8 ms·

Tiffin Tom: Fish, chips and a side of identity theft

196 points by varun_ch 3y ago

srmarm 3y ago
That's shocking and a shame because the platform itself is a good idea and I'd much prefer to order directly from a restaurant than have up to 30% of my order value go to rent seekers like JustEat, Deliveroo or Uber Eats.
- refulgentis 3y ago
  This is an excellent example of why free might ultimately be a bad price point for consumers as well
smelendez 3y ago
I think if I stumbled on this and the vendor was unresponsive I’d notify Stripe ASAP
- mmcclure 3y ago
  I was going to say the same thing. There are some active Stripe folks on here, curious if this post itself will trigger anything internally there.
- gdprrrr 3y ago
  Can you disable an account if you have the secret key?
  - sverhagen 3y ago
    Honest question, is that still within the roam of ethical hacking?
    - connordoner 3y ago
      I’d argue that it’s ethically the right decision — particularly when the SaaS provider seem to be burying their head in the sand. Legally on the other hand?
      - DaiPlusPlus 3y ago
        In Stripe's case, I've been very happy with how responsive their support is (even my Suggestion Box submissions get personal replies) - I'd expect Stripe to suspend that account within a couple of hours, regardless of the time-of-day. But if it was, say, Authorize.net (I can't be the only one?) I'd probably take direct-action (via an anonymous proxy, of course - legacy companies just can't stop themselves shooting the messenger first...) (Disclaimer: I haven't had to deal with Authorize.net since 2016 - can anyone say if things improved since then?)
- fencepost 3y ago
  And Stripe can shut it down then respond with "we can only discuss this with a Director of the company. Let us know when you have one and are legally able to be in business."
shortcake27 3y ago
Tangential, but I wish companies like this didn’t force people to provide so much PII in the first place. In Australia, I’m yet to use a QR menu that doesn’t force me to provide my phone number. Why is my phone number necessary to order a bowl of chips? Ah, I see, Liven needs my phone number so they can sell it, according to their Privacy Policy. Mr Yum apparently doesn’t sell it, but still forces me to provide it anyway.
- Gordonjcp 3y ago
  Maybe so that if you live in a house where the "street address" doesn't actually match the street you're on, because 1950s town planning conflicts with 1590s town planning, the delivery driver can phone you before your "Special Mixed Kebab" - a bulging 16" pizza box full of doner, kofta, shaslik, shawerma, fried chicken, burgers, pakora, four Naan breads and half a litre of hummus, for 25 quid - gets cold?
  - topato 3y ago
    OP is definitely referring to QR codes to view menus INSIDE of the restaurant. Obviously phone numbers for delivery has an actual use.
    - NoZebra120vClip 3y ago
      > Obviously phone numbers for delivery has an actual use. You would think that, wouldn't you? I routinely see my real number printed on store receipts when the store has no reason to have them. GrubHub is supposed to anonymize numbers; the drivers always come through on a particular area code that I can recognize. I've had drivers call me when lost, and it's always lost within my apartment complex (even though I've given really specific notes for every step of the way). I just explain it the same way I did in the notes, but they sometimes have a really poor sense of direction. I've had a couple drivers call me because they refused to leave their car or come to the doorstep to put the food where they're supposed to. In fact, one of them sent me a photo of the Dumpster where I guess he tossed my meal. Also, driver numbers are disclosed to the customer so that we can contact them. Drivers never answer their phones nor reply to texts. Their voice mail box is always full. If your order disappeared then the driver won't be answerable for that.
deleted 3y ago
[deleted]
intrasight 3y ago
Wow, just wow. I can't wonder how common such securing coding slip ups are these days.
- 3-cheese-sundae 3y ago
  This doesn't strike me as a slip-up, it strikes me as complete apathy on behalf of the developer(s).
  - throwaway4233 3y ago
    On inspecting the page where they list restaurants, I can see a several versions of jQuery code like this, for each cuisine. $('#Fish & Chips').on('change', function () { if ($('#Fish & Chips').is(':checked')) { $('.Fish & Chips').css('background-color', '#3a606e;'); $('.Fish & Chips').css('color', '#fff;'); } else { $('.Fish & Chips').css('background-color', '#fff'); $('.Fish & Chips').css('color', '#3a606e;'); } }); I have a good feeling this is more of copy-pasta code from either Copilot or ChatGPT or StackOverflow. That also explains why they handled encryption the way described in the article. Dev: "Hey LLM, how do I pass data around in a secure way ?" Bot: "You can encrypt the data before you send it, so that only users who have the relevant keys can read them" Dev: "Hey LLM, it is not possible to access the data I have encrypted on the frontend" Bot: "Here is the javascript code to decrypt the data you have passed then"
