23 ms·

I pwned half of America's fast food chains simultaneously

1081 points by MrBruh 3y ago

mihaaly 3y ago
"move fast and break things" - Mark Elliot Zuckerberg
bomewish 3y ago
They need to pay this guy 100k. And fire someone.
- mapster 3y ago
  They can’t because most of the people firing will also be held accountable and fired
- deleted 3y ago
  [deleted]
Erratic6576 3y ago
So the hacker worked for free?
- iinnPP 3y ago
  Yes, the way the incentives are aligned ensures nobody ever goes to jail and the little guy pays all the bills.
1-6 3y ago
We need Whitehat awards and give this person that.
tech_ken 3y ago
Lol. Lmao even. Great writeup
unoti 3y ago
I worked with Firebase for a while, lured in because of how easy it was to do certain things. It makes certain kinds of operations essentially zero effort, such as getting realtime updates on the frontend when something changes. But it also creates a huge amount of effort that is trivial with other frameworks, such as creating a huge effort for security. I found that what I gained in convenience, I lost by needing to do so much work continuously battling with security rules. I left it behind and never looked back, and it made me much more cheerful about the work that I needed to do to establish and maintain more conventional backend data systems.
- robertlagrant 3y ago
  I made an app in Firebase once and did it so that people could collaborate but they used per-session IDs that were linked to their real IDs behind the scenes, so people couldn't spot trends of activity over time. I found it a little tricky to start with while getting familiar with the rules, but it worked really well after I got the hang of it.
digitcatphd 3y ago
This is extremely annoying. Instead of fucking with other people’s companies why not build your own? You pwned them? What are you twelve? All you did was commit a felony and post it online.
- deleted 3y ago
  [deleted]
- kipukun 3y ago
  I'll bite -- he discovered a vulnerability in a large company and responsibly disclosed it to them. How is that a felony? Why would you post a felony online?
- Kuraj 3y ago
  If I understand correctly, the article was published only after the vulnerability was patched. That sounds OK to me.
- monsieurgaufre 3y ago
  Pretty sure that poking around for holes/exploits is part of the definition of what is a hacker. They notified the relevant organization as well. Not sure why you take that stance.
  - digitcatphd 3y ago
    And then posted it online? If his intentions were good he wouldn’t post their name.
    - KomoD 3y ago
      > If his intentions were good he wouldn’t post their name. Why? They shouldn't be allowed to sweep it under the rug
    - monsieurgaufre 3y ago
      After the fix as been deployed, i don't see why it should not be. It might be useful to someone else. If security is mostly an afterthought, maybe naming and shaming might help them take it seriously. I do not understand your stance at all. Why are you defending corps that were negligent?
946789987649 3y ago
If they're already using firebase, can anyone think why they are storing passwords? Firebase Authentication is incredibly easy and quick to setup and use (less than a day for someone new to it), which means you have no need to worry about passwords.
- jzig 3y ago
  offshore workers
  - diogomqbm 3y ago
    this is racist
- godelski 3y ago
  Not a direct answer, but I can tell you I see crazily idiotic mistakes in apps all the time. I think people are hiring the lowest of the low. FWIW, I don't think AI will replace coders anytime soon, but I think it'll replace these coders. For example, my school's laundry app. Takes 8s to load because it continually refreshes the screen while it is trying to make a connection to their portal. Even now I just checked, it logged me out, took 5 seconds to let me touch the login, I placed in my email, grabbed my password form my password manager, it clearerd my email, retyped, and now the login is grayed out. Looks like I'm currently locked out. Looking at the laundry rooms, it takes 45s to load (literally, I timed it), and then the rooms aren't in order. It'll be like A4, A6, A7, A3, A11, A9, and so on. I'm not sure it's even manually filled in because they seem to change. Plus I have to unplug and replugin the machines constantly because they disconnect from the server. The dryer is a pain. This happens enough that the cords are worn down and it is a fire issue. Yesterday I ordered from Jersey Mikes. They have a field where you can specify instructions. They do keyword filtering so you can't place a word like "cheese" in it, because they want you to click the box, but the box doesn't let you specify what kind of cheese. You also can't use words like "extra." Employees have always understood my shorthand or leet speak. My housing processes applications via LIFO instead of FIFO. So all the students who renew their applications a month after the deadline get approved for their housing before anyone who does it within a reasonable time. Electric bikes are known to light on fire when charging them. Teslas doesn't cover warranty for water damage. Google Maps routinely tells me to be in the wrong lane or miscalculates the number of lanes that exist. Google drive's solution to scrolling through music too fast is to lock you out, which just results in the user picking up the phone. Mine also likes to frequently disconnect itself and there's no low data mode so sometimes it just overloads my car's infotainment computer. Classic halt and catch fire situation. I can go on about this stuff and it astounds me. Something is fundamentally broken when we can have computers that can talk to us in natural language but we are unable to design a system where employees understand the concept of a sorted list. Not to mention that I won't be surprised when that building catches fire. Edit: I got logged in. My username was pasting into my password because their password field is labeled as a username field... but it is also hidden... They also double charged me in the past, said they didn't, and their solution was for me to issue a clawback with my bank. These people just don't care. I really believe a lot of people are building things that they never test and never use. Even at big companies.
lxe 3y ago
This is my problem with the whole architecture of FE -> DB. Without a middle server layer, things like token storage, authentication, and other things become really easy to screw up.
- Kamshak 3y ago
  Firebase has an auth API that is free built in, it's weird that they didn't just use it. Idk if whoever built this would have built a more secure solution with a server layer or just have a public mongo instance instead
- tetha 3y ago
  Mhhm. It's also a reason why we're making sure our developers have an easy time integrating into the platforms authn and authz systems. For example, if you need an admin interface, it should be just a library include and some bespoke framework configs to be integrated with the central authz framework over trying to think of something on their own. It's... way too successful internally, lol, because we have a lot of permissions and privileges to manage now. And now we have to figure out good ways to assign these permissions to people more efficiently. But that's a better problem than a GDPR relevant data breach, to be honest.
deleted 3y ago
[deleted]
tmaly 3y ago
Dude should have gotten some free chicken for his efforts.
mellosouls 3y ago
No contact or thanks has been received back so far :)
- MrBruh 3y ago
  I wasn't expecting a bug bounty, but not even a 'thank you' does hurt my soul :(
  - wt__ 3y ago
    If it's any consolation, people these days frequently ignore (or read but don't bother acknowledging) pretty much any email that was intended to be helpful, not just security disclosures.
  - PopePompus 3y ago
    Well, they're incompetent - is it a big surprise that they have poor manners too?
    - ryandrake 3y ago
      Yea, and if they were actually breached and there were victims, the first thing they would do is issue a press release telling the world "We Take Security Very Seriously."
      - ethbr1 3y ago
        Is it legally differentiated if they respond to the reporter? Or is there some weird loophole of "We didn't take action because of your message. We just happened to patch the same vulnerability after you mentioned it. We are not aware of any penetrations, because we didn't notice your message"?
        hnfong 3y ago
        > Is it legally differentiated if they respond to the reporter? Nobody knows. But between taking an unknown legal risk, vs being seen as ungrateful, the choice for legal is quite clear.
intern4tional 3y ago
This isn’t owning fast food chains; rather compromising some AI startup that has some of them as a customer. Title is misleading.
- mellosouls 3y ago
  TBF your proposed title is less snappy.
  - intern4tional 3y ago
    Of course, but it that’s good in most cases as then you don’t get an overreaction. The right people will read it (Chattr.ai’s customers) and respond . Right now everyone looks at it and some CISO will overreact and make everyone go check their Firebase configurations which may likely be a non-value add.
- MrBruh 3y ago
  It exposed PII of the managers & employees of ~half of the most popular fast food companies. Personally I feel the title is justified but I understand and respect your viewpoint. Also keep in mind that trying to clarify the such would also make the title much longer than I desired.
  - refulgentis 3y ago
    [flagged]
  - borissk 3y ago
    Aren't you afraid one of the companies involved may file a complain with FBI or police and get you arrested?
    - buffington 3y ago
      Arrested for what? The system gave them permissions, they didn't exfil data, and they disclosed it to the company. He did those companies a favor by showing them how vulnerable they are by outsourcing every operation and process in pursuit of profits.
erikerikson 3y ago
[flagged]
- deleted 3y ago
  [deleted]
KTibow 3y ago
The timeline omits when the article was put online
- not2b 3y ago
  That can be easily deduced.
- boomboomsubban 3y ago
  According to the Wayback Machine, it first appeared January 10 2024. http://web.archive.org/web/20240000000000*/https://mrbruh.com/chattr/ http://web.archive.org/web/20240000000000*/https://mrbruh.co...
- MrBruh 3y ago
  It was posted earlier today (NZ Time). If they do end up reaching out though, I will amend that part with a revised statement :)
  - samstave 3y ago
    You could ostensibly make a great tool from this data for those seeking employment.... Make a tool which will look at the list of all the franchises within radius of person, and have it auto submit applications to all of them simultaneously...
j-bos 3y ago
If this had been exploited and the job applicants to Target, Subway, Dunkin et al, had bank/credit fraud committed in their name's, would the big companies be liable for not performing due dilligence on chatter.ai? To be clear, I'm asking from a legal standpoint not a practical one.
- mihaaly 3y ago
  I assume it is more like the chattr.ai where the responsibility falls, except if the companies were using it as a tool and configuring the services falls with them. Down to the contractual circumstances. 'Tool provided works well' vs. 'using the provided tool well' kind of thing I guess.
- qznc 3y ago
  There is probably at least one European citizen in there, so GDPR applies.
- MrBruh 3y ago
  Probably yeah, although it just comes down to if they get Sued or not I guess. NOTE: I am not a legal professional, just making my guess.
- n2d4 3y ago
  For more crucial PII (such as SSN, health data, payment info, etc), vendors are generally required to have certifications from a third-party auditor (such as SOC2). If the big companies fail to check that, then yes, they can be made liable.
  - adrr 3y ago
