventions as The Netherlands, DD-MM-YYYY is probably even more common
- capableweb 5y agoThere is a meta tag in the article source code that removes all ambiguity (since 99% of the time it is specified in ISO 8601): <meta property="article:published_time" content="2021-05-10T22:00:00+02:00">
- Semaphor 5y agoYYYY-MM-DD is the standard in Germany, most people don’t know that and essentially no one (including in official documents) uses it. Never seen it anywhere outside computer nerds who like sortable dates. So yeah, DD-MM-YYYY is the normal way here.
- llampx 5y agoI would add that if DD comes first, the format is usually DD.MM.YYYY. Or DD/MM/YYYY, which is more common in the UK. Rarely have I seen dashes when not following the ISO 8601 YYYY-MM-DD standard.
- arrrg 5y agoI was taught DD.MM.YYYY in school (90s). This is the de-facto standard (short) date format in Germany and by far the most commonly used one. First because it’s consistent with the longer written out date format used in German: „19. Januar 2022“ (19th of January 2022) – note the dot after the 19. Second because it’s also consistent with how it’s spoken. The dot denotes ordinal numbers in German and that’s also how the date is spoken: „Neunzehnter Erster Zweitausend Zweiundzwanzig“ or “nineteenth first two thousand twenty and two”. Dashes and slashes are highly likely to be confusing to people if used in that context, though advisable if you are using any other date format because then at least people will be weirded out and likely pay closer attention if there’s anything going on with that date. It is true that DIN 5008 (which defines rules for word processing and does have some weight in professional circles) recommends YYYY-MM-DD, however this way of writing the date never took hold in Germany (just because it’s part of a norm doesn’t make it commonly used or accepted) and DIN 5008 does actually allow for DD.MM.YYYY.
- deleted 5y ago[deleted]
- float4 5y agoPersonally I don't care about these data breaches anymore. My: - full name, date of birth and email have been leaked by multiple websites; - phone number was leaked by Facebook (added it for 2FA many years ago); - address information can be found in the public database of the Chamber of Commerce. That doesn't make negligence okay, but at least Gorillas and Flink both gave me a €15 discount on my groceries in return.
- MrBuddyCasino 5y agoSame. I have some "core" accounts that I make sure to keep very well protected, like Paypal, Gmail, Amazon etc. But the 2nd tier accounts from hundreds of random shopping websites etc I just don't expect to be kept secret at this point, there are just so many of them, and the data itself isn't particularly juicy.
- baxtr 5y agoI still need to hear a real world case where data breaches are harmful other than annoying spam SMS. EDIT: re the downvotes - I guess it's ok to ask crypto people all the time about real world cases but then not to accept any questions about real world cases elsewhere...
- batch12 5y agoCould you post your full contact details? I am looking for your name, address, date of birth, and phone number. If it isn't too much trouble, please include all email addresses and relevant passwords, your tax ID, mother's maiden name, usual prompts and answers to security questions and your SSN if in the US.
- kreetx 5y agoThe do give some legitimate attack vectors in the article.
- amelius 5y agoIdentity theft ...
- 5y ago
- username_my1 5y ago1M order exposed and 200k customer and workers data exposed just because an AuthKey is allowed to query all customer data instead of user specific data. this means most likely a junior developer built this service, and on top graphQL is used which is built relational first / security is one step away. it sucks that companies grow fast in the tech scene, try to make their wealth using technology without really understanding it.
- amelius 5y agoGrowth hacking 101: ignore security; it's never too late to work on security; the worst that can happen is some wrist slapping; security is a luxury problem.
- username_my1 5y agoI mean with graphQL as I mentioned it feels like you have to bend it that way to load all data without relationships also why on earth do you need to expose your suppliers (sendgrid) api keys to the frontend it's not about ignoring security as if it's extra work, it's about not being qualified enough to do a reasonable job. security is hard, but this is going out of your way to expose your system.
- ratww 5y agoIMO this is a cultural problem. Coupled with a general lack of experience of majority of people working in our industry. People learn how to do certain programming tasks in one way, and instead of trying to fully understand "what" and "why" they're doing it, they just keep doing it. This approach works fine in a computer class, or in internships, but it breaks down when comes to writing secure apps. It is similar with SQL injection: using prepared queries is not really difficult. I'd even claim that it's easier and simpler to write compared to string concatenation. But "knowing" about them takes time, curiosity and preparation. But making queries via string concatenation is how people used to learn. Another thing is over-engineering (the wrong kind): it is more difficult to write tens of classes rather than doing what the task requires, but some people still do it because that's how they learned to program. There are no shortcuts, unfortunately. So far we've solved this partially by using slogans: "Just use BCrypt" was a popular one a few years ago. But honestly I don't think this is enough. We need more mentorship (for the beginners) and more peer reviews (for the experienced).
- k__ 5y agoI worked for a bunch of startups and I'm not surprised by this. Nobody really cares. Security isn't a topic ever. Founders pay you VC money to fly across the country to talk for days about UI wireframes, but nobody ever cares about where or how you store data.
- nikanj 5y ago”In the cloud” for web 2.0, ”On the block chain” for web 3.0
- capableweb 5y agoUnintentionally public data for web 2.0, intentionally public data for web 3.0
- willcipriano 5y agoNon-technicals can bikeshed[0] all day long about UI. "Move that a little to the right, what about cornflower blue?" but have to sit around looking useless when it comes to discuss the engine that will drive that UI. People don't like to feel useless, so they don't talk about the tech. I think this is the reason most software just flat out sucks. It's easy to use if you ignore the part where it doesn't work half the time. [0]https://en.m.wikipedia.org/wiki/Law_of_triviality https://en.m.wikipedia.org/wiki/Law_of_triviality
- estaseuropano 5y agoBut its a solvable problem: oblige all decision takers to get training on the IT side and get all IT staff to get training on how to explain/communicate what they do.