    - lcnPylGDnU4H9OF 3y ago
      "This is what you mean by CSS-in-JS, right?" But seriously, those selectors are making me cringe. Does it even work with the spaces? $('[id="Fish & Chips"]') $('[class="Fish & Chips"]')
      - throwaway4233 3y ago
        with attribute selectors like what you have mentioned it would work. But `$('#Fish & Chips')` most certainly will not, since jQuery would throw a syntax error.
hayd 3y ago
There's a bunch of PII, but another issue is a hacker could: refund every payment, start billing random cards, or move money out of their account (this is probably a little more difficult, but they could certainly pay out to the businesses). Perhaps what they are used more is to start testing cards (we've had this attack happen to our production site on stripe's checkout.js... it'd be much easier if the attackers had our secret key)! Additionally... if their site is this trivially insecure it won't end here.
- fragmede 3y ago
  Possibly. Stripe supports limited scope API keys called "restricted" that aren't allowed to eg refund payments, though they're not the default. I have no idea how many people are actually using them. https://stripe.com/docs/keys https://stripe.com/docs/keys
  - hayd 3y ago
    I didn't know that, thanks, we should probably be using those... Unsurprisingly, this company isn't as (in screenshot) their key starts with sk_live_.
dinom 3y ago
> Ya know the worst part? After explaining all this, my chips were cold. Oh, the humanity. The worst part for me is that the blog reads like a short story instead of a technical analysis. And, given that it's published via ghost.org, makes me think there's just a bunch of scams and meta-scams going on... one layered on top of the other.
- mattl 3y ago
  Why does ghost.org seem like a scam?
  - deleted 3y ago
    [deleted]
  - dinom 3y ago
    Alone it doesn't at all, but when you couple the tagline "Turn your audience into a business" along with the blog's more literary narrative style, the whole piece strikes me as entertainment meant for a particular cohort instead of a rigorous analysis. In addition, the tone of the article seems overly condescending to me. I certainly don't want to minimize accountability and the severity of security holes, but in the real world where startups are trying to hastily bring products to market, they are often understaffed and there is a certain reality that can't be denied. The author may have indeed found flagrant problems but, in even moderately complex systems, there are big struggles with a diffusion of responsibility and a lot that can be lost in translation; for many reasons besides technical ineptitude. Ultimately there was too much punditry and not enough of a clinical postmortem for my taste. Of course I don't seem to hold the popular opinion here given that my comment got down-voted rather severely, which seems unjustified. Oh well.
wyldfire 3y ago
It's not deliberate for them doing this. But the real problem here is that the data they collect isn't seen as a liability. If anything, it's an asset. This externality means that forfeiting people's personal info costs them nothing or nearly nothing.
jszymborski 3y ago
An almost certainly illegal but effective way to stop thus site is to query the API in such a way that the key or account would be suspended. If they change the tokens, rinse and repeat until you can't find them anymore. This is illegal don't do this.
laurieg 3y ago
This reminds me of a contract I did. End users had complained that they were getting more spam after signing up for an account. I thought it must be a coincidence. I jump into the firebase console and look at the security rules. allow read, write: if true; Turns out that the whole customer database was wide open. After fixing it up, I tried to work out how things had ended up like this. The entire system had been written by an intern...
- pixl97 3y ago
  The first rule of programming is make it work. The last rule of programming is make it secure. At least this appears to be the case from observation.
manarth 3y ago
Interesting to see that Companies House struck off the company – just yesterday. https://find-and-update.company-information.service.gov.uk/company/10342031 https://find-and-update.company-information.service.gov.uk/c...
- manarth 3y ago
  Also interesting that there are three directors linked with the associated companies, all named Jamal Ahmed: one born September 1978, another born March 1978, and a third born September 1999. Companies house is a goldmine of information.
  - baz00 3y ago
    I usually check out anyone we hire on Companies House. On numerous occasions we've found people with at least 3 slightly different names or dates of birth that work for the same pile of dissolved companies. Sometimes you can Google the different names or look on LinkedIn and see they are exactly the same person. Instant strike-off.