    No rules or laws that require it. Closest requirement would be PCI around credit cards but you need lots of volume to be required to do an audit. HIPPA just requires you to do risk analysis and implement risk management. SOX is up to the auditor, when I was CTO at a public company, they were fine with me signing at attestation of all things we had implemented. Same with banks, no explicit requirement in both glba and fdic rules. Core bank systems are so old, none of that data is even encrypted neither is network traffic. Stuff is still in cobol. Forcing function would be cyberinsurance policies that typically want to see audit results if you have multi-million dollar policy limits.
MattDaEskimo 3y ago
Full permissions for a user is blatant negligence. For anyone who's never used Firebase before this is as simple as a single piece of logic that appears basically as: if authUserID is UserDirectoryID That simple.
- akersten 3y ago
  I've never used firebase before. But are you saying that, in it's default configuration, anyone who registers a firebase account has R/W access to any firebase database as long as the database owner forgot to put that line in there somewhere? That seems like an insane design...
  - n2d4 3y ago
    When you create the database, you're asked whether you want to give everyone access (development mode), or whether no one gets it (production mode). If you choose the development mode, it will automatically disable that access after a certain timestamp, so you don't forget to update it before shipping. This of course doesn't stop people who don't care about security from just manually giving out public R/W, or extending the timestamp.
  - curtisf 3y ago
    No, the default is no access to anything. You have to write rules that allow access to each record in the database. It sounds like the rule that they wrote only checked that the request _is logged in_, because they assumed that visitors can't create their own accounts.
    - hot_gril 3y ago
      Yeah, the whole design of Firebase is that the client interacts directly with Firebase, not via your server. Which makes sense for auth since you don't want to be handling that manually, but the database? That makes me uneasy.
    - lolinder 3y ago
      Which, even if that assumption were true, is still bonkers, because from what I see in the article they had no partitioning between tenants or permissions checks for different user roles. So even if they hadn't accidentally allowed creating new accounts, any account on any one of their existing customers had full access to every row in the database.
hazebooth 3y ago
i love the picture of your cat on the home page :)
- MrBruh 3y ago
  That's my lovely cat, Jingles. She is getting a bit old so I thought I would immortalize her on the homepage of my site.
hot_gril 3y ago
Article gets to the point very quickly, nice.
- MrBruh 3y ago
  Much appreciated, I am always open for further feedback too! (If there are ways I can improve my writing)
  - howon92 3y ago
    My feedback: keep the same style :)
  - listenallyall 3y ago
    Article was good, and your instincts proved correct -- but if you want some truthful feedback, your headline is clickbait. You pwned a single vendor that happens to work with some fast food restaurants, you did not find a vulnerability within the restaurant companies themselves. "I pwned an applicant management system" is a lot less compelling than the headline you used.
alalbertson 3y ago
no contact or thanks for potentially avoiding a lawsuit for them.
- deleted 3y ago
  [deleted]
speps 3y ago
Who's to say they're the first to discover this? They're the first to discover it and do something to fix it. I thought there was a US law now where breaches like this have to be reported?
- MrBruh 3y ago
  > I thought there was a US law now where breaches like this have to be reported? Yes. > Will they report it? Probably not (unless forced imo).
  - smegger001 3y ago
    i seem to recall a case of hackers anonymously reporting a data breech when a the company they hacked refused to pay up and didn't report it as required by law.
    - n2d4 3y ago
      Yes, ALPHV/Blackcat blackmailed MeridianLink by hacking them and then filing a SEC whistleblower complaint [1]. As always, Matt Levine has a wonderful article on it: https://archive.ph/Yffbh https://archive.ph/Yffbh [1] https://www.burr.com/cyber-security-law-blog/ALPHV-extort-MeridianLink-with-sec-whistleblower-complaint https://www.burr.com/cyber-security-law-blog/ALPHV-extort-Me...
- itsdrewmiller 3y ago
  You're probably thinking of recent SEC regulations requiring disclosure for public companies - https://www.sec.gov/news/statement/gerding-cybersecurity-disclosure-20231214 https://www.sec.gov/news/statement/gerding-cybersecurity-dis... Chattr is a private company - https://www.crunchbase.com/organization/chatrr https://www.crunchbase.com/organization/chatrr
  - namdnay 3y ago
    the clients are public companies, and in the contracts they've signed with Chattr there will definitely be a clause that Chattr has to disclose everything to their clients, so that they themselves can raise to the markets
miek 3y ago
Well done, well written, great tact. Luckily we have HN to fill the gap on the missing kudos. What an unprofessional firm (chattr)
gazelle21 3y ago
[dead]
quickthrower2 3y ago
Firebase is a shitshow. I say this as someone who really tried to like it and sadly built a project for a client using it. Other than this security vuln, the issues vs. just using postgres are: * It is more work! Despite being a backend as a service it is much less code to just write a simple API backend for your thing both in time to do it and time to learn how to do it. Think of Firebase as being on the abstraction level of Sinatra or express and you may as well just use those. Things like Firebase and Parse etc. are more complicated. For the same reason it is more complicate to walk to work with just your arms and no legs (even though there are fewer limbs to deal with and no backend!). * Relational is king. Not being able to do joins really sucks. Yes you need to make async calls in a loop. NoSQL is premature optimisation. * Lots of Googlization. This means lots of weird, hard to find out clickops configuration steps to get anything working. Probably why this security flaw existed(?). * Emulator is flakey, so for local dev you need another cloud DB, and yes all that Googlized setup RSI inducing clickops. * I reckon it is slower than postgres at the scale of starting a project. Traditional architecture are blitz fast on modern hardware and internet. Like playing a 90s game on your laptop. * Apparently as you scale it gets pretty pricey. The main thing is: it actually slows you down! The whole premise is this should speed you up.
- refulgentis 3y ago
  Supabase is the iPhone to Firebase's Palm V -- highly recommend, if you're a fellow millenial like me who grew up on mobile, and things like "much less code to just write a simple API backend for your thing" sounds like 6 months and paying another engineer. EDIT: loud buzzer Careful, Icarus: "permissions can be setup to allow global read-writes" is a "vuln" of every system. p.s. Any comment on why her blog has you guys "remembering Chattr" then getting a seedy Firebase pwner GUI, and yours has you diligently looking through .ai TLDs?
  - zilti 3y ago
    At that point, you might as well just use PostgREST.
  - MrBruh 3y ago
    loud buzzer Sorry, but supabase has a similar issue. Another blog going over that has or will be made by Eva (referenced on the site)
cedws 3y ago
It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan. If it is indeed the latter, I wonder how they are so brazen about it. Does chattr.ai have a responsible disclosure policy? In my eyes people should be free to pentest whatever as long as there is no intent to cause harm and any findings are reported. Sadly, many companies will freak out and get the law involved, even if you are a good samaritan.
- devwastaken 3y ago
  Lack of proper regulations, engineering standards, and tangible fines means that the only democracy that exists is the people themselves taking action. The corps being hacked have plenty of malicious intent, perhaps focus on that.
  - jimz 3y ago
    In the American case, the interpretation of the CFAA under Van Buren (2021) would provide at least the defense that one does not violate the law if there is no meaningful authorization scheme in place to determine what constitutes "exceeds authorized access". This may sound pedantic but when reporting on the decision much of the non-specialist media seemed to have failed to appreciate that in order to determine what conduct exceeds authorized access, it's necessary to be able to determine where authorized access starts and ends in every case as a factual matter, and the courts essentially threw out the theory that one can simply use a non-technological solution (like a very broad ToS) as a backstop and require some sort of notice and specificity. I don't think the mere fact that such a technological scheme can be erected is relevant since in theory you can put in some sort of basic authorization scheme - including basic HTTP authorization - around pretty much anything accessible via the protocol, but anything beyond a showing of actually putting such an authorization scheme in place, there's no real way to determine the unimplemented intent of some company in a way with any certainty. It's Orin Kerr's "gate-up-gate-down" theory - you need to have a gate in place to start with, instead of just a space where a gate can go or the assumption where a gate should be to figure out whether the gate is up or down, and without that determination one cannot meet all of the elements required to prove a violation of the statute. I wouldn't even consider this "hacking" really. If prosecuted a defense attorney familiar with both the technology and the admitted niche area of computer crime law can readily conduct some very effective cross-examination against whoever the state is bringing out as a witness. The government does frequently rely on the lack of tech-competent and accessible counsel as a way to exert coercion (and usually resulting in a plea), and it doesn't help that the layperson has a very difficult time figuring out what qualities constitute competency when looking for attorneys (hence the enduring popularity of jingles since being memorable is frequently mistaken for being competent), but they are out there.
SoftTalker 3y ago
At this point I would not apply for a job if the employer used a third party online service. Seek out employers who do their own hiring and talk to candidates face-to-face. If they steer you to one of these third party services, send your resume by snail mail directly to the HR director with a cover letter highlighting all the data breaches such as this one, LinkedIn, Indeed, etc. You'll stand out as someone who pays attention.
- alwa 3y ago
  Not to be pessimistic, but consider the applicant pool MrBruh targets here. One wonders how widely people with the sort of research skills and communication habits you describe are represented in the population applying for a fry cook position at a Checkers franchise. Or even amongst the franchisees themselves... And for that matter, how that kind of initiative would be received by your potential future manager at the drive-thru. I feel like I sound a little patronizing, but my broader point is it’s not other people’s job to be responsible for this kind of data security, especially in a relationship so imbalanced as that between a job seeker and the potential employer who offers only one pathway to gainful employment. As to the remedy you propose, I’m reminded of the inimitable @patio’s Seeing Like A Bank [0], where he points out that banks (like other firms) use techniques like the paper letter that you described as subtle shibboleths to distinguish people who are likely sophisticated customers from the rank and file. [0] https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/ https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/