- willcipriano 5y agoGleefully declaring you are non-technical in a tech company is like gleefully declaring you are illiterate in a publishing house. Publishing houses just refuse to hire people who can't read rather than getting the executives hooked on phonics.
- rad_gruchalski 5y ago> The tenantConfig however can be accessed without any restrictions. And the information delivered there is quite interesting: API keys and URLs for various services that are apparently used by the Gorillas/eddress infrastructure. Among them we found API keys for Sendgrid and Slack webhook URLs. Unreal.
- Nextgrid 5y agoI can't think of any legitimate purpose for an endpoint to expose its secrets, even if behind authentication.
- edoceo 5y agoDebugging? Like when you litter your code with printf (or console.log or whatever is cool today). Move fast, break things, ignore gdb
- gtf21 5y agoI suspect that they thought this was a clever way of allowing tenant applications to host their own configuration somewhere which the application would fetch and use. It's a whitelabelled application by the sounds of it. Pretty shocking but I can't think of any other line of reasoning.
- sabertoothed 5y agozerforschung.org does an amazing job! They have also recently analyzed Djokovic's test certificate: https://zerforschung.org/posts/djokovic-pcr-test-en/ https://zerforschung.org/posts/djokovic-pcr-test-en/ Stuff like that is super interesting. I love this investigative journalism. Another one I find captivating is: https://www.bellingcat.com/ https://www.bellingcat.com/
- amoshi 5y agoI would not trust bellingcat, as per the article below they are very shady. https://declassifieduk.org/cia-sidekick-gives-2-6m-to-uk-media-groups/ https://declassifieduk.org/cia-sidekick-gives-2-6m-to-uk-med...
- sabertoothed 5y agoI could not derive from the article that they are shady. All it said is that they receive money from National Endowment for Democracy, just as Thomson Reuters Foundation. I am not sure why this is shady per se. Maybe you can explain? Bellingcat was crucial in identifying the Tiergarten killer and the corresponding researcher was invited to court as a witness[1]. [1] https://www.theguardian.com/world/2021/dec/15/germany-convicts-russian-man-of-of-chechen-separatist https://www.theguardian.com/world/2021/dec/15/germany-convic...
- ARandomerDude 5y ago> When will the industry finally learn?! Never. There are too many people using too many technologies with too many deadlines and constant turnover. It will always be possible to find a service with simple vulnerabilities.
- raverbashing 5y agoI'm not so pessimistic, but yes, the situation is not encouraging. Security assessment should have been part of due diligence. Now I know investors don't care much about this, but they should, lest they want to see their investments on the news in not so flattering colors.
- joshspankit 5y agoThis. It’s not an industry thing, it’s a “bottom line” thing. The ROI on just jamming the gas pedal actually means that “horrific accidents” don’t affect profit all that much.
- victor106 5y agoDifferent topic > Gorillas has experienced extreme growth in recent weeks and also raised another absurd 290 million US dollars in venture capital it does not seem absurd considering the current market valuations of online retailers.
- dr_faustus 5y agoI also find it just fascinating, that anyone would pump hundreds of millions in a service which is a copycat anyhow and doesn't even own the IP on the only thing that could potentially differentiate them from their competitors. I mean, hiring desperate people and students to make deliveries in a couple if cities at a loss seems not to be the greatest feat. Services like Uber at least have some tech in-house which is mildly innovative. But this is just pathetic.
- joshspankit 5y agoIt’s like Kevin Smith says in one of his “evening with” DVDs: We think that only the best of us are making money but If you can consistently make even a small return on the investment money, you basically have a job as long as you want it. They don’t care if it’s crap, they just care if you give them more money than they started with.
- thih9 5y ago> The API key of Gorillas for 100 of these so-called “scopes”, the one of Liban Post for more than 200 How did they check the scopes? Did they use these API keys to make requests? Would that be legal?
- _wldu 5y agoBuilding applications is a complex problem. If you want a secure system, then security details have to be carefully considered at every layer (DB, API, front-end). Doing that requires expert security employees/consultants, time and money. On the other hand, profits are driven by new features, first to market and sales. Companies can build insecure systems (that are profitable) much faster and much cheaper than they can build systems that are profitable and secure. It has been my experience that security is seen as a necessary evil. It's not seen as a benefit or feature that customers want. Security employees/consultants are often seen as road-blocks or obstructionists. I think this is largely why technical security has been replaced by compliance. Just check the box mentality. When they get hacked they can say, "but we were compliant and we'll do better next time". IMPO, that basic conflict explains why systems are repeatedly compromised and why companies nor customers really care about good technical security.
- jrumbut 5y agoThis is what I think when I hear about a company being attacked by someone inside their development/ops team or the latest 0day. Ideally there should be measures in place to mitigate these worst case scenarios but those are legitimately hard, expensive, and require commitment at all levels of the company. This wasn't that. The worst vulnerability was caused by a very basic mistake that was more at the level of fundamental competence than security expertise. If you're going to use GraphQL you need someone who knows about GraphQL. It's been out a while now, they aren't that hard to find.
- brazzy 5y agoUgh. This inspired me to check the B2B application I'm responsible for as a manager. Guess what I found: <input type="hidden" name="userId" value ="{{session.userId}}"> I'm sure you can guess what it's used for and what it's not compared against.