196 points by varun_ch 3y ago

That's shocking and a shame because the platform itself is a good idea and I'd much prefer to order directly from a restaurant than have up to 30% of my order value go to rent seekers like JustEat, Deliveroo or Uber Eats.

refulgentis 3y ago
This is an excellent example of why free might ultimately be a bad price point for consumers as well

smelendez 3y ago

I think if I stumbled on this and the vendor was unresponsive I’d notify Stripe ASAP

mmcclure 3y ago
I was going to say the same thing. There are some active Stripe folks on here, curious if this post itself will trigger anything internally there.
gdprrrr 3y ago
Can you disable an account if you have the secret key?
- sverhagen 3y ago
  Honest question, is that still within the roam of ethical hacking?
  - connordoner 3y ago
    I’d argue that it’s ethically the right decision — particularly when the SaaS provider seem to be burying their head in the sand. Legally on the other hand?
    - DaiPlusPlus 3y ago
      In Stripe's case, I've been very happy with how responsive their support is (even my Suggestion Box submissions get personal replies) - I'd expect Stripe to suspend that account within a couple of hours, regardless of the time-of-day. But if it was, say, Authorize.net (I can't be the only one?) I'd probably take direct-action (via an anonymous proxy, of course - legacy companies just can't stop themselves shooting the messenger first...) (Disclaimer: I haven't had to deal with Authorize.net since 2016 - can anyone say if things improved since then?)
fencepost 3y ago
And Stripe can shut it down then respond with "we can only discuss this with a Director of the company. Let us know when you have one and are legally able to be in business."

shortcake27 3y ago

Tangential, but I wish companies like this didn’t force people to provide so much PII in the first place. In Australia, I’m yet to use a QR menu that doesn’t force me to provide my phone number. Why is my phone number necessary to order a bowl of chips? Ah, I see, Liven needs my phone number so they can sell it, according to their Privacy Policy. Mr Yum apparently doesn’t sell it, but still forces me to provide it anyway.

Gordonjcp 3y ago
Maybe so that if you live in a house where the "street address" doesn't actually match the street you're on, because 1950s town planning conflicts with 1590s town planning, the delivery driver can phone you before your "Special Mixed Kebab" - a bulging 16" pizza box full of doner, kofta, shaslik, shawerma, fried chicken, burgers, pakora, four Naan breads and half a litre of hummus, for 25 quid - gets cold?
- topato 3y ago
  OP is definitely referring to QR codes to view menus INSIDE of the restaurant. Obviously phone numbers for delivery has an actual use.
  - NoZebra120vClip 3y ago
    > Obviously phone numbers for delivery has an actual use. You would think that, wouldn't you? I routinely see my real number printed on store receipts when the store has no reason to have them. GrubHub is supposed to anonymize numbers; the drivers always come through on a particular area code that I can recognize. I've had drivers call me when lost, and it's always lost within my apartment complex (even though I've given really specific notes for every step of the way). I just explain it the same way I did in the notes, but they sometimes have a really poor sense of direction. I've had a couple drivers call me because they refused to leave their car or come to the doorstep to put the food where they're supposed to. In fact, one of them sent me a photo of the Dumpster where I guess he tossed my meal. Also, driver numbers are disclosed to the customer so that we can contact them. Drivers never answer their phones nor reply to texts. Their voice mail box is always full. If your order disappeared then the driver won't be answerable for that.

deleted 3y ago

[deleted]

intrasight 3y ago

Wow, just wow. I can't wonder how common such securing coding slip ups are these days.