ashu1461 3y ago
Firebase is like a half baked product which lures people who are just starting out .It helps build products which can quickly go to market, but then once you start to scale, a lot of their products like firestore, firebase auth have basic features missing
mmsc 3y ago
Stepping aside for a moment and thinking about the scope of this, I think it’s a good example of why technological diversity is something to long for. If Chattr can be pwned like this so easily, they likely have many much more serious issues which in turn will affect half of America’s fast food chains.
- Aachen 3y ago
  I've heard it told that's why BIND and unbound exist alongside each other
ysofunny 3y ago
then again, the people in potential harm's way seem to be the poor sods trying to get hired by these companies for a meager hourly wage I don't see how this "p0wns" the companies themselves
simonebrunozzi 3y ago
> No contact or thanks has been received back so far WTF.
- troupe 3y ago
  I'm curious if the best monetary approach for a white hat hacker would be to show them the problem, give them time to fix it, and then give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed). The idea being the showing what you have found on other sites has marketing value for a white hat hacker, but had the company hired you to discover the flaw, you wouldn't be publishing it.
  - jacobsenscott 3y ago
    The best approach is not to do it. Demanding money from someone that didn't hire you is never ethical - just childish. Would you like it if I showed up at your house, mowed your lawn, and then started banging on your door demanding $100 for mowing your lawn? Also, what marketing value - if you're just pwning random web sites rather than getting hired to test a site's security you aren't in any market.
    - z3phyr 3y ago
      The grass in the lawn may not be that dangerous to other people. However, if your house is emitting radiation, and a hero breaks in to clean it up for the sake of other people you service, (because the town does not need to wait for you to hire someone) the hero deserves a reward and the owner of the house deserves punishment.
      - hnfong 3y ago
        Unless the "hero" is law enforcement or some other government agent with a warrant, he will likely have broken a bunch of laws by breaking into a person's house uninvited, and not very likely rewarded. That's modern society for ya.
    - 3y ago
pierat 3y ago
And folks, this is why you sell your exploits to the highest bidder. Being "good" and giving companies free work is a HORRIBLE idea. They're never gonna pay, or even than you. If they're not willing to treat security researchers properly, I see no reason to return the favor. Remember security groups: if your company wont pay, there are others that will.
- mapster 3y ago
  Did you not see the part where applicants info was exposed? Make a few bucks by selling their data to <whoever> is 10000x worse than the chatr dev not securing the files.
  - qznc 3y ago
    Could have submitted it to https://haveibeenpwned.com/ https://haveibeenpwned.com/ Chances are some blackhat already discovered this data and sold it.
  - pierat 3y ago
    Selling exploits (the words explaining how to) is a 1st amendment protected act. Actually downloading the data from a hack and selling it is expressly illegal. Now if the person/group you're selling to expresses illegal actions as a result, you have a duty not to sell. So, don't ask, and dont tell! The real solution: companies all should allow for bug bounties and good-faith reporting and proper compensation for reported issues. But as long as they don't another group WILL pay.
- poisonborz 3y ago
  Sadly this is the right direction. With time, companies will learn, but we can all be afraid on what world they will push for to solve this (it will be less like "put more resources on proper opsec" and more like "browser attestation").
yieldcrv 3y ago
does this count as authorized access under CFAA? I’m curious what the limits are
pstuart 3y ago
I was looking at jobs for my son at Safeway supermarkets and lazily put https://www.safeway.com/jobs https://www.safeway.com/jobs in the browser. That redirects to https://www.careersatsafeway.com/desktop/home https://www.careersatsafeway.com/desktop/home -- which is very much not about jobs at safeway -- appears to be an Indonesian gambling/gaming site. Safeway.com has zero email contacts published and expects communication to be via phone call or chatbot. I found their domain admin email and sent them info with no response, and no change to their site behavior. This makes me think that they might be ripe for more monkey business but that's not my thing. Oh well.
- iamhamm 3y ago
  Hi Albertsons/Safeway VP of Security Engineering here. Thank you for disclosing this. I’ll have it fixed along with the fact our VDP submission link is missing from the Safeway site. Here it is for future reference https://albertsons.responsibledisclosure.com/hc/en-us https://albertsons.responsibledisclosure.com/hc/en-us
  - alright2565 3y ago
    Please also add a security.txt file so that it is not necessary to navigate through a labyrinthine site to get this information. https://datatracker.ietf.org/doc/html/rfc9116 https://datatracker.ietf.org/doc/html/rfc9116
  - forward1 3y ago
    It's definitely not fixed: the (likely malicious?) redirect still happens for me now. How embarassing (for you).
  - pstuart 3y ago
    Hi! I was wondering if it would get noticed here ;-) But as noted elsewhere, it's still not fixed. And the link you shared is a good thing but is that going to be easy to find to someone who sees an issue with your websites? I'd recommend putting a link here: https://www.safeway.com/help/contactus https://www.safeway.com/help/contactus
  - 3y ago
Aurornis 3y ago
> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some participants who would find a small vulnerability, but then sit on it for months while they tried to find a way to turn it into a larger vulnerability to claim a higher prize. Then when they finally gave up on further escalation and submitted it, they'd get angry when we informed them that we had already patched it (and therefore would not pay them). The incentives in infosec are weird.
- jacobsenscott 3y ago
  > The incentives in infosec are weird. Well - only the amateur infosec world where you try and force someone to be your client after you do the work, and then get butthurt when they don't become your client. In the professional infosec world the clients choose to hire you first.
- UberFly 3y ago
  > "No contact or thanks has been received back so far, I will amend this comment if/when they do so :)" They couldn't even be bothered to send a proper thank you.
  - sailfast 3y ago
    To be fair... that's today. Guessing something might be in the works but it's 1AM Eastern Time in the US.
- MrBruh 3y ago
  I feel I should clarify, the writeup was not the blog but rather than vulnerability disclosure report (PDF) I sent to them directly.
  - Aurornis 3y ago
habosa 3y ago
Sad that in 2024 people continue to set their Firebase security rules to be wide open. Back in maybe 2015-2019 that was excusable because that was the default but now it’s just lazy. Don’t expose your database / api / blob storage bucket / etc to the public! It’s not that hard to do it right, or at least “right enough” that you can’t get owned by someone scanning a whole TLD.
- thatwasunusual 3y ago
  > Sad that in 2024 people continue to set their Firebase security rules to be wide open. [...] Don’t expose your database / api / blob storage bucket / etc to the public! What is additionally sad, is that your comment - in 2024 - is being downvoted.
- araes 3y ago
  Partially, this seems like an issue with Firebase, where the defaults are possibly set on something that is not sane from most professionals perspective. Having slightly tried Firebase, I can also say that the Google cloud tool environment was really confusing the last time I tried using it. Just this enormous maze of switches, and dials, and widgets, like a lot of the popular IDEs. If the defaults are not set on something sane, and I, a personally evaluated competent tech user with some background in security (fed work) can barely find the settings, then most normal humans with limited grasp of those issues probably won't even know to look.
sampli 3y ago
If you view this page in Safari, it’s just a text document
- black3r 3y ago
  Since this is a post about security, this is your daily reminder to update your browser to stay safe on the internet. Up-to-date versions of Safari support AVIF images, and there have been multiple RCE vulnerabilities with known exploits fixed last year in Safari...
  - deleted 3y ago
    [deleted]
  - hospitalJail 3y ago
    iphones are the scariest device to do anything important on. I had a moment of total freakout when I realized the person across from me at lunch had an iPhone on the table. Actually he had an Android, and we continued talking like no big deal. To be clear, we were talking about a 10-100M dollar problem, this wasnt small potatoes. Too many exploits, I can't imagine having anything of value on an iphone.
    - novagameco 3y ago
      > I had a moment of total freakout when I realized the person across from me at lunch had an iPhone on the table Why?
    - buffington 3y ago
      Please, tell us more about each of these points you make, in detail. I'm compelled to know.
- MrBruh 3y ago
  It is using the Avif format (for images) for a 2x compression bonus over PNG while still maintaining a higher quality over JPG. If you can't view the images then it means you are likely using an outdated browser, all current versions of browsers support it (afaik) except Internet Explorer.[0] ...And if you are using Internet Explorer, then god help you. [0] https://caniuse.com/avif https://caniuse.com/avif
thekombustor 3y ago
At the time of writing, accessing the link returns a bunch of prometheus metrics... interesting.
- MrBruh 3y ago
  Shouldn't anymore, was a "pushing to production" moment. I wanted analytics since my site was getting flooded \w traffic.
  - user3939382 3y ago
    Are you not concerned with the CFAA?
Michaelhartnett 3y ago
[dead]
zharknado 3y ago
From Eva’s post: > we didnt know much about firebase at the time so we simply tried to find a tool to see if it was vulnerable to something obvious and we found firepwn, which seemed nice for a GUI tool, so we simply entered the details of chattr's firebase Genuinely curious (I’ve no infosec experience), wouldn’t there be a risk that a tool like this could phone home and log everything you find while doing research?
- MrBruh 3y ago
  Sure but it's FOSS, so audits are pretty easy. Plus as part of the pentesting I watch the network stack in Firefox sometimes so I would tell if it was trying to exfiltrate date
- bushbaba 3y ago
  Yes, but that might also be caught by infosec users of said tool who have things similar to “littlesnitch” alerting them to the outbound API call attempt.
  - genewitch 3y ago
    there used to be windows GUIs for forcing new connections to ask, but i haven't seen anything like it. I can't recall the name of the one i used to use, but it scored perfectly on shieldsUp - oh, Zone Alarm. Littlesnitch iirc is macos only, but it sounds lovely for this sort of thing.
    - hexadec 3y ago
      You can set this with Windows' default firewall. Setting to strict mode with no whitelist causes a UAC alert every time a process attempts communication.
    - Hrun0 3y ago
      You are looking for simplewall
    - flexagoon 3y ago
andrecarini 3y ago
How much would this leak go for in the darknet?
- crooksey 3y ago
  Deciding to sell this on the darknet is a life changing decision, white to black overnight and imagine not really something most would contemplate. Payment in BTC probably from an already compromised address so loads of factors. Probably an easy + quick 2BTC though
  - mathverse 3y ago
    This is an easy and obvious exploit so an attacker would need to extract the data from all sources ASAP. High risk of getting caught and ending in jail to be honest for measly 2BTC. Not worth it for anyone in the US or even Europe.
    - gretch 3y ago
      > Not worth it for anyone in the US or even Europe. Lots of crimes are not "worth it". And yet criminals do it anyway. Because criminals (nor most humans) are not perfectly rational. There's routinely reports where people try to rob a gas station with a loaded gun - a $200 haul if everything goes perfect. It doesn't and now they have 10 years in jail...
      - leoqa 3y ago
        One crime is skilled, one crime is not. The skilled person has more options to earn 2BTC than the unskilled person does to earn $200. If you’re a felon and unskilled you’re as desperate as it gets in America.
        gretch 3y ago
        Yeah Sam Bankman Fried probably had the skills and connections and trust to coast through life. But instead he chose to commit the most egregious of financial fraud. I would strongly argue that almost all crime is irrationally - take it to the game theory strategies of tit-for-tat and such.
counterpartyrsk 3y ago
This is the most perfect blog post. ZERO fluff, straight to the point. Win.
- az226 3y ago
  Except it is almost perfect — it would have been perfect had he been thanked and rewarded. Of course that is not on him, but felt so disappointed reading that at the end.
  - jb1991 3y ago
    "Perfect" is referring to the blog post, not the outcome.
  - brojo_ 3y ago
    It's been less than 24hours. I don't think any company works at that speed.
    - davedx 3y ago
      Oh come ON. Sending an email acknowledging the report and saying "Thanks so much for reporting this - we will look into it ASAP" takes about 10 seconds
- deleted 3y ago
  [deleted]
deleted 3y ago
[deleted]
theonething 3y ago
> If you grab the list of admin users from /orgs/0/users, you can splice a new entry into it giving you full access to their Administrator dashboard. I'm not clear on this. Splice a new entry into what? The list of admin users? And then do what with it?
- iamflimflam1 3y ago
  Once he had access to Firebase (the database) he was able to add an entry to the list of admin users. With that done he could login as an admin user to the website and access the administrator dashboard.
- urbandw311er 3y ago
  I read this as worse - splice being a client side JavaScript function to add items to arrays. My concern here is whether the “is admin user” perms checks were done solely on the client side and not enforced on the API endpoint!
  - missblit 3y ago
    He's using the word as meaning "insert", not the JS function. He is saying he inserted a new row into a database to get admin access to a dashboard. 'splice" means to join two things as if by weaving them together. If used as "splice into" or "splice in" there is a sense of breaking something apart, inserting something into the gap, and joining it back together. This all makes a bit more sense if you look up the etymology which was about ropes (despite splicing being about uniting, it's closely related to the word 'split').
  - specialp 3y ago
    It doesn't look like an IDOR attack. The poster says they had read/write access to the Firebase DB with their Firebase user they registered. It appears they had the database entirely open to all Firebase users. I agree the usage of "splice" in a JavaScript context does imply that they had an IDOR exploit
8organicbits 3y ago
I would have stopped once I confirmed the leaked keys were valid. Looking at what types of data you had access to wasn't required. Downloading plaintext passwords of other people is probably too far. Impacted users may need to be notified about a breach. If needed, create an account of your own and target only that. If there was a pentester agreement, safe harbor, or other protection that's different. Be careful out there.
- denysvitali 3y ago
  I would argue that looking at the type of data you're dealing with is actually a very important part to assess the impact, but looking at the data itself is beyond this part. Knowing that they store passwords in plaintext is a security issue on top of the R/W credential
  - 8organicbits 3y ago
    Type of data is very important to assessing impact. But that doesn't grant anyone authority to breach customer data. The company can assess impact.
- Topfi 3y ago
  > Looking at what types of data you had access to wasn't required. Downloading plaintext passwords of other people is probably too far. Impacted users may need to be notified about a breach. If needed, create an account of your own and target only that. I'd argue that it was absolutely necessary to gauge the severity of this misconfiguration and furthermore, that Chattr.ai must contact every affected user, not MrBruh. Their configuration allowed anyone to create an account and access plaintext passwords. There is no telling whether and how many outside of this disclosure have previously accessed this information and may intend to use it. This was negligence of the highest order, and it shouldn't be on the one finding and reporting this issue to rectify it.
  - 8organicbits 3y ago
    > absolutely necessary to gauge the severity of this misconfiguration Possibly. But what's the legal basis that allows random external parties to make that determination? Report the leaked credential, and let the company assess impact. The problem is that pivoting to accessing user passwords may cause the companies to spend money notifying customers and harm their reputation. If they want to pursue legal action, those are clear damages. > Chattr.ai must contact every affected user, not MrBruh. Agreed, a pentester directly contacting impacted users would increase the risk legal gets involved. > There is no telling whether and how many outside of this disclosure have previously accessed this information Typically the company would review logs to determine that.
deleted 3y ago
[deleted]
lulznews 3y ago
>With an upbeat pling my console alerted me that my script had finished running Forget the pwn how do I do this Also, HN used to think this was cool now there are 20 posts blaming the hacker…
- ginko 3y ago
  I have this in my .bashrc beep() { if [ $? -eq 0 ] then file=/usr/share/sounds/purple/receive.wav ret='true' else file=/usr/share/sounds/purple/alert.wav ret='false' fi (aplay $file 2>/dev/null >/dev/null &); $ret } Can be called like this: $ command ; beep Depending on the return value it'll give a different alert. It preserves the return value so you can still chain other dependent commands after it. This depends on the libpurple sounds to be where they are (works in ubuntu at least)
- mmsc 3y ago
  >Also, HN used to think this was cool now there are 20 posts blaming the hacker… I'm not sure whether it's HN thinking this is uncool (it is cool!) or it's HN taking the unfortunate realistic position that this type of stuff only gets the reporters into trouble, after seeing it happening time and time ago. People doing cool stuff get in trouble, and it's sad to watch.
- deleted 3y ago
  [deleted]
- binwiederhier 3y ago
  I suggest using ntfy [1] for this. It's open source and self-hostable. It lets you push notifications to your phone like this: ./myscript.sh; curl -d "Script done" \ ntfy.sh/mytopic Disclaimer: I am the maintainer of ntfy. [1] https://ntfy.sh/ https://ntfy.sh/ + https://github.com/binwiederhier/ntfy https://github.com/binwiederhier/ntfy
- FrustratedMonky 3y ago
  Yeah, what happened to the "Hacker" in Hacker News. (responding to people blaming the 'hacker', not the sites). This guy just grabbed publicly available information, and by 'public' I mean put out onto the web un-protected, just put out there. If you can just basically browse to something, is it really his fault for finding it. It's like if I have a front door on my house, and just in the front hallway I have a huge naked picture of my wife. If I leave the door open, can I get mad at pedestrians walking by, for seeing the picture. Maybe they walkup to ring the door bell just to get closer look, walking up to the door, but not going in, is allowed.
Sparkyte 3y ago
Ethical hacking is a good thing. Nice to see someone doing good.
- deleted 3y ago
  [deleted]
- refulgentis 3y ago
  They reworded things since yesterday: Before, one collaborator had them in a chat sneering about chattr, checking their Javascript, then getting a GUI pwn tool for firebase. i.e targeted attack with malice, followed up a blog post wildly exaggerating what happened, with a disclosure policy of 'we emailed them once and they fixed and didn't email us back so we'll just publish' Only spelling this out because it's important to point out the significant gaps between white hat culture and these actions, not only for the authors, but for people who are inspired and want to practice it
  - internetter 3y ago
    > Before, one collaborator had them in a chat sneering about chattr "Wow this thing looks crappy" > checking their Javascript "I wonder if it is crappy" > then getting a GUI pwn tool for firebase. "Huh, it seems crappy. Let's just check to be sure" > with a disclosure policy of 'we emailed them once and they fixed ...' "Well, this thing is really crappy. we don't want to harm people. Let's tell them about how crappy it is to avoid harm" > and didn't email us back so we'll just publish' "They fixed the thing, nobody will be harmed. We still think it's crappy so let's talk about it" Why wouldn't they go public at this point? They've gotten nothing else out of it, and since the issue has been fixed there is zero harm to customers. Do you propose they go like "Hey company, we found this really embarrassing thing you did. I see you fixed it now, so can we talk about it" silence "Oh well the company didn't say anything so we won't talk about it. So sad" In what world do we not hold companies accountable? In what world do we blame the people who find these issues for free?
    - refulgentis 3y ago
      Note I'm not claiming disclosure is bad, but rather, this is a copy of a copy of a copy of a copy of a copy of a copy of how professionals handle these situations, to the point there's nothing left except the "1) pick a target 2) email them 3) write a blog post when fixed" parts.
bikamonki 3y ago
You are a good human. Seems they had not tweaked the database rules correctly, maybe even left the default setup! That means you could have executed this: Firebase.database().ref('/').set('All your data is gone'). Better yet, download the whole DB and then: Firebase.database().ref('/').set('I have all your data, pay me to get it back').
- deleted 3y ago
  [deleted]
lwhi 3y ago
It seems crazy that no thanks or recognition has been given. Is this because doing so might be seen as an admission of liability, and could be used in any legal cases that are brought?
- didntcheck 3y ago
  To give the benefit of the doubt, it appears he only contacted them less than 48 hours ago. Their first priority should correctly be to fix the problem. They could be discussing a bug bounty right now and just haven't finalized the email yet
  - pge 3y ago
    American readers may not have noticed that the dates are in European DD/MM format, so they thought disclosure was Sept 1 rather than Jan 9.
    - MrDunham 3y ago
      I 100% saw it as MM/DD and was wondering why it took them three months to write up the vulnerability and a month to patch it. Thanks for the clarification
  - zopa 3y ago
    “Thanks for coming to us with this, we’re looking at it right away” wouldn’t take a lot of time or commit then to anything