3-cheese-sundae 3y ago
This doesn't strike me as a slip-up, it strikes me as complete apathy on behalf of the developer(s).
- throwaway4233 3y ago
  On inspecting the page where they list restaurants, I can see a several versions of jQuery code like this, for each cuisine. $('#Fish & Chips').on('change', function () { if ($('#Fish & Chips').is(':checked')) { $('.Fish & Chips').css('background-color', '#3a606e;'); $('.Fish & Chips').css('color', '#fff;'); } else { $('.Fish & Chips').css('background-color', '#fff'); $('.Fish & Chips').css('color', '#3a606e;'); } }); I have a good feeling this is more of copy-pasta code from either Copilot or ChatGPT or StackOverflow. That also explains why they handled encryption the way described in the article. Dev: "Hey LLM, how do I pass data around in a secure way ?" Bot: "You can encrypt the data before you send it, so that only users who have the relevant keys can read them" Dev: "Hey LLM, it is not possible to access the data I have encrypted on the frontend" Bot: "Here is the javascript code to decrypt the data you have passed then"
  - lcnPylGDnU4H9OF 3y ago
    "This is what you mean by CSS-in-JS, right?" But seriously, those selectors are making me cringe. Does it even work with the spaces? $('[id="Fish & Chips"]') $('[class="Fish & Chips"]')
    - throwaway4233 3y ago
      with attribute selectors like what you have mentioned it would work. But `$('#Fish & Chips')` most certainly will not, since jQuery would throw a syntax error.

hayd 3y ago

There's a bunch of PII, but another issue is a hacker could: refund every payment, start billing random cards, or move money out of their account (this is probably a little more difficult, but they could certainly pay out to the businesses). Perhaps what they are used more is to start testing cards (we've had this attack happen to our production site on stripe's checkout.js... it'd be much easier if the attackers had our secret key)! Additionally... if their site is this trivially insecure it won't end here.

fragmede 3y ago
Possibly. Stripe supports limited scope API keys called "restricted" that aren't allowed to eg refund payments, though they're not the default. I have no idea how many people are actually using them. https://stripe.com/docs/keys https://stripe.com/docs/keys
- hayd 3y ago
  I didn't know that, thanks, we should probably be using those... Unsurprisingly, this company isn't as (in screenshot) their key starts with sk_live_.

dinom 3y ago

> Ya know the worst part? After explaining all this, my chips were cold. Oh, the humanity. The worst part for me is that the blog reads like a short story instead of a technical analysis. And, given that it's published via ghost.org, makes me think there's just a bunch of scams and meta-scams going on... one layered on top of the other.

mattl 3y ago
Why does ghost.org seem like a scam?
- deleted 3y ago
  [deleted]
- dinom 3y ago
  Alone it doesn't at all, but when you couple the tagline "Turn your audience into a business" along with the blog's more literary narrative style, the whole piece strikes me as entertainment meant for a particular cohort instead of a rigorous analysis. In addition, the tone of the article seems overly condescending to me. I certainly don't want to minimize accountability and the severity of security holes, but in the real world where startups are trying to hastily bring products to market, they are often understaffed and there is a certain reality that can't be denied. The author may have indeed found flagrant problems but, in even moderately complex systems, there are big struggles with a diffusion of responsibility and a lot that can be lost in translation; for many reasons besides technical ineptitude. Ultimately there was too much punditry and not enough of a clinical postmortem for my taste. Of course I don't seem to hold the popular opinion here given that my comment got down-voted rather severely, which seems unjustified. Oh well.

wyldfire 3y ago

It's not deliberate for them doing this. But the real problem here is that the data they collect isn't seen as a liability. If anything, it's an asset. This externality means that forfeiting people's personal info costs them nothing or nearly nothing.

jszymborski 3y ago

An almost certainly illegal but effective way to stop thus site is to query the API in such a way that the key or account would be suspended. If they change the tokens, rinse and repeat until you can't find them anymore. This is illegal don't do this.

laurieg 3y ago

This reminds me of a contract I did. End users had complained that they were getting more spam after signing up for an account. I thought it must be a coincidence. I jump into the firebase console and look at the security rules. allow read, write: if true; Turns out that the whole customer database was wide open. After fixing it up, I tried to work out how things had ended up like this. The entire system had been written by an intern...

pixl97 3y ago
The first rule of programming is make it work. The last rule of programming is make it secure. At least this appears to be the case from observation.

manarth 3y ago

Interesting to see that Companies House struck off the company – just yesterday. https://find-and-update.company-information.service.gov.uk/company/10342031 https://find-and-update.company-information.service.gov.uk/c...

manarth 3y ago
Also interesting that there are three directors linked with the associated companies, all named Jamal Ahmed: one born September 1978, another born March 1978, and a third born September 1999. Companies house is a goldmine of information.
- baz00 3y ago
  I usually check out anyone we hire on Companies House. On numerous occasions we've found people with at least 3 slightly different names or dates of birth that work for the same pile of dissolved companies. Sometimes you can Google the different names or look on LinkedIn and see they are exactly the same person. Instant strike-off.