1081 points by MrBruh 3y ago

mihaaly 3y ago

"move fast and break things" - Mark Elliot Zuckerberg

bomewish 3y ago

They need to pay this guy 100k. And fire someone.

mapster 3y ago
They can’t because most of the people firing will also be held accountable and fired
deleted 3y ago
[deleted]

Erratic6576 3y ago

So the hacker worked for free?

iinnPP 3y ago
Yes, the way the incentives are aligned ensures nobody ever goes to jail and the little guy pays all the bills.

1-6 3y ago

We need Whitehat awards and give this person that.

tech_ken 3y ago

Lol. Lmao even. Great writeup

unoti 3y ago

I worked with Firebase for a while, lured in because of how easy it was to do certain things. It makes certain kinds of operations essentially zero effort, such as getting realtime updates on the frontend when something changes. But it also creates a huge amount of effort that is trivial with other frameworks, such as creating a huge effort for security. I found that what I gained in convenience, I lost by needing to do so much work continuously battling with security rules. I left it behind and never looked back, and it made me much more cheerful about the work that I needed to do to establish and maintain more conventional backend data systems.

robertlagrant 3y ago
I made an app in Firebase once and did it so that people could collaborate but they used per-session IDs that were linked to their real IDs behind the scenes, so people couldn't spot trends of activity over time. I found it a little tricky to start with while getting familiar with the rules, but it worked really well after I got the hang of it.

digitcatphd 3y ago

This is extremely annoying. Instead of fucking with other people’s companies why not build your own? You pwned them? What are you twelve? All you did was commit a felony and post it online.

deleted 3y ago
[deleted]
kipukun 3y ago
I'll bite -- he discovered a vulnerability in a large company and responsibly disclosed it to them. How is that a felony? Why would you post a felony online?
Kuraj 3y ago
If I understand correctly, the article was published only after the vulnerability was patched. That sounds OK to me.
monsieurgaufre 3y ago
Pretty sure that poking around for holes/exploits is part of the definition of what is a hacker. They notified the relevant organization as well. Not sure why you take that stance.
- digitcatphd 3y ago
  And then posted it online? If his intentions were good he wouldn’t post their name.
  - KomoD 3y ago
    > If his intentions were good he wouldn’t post their name. Why? They shouldn't be allowed to sweep it under the rug
  - monsieurgaufre 3y ago
    After the fix as been deployed, i don't see why it should not be. It might be useful to someone else. If security is mostly an afterthought, maybe naming and shaming might help them take it seriously. I do not understand your stance at all. Why are you defending corps that were negligent?

946789987649 3y ago

If they're already using firebase, can anyone think why they are storing passwords? Firebase Authentication is incredibly easy and quick to setup and use (less than a day for someone new to it), which means you have no need to worry about passwords.

jzig 3y ago
offshore workers
- diogomqbm 3y ago
  this is racist
godelski 3y ago
Not a direct answer, but I can tell you I see crazily idiotic mistakes in apps all the time. I think people are hiring the lowest of the low. FWIW, I don't think AI will replace coders anytime soon, but I think it'll replace these coders. For example, my school's laundry app. Takes 8s to load because it continually refreshes the screen while it is trying to make a connection to their portal. Even now I just checked, it logged me out, took 5 seconds to let me touch the login, I placed in my email, grabbed my password form my password manager, it clearerd my email, retyped, and now the login is grayed out. Looks like I'm currently locked out. Looking at the laundry rooms, it takes 45s to load (literally, I timed it), and then the rooms aren't in order. It'll be like A4, A6, A7, A3, A11, A9, and so on. I'm not sure it's even manually filled in because they seem to change. Plus I have to unplug and replugin the machines constantly because they disconnect from the server. The dryer is a pain. This happens enough that the cords are worn down and it is a fire issue. Yesterday I ordered from Jersey Mikes. They have a field where you can specify instructions. They do keyword filtering so you can't place a word like "cheese" in it, because they want you to click the box, but the box doesn't let you specify what kind of cheese. You also can't use words like "extra." Employees have always understood my shorthand or leet speak. My housing processes applications via LIFO instead of FIFO. So all the students who renew their applications a month after the deadline get approved for their housing before anyone who does it within a reasonable time. Electric bikes are known to light on fire when charging them. Teslas doesn't cover warranty for water damage. Google Maps routinely tells me to be in the wrong lane or miscalculates the number of lanes that exist. Google drive's solution to scrolling through music too fast is to lock you out, which just results in the user picking up the phone. Mine also likes to frequently disconnect itself and there's no low data mode so sometimes it just overloads my car's infotainment computer. Classic halt and catch fire situation. I can go on about this stuff and it astounds me. Something is fundamentally broken when we can have computers that can talk to us in natural language but we are unable to design a system where employees understand the concept of a sorted list. Not to mention that I won't be surprised when that building catches fire. Edit: I got logged in. My username was pasting into my password because their password field is labeled as a username field... but it is also hidden... They also double charged me in the past, said they didn't, and their solution was for me to issue a clawback with my bank. These people just don't care. I really believe a lot of people are building things that they never test and never use. Even at big companies.

lxe 3y ago

This is my problem with the whole architecture of FE -> DB. Without a middle server layer, things like token storage, authentication, and other things become really easy to screw up.

Kamshak 3y ago
Firebase has an auth API that is free built in, it's weird that they didn't just use it. Idk if whoever built this would have built a more secure solution with a server layer or just have a public mongo instance instead
tetha 3y ago
Mhhm. It's also a reason why we're making sure our developers have an easy time integrating into the platforms authn and authz systems. For example, if you need an admin interface, it should be just a library include and some bespoke framework configs to be integrated with the central authz framework over trying to think of something on their own. It's... way too successful internally, lol, because we have a lot of permissions and privileges to manage now. And now we have to figure out good ways to assign these permissions to people more efficiently. But that's a better problem than a GDPR relevant data breach, to be honest.

deleted 3y ago

[deleted]

tmaly 3y ago

Dude should have gotten some free chicken for his efforts.

mellosouls 3y ago

No contact or thanks has been received back so far :)

MrBruh 3y ago
I wasn't expecting a bug bounty, but not even a 'thank you' does hurt my soul :(
- wt__ 3y ago
  If it's any consolation, people these days frequently ignore (or read but don't bother acknowledging) pretty much any email that was intended to be helpful, not just security disclosures.
- PopePompus 3y ago
  Well, they're incompetent - is it a big surprise that they have poor manners too?
  - ryandrake 3y ago
    Yea, and if they were actually breached and there were victims, the first thing they would do is issue a press release telling the world "We Take Security Very Seriously."
    - ethbr1 3y ago
      Is it legally differentiated if they respond to the reporter? Or is there some weird loophole of "We didn't take action because of your message. We just happened to patch the same vulnerability after you mentioned it. We are not aware of any penetrations, because we didn't notice your message"?
      - hnfong 3y ago
        > Is it legally differentiated if they respond to the reporter? Nobody knows. But between taking an unknown legal risk, vs being seen as ungrateful, the choice for legal is quite clear.

intern4tional 3y ago

This isn’t owning fast food chains; rather compromising some AI startup that has some of them as a customer. Title is misleading.

mellosouls 3y ago
TBF your proposed title is less snappy.
- intern4tional 3y ago
  Of course, but it that’s good in most cases as then you don’t get an overreaction. The right people will read it (Chattr.ai’s customers) and respond . Right now everyone looks at it and some CISO will overreact and make everyone go check their Firebase configurations which may likely be a non-value add.
MrBruh 3y ago
It exposed PII of the managers & employees of ~half of the most popular fast food companies. Personally I feel the title is justified but I understand and respect your viewpoint. Also keep in mind that trying to clarify the such would also make the title much longer than I desired.
- refulgentis 3y ago
  [flagged]
- borissk 3y ago
  Aren't you afraid one of the companies involved may file a complain with FBI or police and get you arrested?
  - buffington 3y ago
    Arrested for what? The system gave them permissions, they didn't exfil data, and they disclosed it to the company. He did those companies a favor by showing them how vulnerable they are by outsourcing every operation and process in pursuit of profits.

erikerikson 3y ago

[flagged]

deleted 3y ago
[deleted]

KTibow 3y ago

The timeline omits when the article was put online

not2b 3y ago
That can be easily deduced.
boomboomsubban 3y ago
According to the Wayback Machine, it first appeared January 10 2024. http://web.archive.org/web/20240000000000*/https://mrbruh.com/chattr/ http://web.archive.org/web/20240000000000*/https://mrbruh.co...
MrBruh 3y ago
It was posted earlier today (NZ Time). If they do end up reaching out though, I will amend that part with a revised statement :)
- samstave 3y ago
  You could ostensibly make a great tool from this data for those seeking employment.... Make a tool which will look at the list of all the franchises within radius of person, and have it auto submit applications to all of them simultaneously...

j-bos 3y ago

If this had been exploited and the job applicants to Target, Subway, Dunkin et al, had bank/credit fraud committed in their name's, would the big companies be liable for not performing due dilligence on chatter.ai? To be clear, I'm asking from a legal standpoint not a practical one.

mihaaly 3y ago
I assume it is more like the chattr.ai where the responsibility falls, except if the companies were using it as a tool and configuring the services falls with them. Down to the contractual circumstances. 'Tool provided works well' vs. 'using the provided tool well' kind of thing I guess.
qznc 3y ago
There is probably at least one European citizen in there, so GDPR applies.
MrBruh 3y ago
Probably yeah, although it just comes down to if they get Sued or not I guess. NOTE: I am not a legal professional, just making my guess.
n2d4 3y ago
For more crucial PII (such as SSN, health data, payment info, etc), vendors are generally required to have certifications from a third-party auditor (such as SOC2). If the big companies fail to check that, then yes, they can be made liable.
- adrr 3y ago
  No rules or laws that require it. Closest requirement would be PCI around credit cards but you need lots of volume to be required to do an audit. HIPPA just requires you to do risk analysis and implement risk management. SOX is up to the auditor, when I was CTO at a public company, they were fine with me signing at attestation of all things we had implemented. Same with banks, no explicit requirement in both glba and fdic rules. Core bank systems are so old, none of that data is even encrypted neither is network traffic. Stuff is still in cobol. Forcing function would be cyberinsurance policies that typically want to see audit results if you have multi-million dollar policy limits.

MattDaEskimo 3y ago

Full permissions for a user is blatant negligence. For anyone who's never used Firebase before this is as simple as a single piece of logic that appears basically as: if authUserID is UserDirectoryID That simple.

akersten 3y ago
I've never used firebase before. But are you saying that, in it's default configuration, anyone who registers a firebase account has R/W access to any firebase database as long as the database owner forgot to put that line in there somewhere? That seems like an insane design...
- n2d4 3y ago
  When you create the database, you're asked whether you want to give everyone access (development mode), or whether no one gets it (production mode). If you choose the development mode, it will automatically disable that access after a certain timestamp, so you don't forget to update it before shipping. This of course doesn't stop people who don't care about security from just manually giving out public R/W, or extending the timestamp.
- curtisf 3y ago
  No, the default is no access to anything. You have to write rules that allow access to each record in the database. It sounds like the rule that they wrote only checked that the request _is logged in_, because they assumed that visitors can't create their own accounts.
  - hot_gril 3y ago
    Yeah, the whole design of Firebase is that the client interacts directly with Firebase, not via your server. Which makes sense for auth since you don't want to be handling that manually, but the database? That makes me uneasy.
  - lolinder 3y ago
    Which, even if that assumption were true, is still bonkers, because from what I see in the article they had no partitioning between tenants or permissions checks for different user roles. So even if they hadn't accidentally allowed creating new accounts, any account on any one of their existing customers had full access to every row in the database.

hazebooth 3y ago

i love the picture of your cat on the home page :)

MrBruh 3y ago
That's my lovely cat, Jingles. She is getting a bit old so I thought I would immortalize her on the homepage of my site.

hot_gril 3y ago

Article gets to the point very quickly, nice.

MrBruh 3y ago
Much appreciated, I am always open for further feedback too! (If there are ways I can improve my writing)
- howon92 3y ago
  My feedback: keep the same style :)
- listenallyall 3y ago
  Article was good, and your instincts proved correct -- but if you want some truthful feedback, your headline is clickbait. You pwned a single vendor that happens to work with some fast food restaurants, you did not find a vulnerability within the restaurant companies themselves. "I pwned an applicant management system" is a lot less compelling than the headline you used.

alalbertson 3y ago

no contact or thanks for potentially avoiding a lawsuit for them.

deleted 3y ago
[deleted]

speps 3y ago

Who's to say they're the first to discover this? They're the first to discover it and do something to fix it. I thought there was a US law now where breaches like this have to be reported?

MrBruh 3y ago
> I thought there was a US law now where breaches like this have to be reported? Yes. > Will they report it? Probably not (unless forced imo).
- smegger001 3y ago
  i seem to recall a case of hackers anonymously reporting a data breech when a the company they hacked refused to pay up and didn't report it as required by law.
  - n2d4 3y ago
    Yes, ALPHV/Blackcat blackmailed MeridianLink by hacking them and then filing a SEC whistleblower complaint [1]. As always, Matt Levine has a wonderful article on it: https://archive.ph/Yffbh https://archive.ph/Yffbh [1] https://www.burr.com/cyber-security-law-blog/ALPHV-extort-MeridianLink-with-sec-whistleblower-complaint https://www.burr.com/cyber-security-law-blog/ALPHV-extort-Me...
itsdrewmiller 3y ago
You're probably thinking of recent SEC regulations requiring disclosure for public companies - https://www.sec.gov/news/statement/gerding-cybersecurity-disclosure-20231214 https://www.sec.gov/news/statement/gerding-cybersecurity-dis... Chattr is a private company - https://www.crunchbase.com/organization/chatrr https://www.crunchbase.com/organization/chatrr
- namdnay 3y ago
  the clients are public companies, and in the contracts they've signed with Chattr there will definitely be a clause that Chattr has to disclose everything to their clients, so that they themselves can raise to the markets

miek 3y ago

Well done, well written, great tact. Luckily we have HN to fill the gap on the missing kudos. What an unprofessional firm (chattr)

gazelle21 3y ago

[dead]

quickthrower2 3y ago

Firebase is a shitshow. I say this as someone who really tried to like it and sadly built a project for a client using it. Other than this security vuln, the issues vs. just using postgres are: * It is more work! Despite being a backend as a service it is much less code to just write a simple API backend for your thing both in time to do it and time to learn how to do it. Think of Firebase as being on the abstraction level of Sinatra or express and you may as well just use those. Things like Firebase and Parse etc. are more complicated. For the same reason it is more complicate to walk to work with just your arms and no legs (even though there are fewer limbs to deal with and no backend!). * Relational is king. Not being able to do joins really sucks. Yes you need to make async calls in a loop. NoSQL is premature optimisation. * Lots of Googlization. This means lots of weird, hard to find out clickops configuration steps to get anything working. Probably why this security flaw existed(?). * Emulator is flakey, so for local dev you need another cloud DB, and yes all that Googlized setup RSI inducing clickops. * I reckon it is slower than postgres at the scale of starting a project. Traditional architecture are blitz fast on modern hardware and internet. Like playing a 90s game on your laptop. * Apparently as you scale it gets pretty pricey. The main thing is: it actually slows you down! The whole premise is this should speed you up.

refulgentis 3y ago
Supabase is the iPhone to Firebase's Palm V -- highly recommend, if you're a fellow millenial like me who grew up on mobile, and things like "much less code to just write a simple API backend for your thing" sounds like 6 months and paying another engineer. EDIT: loud buzzer Careful, Icarus: "permissions can be setup to allow global read-writes" is a "vuln" of every system. p.s. Any comment on why her blog has you guys "remembering Chattr" then getting a seedy Firebase pwner GUI, and yours has you diligently looking through .ai TLDs?
- zilti 3y ago
  At that point, you might as well just use PostgREST.
- MrBruh 3y ago
  loud buzzer Sorry, but supabase has a similar issue. Another blog going over that has or will be made by Eva (referenced on the site)

cedws 3y ago

It's not clear if the author was hired to do this pentest or is a guerilla/good samaritan. If it is indeed the latter, I wonder how they are so brazen about it. Does chattr.ai have a responsible disclosure policy? In my eyes people should be free to pentest whatever as long as there is no intent to cause harm and any findings are reported. Sadly, many companies will freak out and get the law involved, even if you are a good samaritan.

devwastaken 3y ago
Lack of proper regulations, engineering standards, and tangible fines means that the only democracy that exists is the people themselves taking action. The corps being hacked have plenty of malicious intent, perhaps focus on that.
- jimz 3y ago
  In the American case, the interpretation of the CFAA under Van Buren (2021) would provide at least the defense that one does not violate the law if there is no meaningful authorization scheme in place to determine what constitutes "exceeds authorized access". This may sound pedantic but when reporting on the decision much of the non-specialist media seemed to have failed to appreciate that in order to determine what conduct exceeds authorized access, it's necessary to be able to determine where authorized access starts and ends in every case as a factual matter, and the courts essentially threw out the theory that one can simply use a non-technological solution (like a very broad ToS) as a backstop and require some sort of notice and specificity. I don't think the mere fact that such a technological scheme can be erected is relevant since in theory you can put in some sort of basic authorization scheme - including basic HTTP authorization - around pretty much anything accessible via the protocol, but anything beyond a showing of actually putting such an authorization scheme in place, there's no real way to determine the unimplemented intent of some company in a way with any certainty. It's Orin Kerr's "gate-up-gate-down" theory - you need to have a gate in place to start with, instead of just a space where a gate can go or the assumption where a gate should be to figure out whether the gate is up or down, and without that determination one cannot meet all of the elements required to prove a violation of the statute. I wouldn't even consider this "hacking" really. If prosecuted a defense attorney familiar with both the technology and the admitted niche area of computer crime law can readily conduct some very effective cross-examination against whoever the state is bringing out as a witness. The government does frequently rely on the lack of tech-competent and accessible counsel as a way to exert coercion (and usually resulting in a plea), and it doesn't help that the layperson has a very difficult time figuring out what qualities constitute competency when looking for attorneys (hence the enduring popularity of jingles since being memorable is frequently mistaken for being competent), but they are out there.

SoftTalker 3y ago

At this point I would not apply for a job if the employer used a third party online service. Seek out employers who do their own hiring and talk to candidates face-to-face. If they steer you to one of these third party services, send your resume by snail mail directly to the HR director with a cover letter highlighting all the data breaches such as this one, LinkedIn, Indeed, etc. You'll stand out as someone who pays attention.

alwa 3y ago
Not to be pessimistic, but consider the applicant pool MrBruh targets here. One wonders how widely people with the sort of research skills and communication habits you describe are represented in the population applying for a fry cook position at a Checkers franchise. Or even amongst the franchisees themselves... And for that matter, how that kind of initiative would be received by your potential future manager at the drive-thru. I feel like I sound a little patronizing, but my broader point is it’s not other people’s job to be responsible for this kind of data security, especially in a relationship so imbalanced as that between a job seeker and the potential employer who offers only one pathway to gainful employment. As to the remedy you propose, I’m reminded of the inimitable @patio’s Seeing Like A Bank [0], where he points out that banks (like other firms) use techniques like the paper letter that you described as subtle shibboleths to distinguish people who are likely sophisticated customers from the rank and file. [0] https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/ https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/

ashu1461 3y ago

Firebase is like a half baked product which lures people who are just starting out .It helps build products which can quickly go to market, but then once you start to scale, a lot of their products like firestore, firebase auth have basic features missing

mmsc 3y ago

Stepping aside for a moment and thinking about the scope of this, I think it’s a good example of why technological diversity is something to long for. If Chattr can be pwned like this so easily, they likely have many much more serious issues which in turn will affect half of America’s fast food chains.

Aachen 3y ago
I've heard it told that's why BIND and unbound exist alongside each other

ysofunny 3y ago

then again, the people in potential harm's way seem to be the poor sods trying to get hired by these companies for a meager hourly wage I don't see how this "p0wns" the companies themselves

simonebrunozzi 3y ago

> No contact or thanks has been received back so far WTF.

troupe 3y ago
I'm curious if the best monetary approach for a white hat hacker would be to show them the problem, give them time to fix it, and then give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed). The idea being the showing what you have found on other sites has marketing value for a white hat hacker, but had the company hired you to discover the flaw, you wouldn't be publishing it.
- jacobsenscott 3y ago
  The best approach is not to do it. Demanding money from someone that didn't hire you is never ethical - just childish. Would you like it if I showed up at your house, mowed your lawn, and then started banging on your door demanding $100 for mowing your lawn? Also, what marketing value - if you're just pwning random web sites rather than getting hired to test a site's security you aren't in any market.
  - z3phyr 3y ago
    The grass in the lawn may not be that dangerous to other people. However, if your house is emitting radiation, and a hero breaks in to clean it up for the sake of other people you service, (because the town does not need to wait for you to hire someone) the hero deserves a reward and the owner of the house deserves punishment.
    - hnfong 3y ago
      Unless the "hero" is law enforcement or some other government agent with a warrant, he will likely have broken a bunch of laws by breaking into a person's house uninvited, and not very likely rewarded. That's modern society for ya.
  - 3y ago

pierat 3y ago

And folks, this is why you sell your exploits to the highest bidder. Being "good" and giving companies free work is a HORRIBLE idea. They're never gonna pay, or even than you. If they're not willing to treat security researchers properly, I see no reason to return the favor. Remember security groups: if your company wont pay, there are others that will.

mapster 3y ago
Did you not see the part where applicants info was exposed? Make a few bucks by selling their data to <whoever> is 10000x worse than the chatr dev not securing the files.
- qznc 3y ago
  Could have submitted it to https://haveibeenpwned.com/ https://haveibeenpwned.com/ Chances are some blackhat already discovered this data and sold it.
- pierat 3y ago
  Selling exploits (the words explaining how to) is a 1st amendment protected act. Actually downloading the data from a hack and selling it is expressly illegal. Now if the person/group you're selling to expresses illegal actions as a result, you have a duty not to sell. So, don't ask, and dont tell! The real solution: companies all should allow for bug bounties and good-faith reporting and proper compensation for reported issues. But as long as they don't another group WILL pay.
poisonborz 3y ago
Sadly this is the right direction. With time, companies will learn, but we can all be afraid on what world they will push for to solve this (it will be less like "put more resources on proper opsec" and more like "browser attestation").

yieldcrv 3y ago

does this count as authorized access under CFAA? I’m curious what the limits are

pstuart 3y ago

I was looking at jobs for my son at Safeway supermarkets and lazily put https://www.safeway.com/jobs https://www.safeway.com/jobs in the browser. That redirects to https://www.careersatsafeway.com/desktop/home https://www.careersatsafeway.com/desktop/home -- which is very much not about jobs at safeway -- appears to be an Indonesian gambling/gaming site. Safeway.com has zero email contacts published and expects communication to be via phone call or chatbot. I found their domain admin email and sent them info with no response, and no change to their site behavior. This makes me think that they might be ripe for more monkey business but that's not my thing. Oh well.

iamhamm 3y ago
Hi Albertsons/Safeway VP of Security Engineering here. Thank you for disclosing this. I’ll have it fixed along with the fact our VDP submission link is missing from the Safeway site. Here it is for future reference https://albertsons.responsibledisclosure.com/hc/en-us https://albertsons.responsibledisclosure.com/hc/en-us
- alright2565 3y ago
  Please also add a security.txt file so that it is not necessary to navigate through a labyrinthine site to get this information. https://datatracker.ietf.org/doc/html/rfc9116 https://datatracker.ietf.org/doc/html/rfc9116
- forward1 3y ago
  It's definitely not fixed: the (likely malicious?) redirect still happens for me now. How embarassing (for you).
- pstuart 3y ago
  Hi! I was wondering if it would get noticed here ;-) But as noted elsewhere, it's still not fixed. And the link you shared is a good thing but is that going to be easy to find to someone who sees an issue with your websites? I'd recommend putting a link here: https://www.safeway.com/help/contactus https://www.safeway.com/help/contactus
- 3y ago

Aurornis 3y ago

> Timeline (DD/MM) > 06/01 - Vulnerability Discovered > 09/01 - Write-up completed & Emailed to them > 10/01 - Vulnerability patched Note those dates are DAY-MONTH. At least they patched it within a single day. I find it funny that the author found a massive vulnerability but chose to wait a couple days to report it so they could finish a nice write-up. Reminds me of my experience with HackerOne: We had some participants who would find a small vulnerability, but then sit on it for months while they tried to find a way to turn it into a larger vulnerability to claim a higher prize. Then when they finally gave up on further escalation and submitted it, they'd get angry when we informed them that we had already patched it (and therefore would not pay them). The incentives in infosec are weird.

jacobsenscott 3y ago
> The incentives in infosec are weird. Well - only the amateur infosec world where you try and force someone to be your client after you do the work, and then get butthurt when they don't become your client. In the professional infosec world the clients choose to hire you first.
UberFly 3y ago
> "No contact or thanks has been received back so far, I will amend this comment if/when they do so :)" They couldn't even be bothered to send a proper thank you.
- sailfast 3y ago
  To be fair... that's today. Guessing something might be in the works but it's 1AM Eastern Time in the US.
MrBruh 3y ago
I feel I should clarify, the writeup was not the blog but rather than vulnerability disclosure report (PDF) I sent to them directly.
- Aurornis 3y ago

habosa 3y ago

Sad that in 2024 people continue to set their Firebase security rules to be wide open. Back in maybe 2015-2019 that was excusable because that was the default but now it’s just lazy. Don’t expose your database / api / blob storage bucket / etc to the public! It’s not that hard to do it right, or at least “right enough” that you can’t get owned by someone scanning a whole TLD.

thatwasunusual 3y ago
> Sad that in 2024 people continue to set their Firebase security rules to be wide open. [...] Don’t expose your database / api / blob storage bucket / etc to the public! What is additionally sad, is that your comment - in 2024 - is being downvoted.
araes 3y ago
Partially, this seems like an issue with Firebase, where the defaults are possibly set on something that is not sane from most professionals perspective. Having slightly tried Firebase, I can also say that the Google cloud tool environment was really confusing the last time I tried using it. Just this enormous maze of switches, and dials, and widgets, like a lot of the popular IDEs. If the defaults are not set on something sane, and I, a personally evaluated competent tech user with some background in security (fed work) can barely find the settings, then most normal humans with limited grasp of those issues probably won't even know to look.

sampli 3y ago

If you view this page in Safari, it’s just a text document

black3r 3y ago
Since this is a post about security, this is your daily reminder to update your browser to stay safe on the internet. Up-to-date versions of Safari support AVIF images, and there have been multiple RCE vulnerabilities with known exploits fixed last year in Safari...
- deleted 3y ago
  [deleted]
- hospitalJail 3y ago
  iphones are the scariest device to do anything important on. I had a moment of total freakout when I realized the person across from me at lunch had an iPhone on the table. Actually he had an Android, and we continued talking like no big deal. To be clear, we were talking about a 10-100M dollar problem, this wasnt small potatoes. Too many exploits, I can't imagine having anything of value on an iphone.
  - novagameco 3y ago
    > I had a moment of total freakout when I realized the person across from me at lunch had an iPhone on the table Why?
  - buffington 3y ago
    Please, tell us more about each of these points you make, in detail. I'm compelled to know.
MrBruh 3y ago
It is using the Avif format (for images) for a 2x compression bonus over PNG while still maintaining a higher quality over JPG. If you can't view the images then it means you are likely using an outdated browser, all current versions of browsers support it (afaik) except Internet Explorer.[0] ...And if you are using Internet Explorer, then god help you. [0] https://caniuse.com/avif https://caniuse.com/avif

thekombustor 3y ago

At the time of writing, accessing the link returns a bunch of prometheus metrics... interesting.

MrBruh 3y ago
Shouldn't anymore, was a "pushing to production" moment. I wanted analytics since my site was getting flooded \w traffic.
- user3939382 3y ago
  Are you not concerned with the CFAA?

Michaelhartnett 3y ago

[dead]

zharknado 3y ago

From Eva’s post: > we didnt know much about firebase at the time so we simply tried to find a tool to see if it was vulnerable to something obvious and we found firepwn, which seemed nice for a GUI tool, so we simply entered the details of chattr's firebase Genuinely curious (I’ve no infosec experience), wouldn’t there be a risk that a tool like this could phone home and log everything you find while doing research?

MrBruh 3y ago
Sure but it's FOSS, so audits are pretty easy. Plus as part of the pentesting I watch the network stack in Firefox sometimes so I would tell if it was trying to exfiltrate date
bushbaba 3y ago
Yes, but that might also be caught by infosec users of said tool who have things similar to “littlesnitch” alerting them to the outbound API call attempt.
- genewitch 3y ago
  there used to be windows GUIs for forcing new connections to ask, but i haven't seen anything like it. I can't recall the name of the one i used to use, but it scored perfectly on shieldsUp - oh, Zone Alarm. Littlesnitch iirc is macos only, but it sounds lovely for this sort of thing.
  - hexadec 3y ago
    You can set this with Windows' default firewall. Setting to strict mode with no whitelist causes a UAC alert every time a process attempts communication.
  - Hrun0 3y ago
    You are looking for simplewall
  - flexagoon 3y ago

andrecarini 3y ago

How much would this leak go for in the darknet?

crooksey 3y ago
Deciding to sell this on the darknet is a life changing decision, white to black overnight and imagine not really something most would contemplate. Payment in BTC probably from an already compromised address so loads of factors. Probably an easy + quick 2BTC though
- mathverse 3y ago
  This is an easy and obvious exploit so an attacker would need to extract the data from all sources ASAP. High risk of getting caught and ending in jail to be honest for measly 2BTC. Not worth it for anyone in the US or even Europe.
  - gretch 3y ago
    > Not worth it for anyone in the US or even Europe. Lots of crimes are not "worth it". And yet criminals do it anyway. Because criminals (nor most humans) are not perfectly rational. There's routinely reports where people try to rob a gas station with a loaded gun - a $200 haul if everything goes perfect. It doesn't and now they have 10 years in jail...
    - leoqa 3y ago
      One crime is skilled, one crime is not. The skilled person has more options to earn 2BTC than the unskilled person does to earn $200. If you’re a felon and unskilled you’re as desperate as it gets in America.
      - gretch 3y ago
        Yeah Sam Bankman Fried probably had the skills and connections and trust to coast through life. But instead he chose to commit the most egregious of financial fraud. I would strongly argue that almost all crime is irrationally - take it to the game theory strategies of tit-for-tat and such.

counterpartyrsk 3y ago

This is the most perfect blog post. ZERO fluff, straight to the point. Win.

az226 3y ago
Except it is almost perfect — it would have been perfect had he been thanked and rewarded. Of course that is not on him, but felt so disappointed reading that at the end.
- jb1991 3y ago
  "Perfect" is referring to the blog post, not the outcome.
- brojo_ 3y ago
  It's been less than 24hours. I don't think any company works at that speed.
  - davedx 3y ago
    Oh come ON. Sending an email acknowledging the report and saying "Thanks so much for reporting this - we will look into it ASAP" takes about 10 seconds
deleted 3y ago
[deleted]

deleted 3y ago

[deleted]

theonething 3y ago

> If you grab the list of admin users from /orgs/0/users, you can splice a new entry into it giving you full access to their Administrator dashboard. I'm not clear on this. Splice a new entry into what? The list of admin users? And then do what with it?

iamflimflam1 3y ago
Once he had access to Firebase (the database) he was able to add an entry to the list of admin users. With that done he could login as an admin user to the website and access the administrator dashboard.
urbandw311er 3y ago
I read this as worse - splice being a client side JavaScript function to add items to arrays. My concern here is whether the “is admin user” perms checks were done solely on the client side and not enforced on the API endpoint!
- missblit 3y ago
  He's using the word as meaning "insert", not the JS function. He is saying he inserted a new row into a database to get admin access to a dashboard. 'splice" means to join two things as if by weaving them together. If used as "splice into" or "splice in" there is a sense of breaking something apart, inserting something into the gap, and joining it back together. This all makes a bit more sense if you look up the etymology which was about ropes (despite splicing being about uniting, it's closely related to the word 'split').
- specialp 3y ago
  It doesn't look like an IDOR attack. The poster says they had read/write access to the Firebase DB with their Firebase user they registered. It appears they had the database entirely open to all Firebase users. I agree the usage of "splice" in a JavaScript context does imply that they had an IDOR exploit

8organicbits 3y ago

I would have stopped once I confirmed the leaked keys were valid. Looking at what types of data you had access to wasn't required. Downloading plaintext passwords of other people is probably too far. Impacted users may need to be notified about a breach. If needed, create an account of your own and target only that. If there was a pentester agreement, safe harbor, or other protection that's different. Be careful out there.

denysvitali 3y ago
I would argue that looking at the type of data you're dealing with is actually a very important part to assess the impact, but looking at the data itself is beyond this part. Knowing that they store passwords in plaintext is a security issue on top of the R/W credential
- 8organicbits 3y ago
  Type of data is very important to assessing impact. But that doesn't grant anyone authority to breach customer data. The company can assess impact.
Topfi 3y ago
> Looking at what types of data you had access to wasn't required. Downloading plaintext passwords of other people is probably too far. Impacted users may need to be notified about a breach. If needed, create an account of your own and target only that. I'd argue that it was absolutely necessary to gauge the severity of this misconfiguration and furthermore, that Chattr.ai must contact every affected user, not MrBruh. Their configuration allowed anyone to create an account and access plaintext passwords. There is no telling whether and how many outside of this disclosure have previously accessed this information and may intend to use it. This was negligence of the highest order, and it shouldn't be on the one finding and reporting this issue to rectify it.
- 8organicbits 3y ago
  > absolutely necessary to gauge the severity of this misconfiguration Possibly. But what's the legal basis that allows random external parties to make that determination? Report the leaked credential, and let the company assess impact. The problem is that pivoting to accessing user passwords may cause the companies to spend money notifying customers and harm their reputation. If they want to pursue legal action, those are clear damages. > Chattr.ai must contact every affected user, not MrBruh. Agreed, a pentester directly contacting impacted users would increase the risk legal gets involved. > There is no telling whether and how many outside of this disclosure have previously accessed this information Typically the company would review logs to determine that.

deleted 3y ago

[deleted]

lulznews 3y ago

>With an upbeat pling my console alerted me that my script had finished running Forget the pwn how do I do this Also, HN used to think this was cool now there are 20 posts blaming the hacker…

ginko 3y ago
I have this in my .bashrc beep() { if [ $? -eq 0 ] then file=/usr/share/sounds/purple/receive.wav ret='true' else file=/usr/share/sounds/purple/alert.wav ret='false' fi (aplay $file 2>/dev/null >/dev/null &); $ret } Can be called like this: $ command ; beep Depending on the return value it'll give a different alert. It preserves the return value so you can still chain other dependent commands after it. This depends on the libpurple sounds to be where they are (works in ubuntu at least)
mmsc 3y ago
>Also, HN used to think this was cool now there are 20 posts blaming the hacker… I'm not sure whether it's HN thinking this is uncool (it is cool!) or it's HN taking the unfortunate realistic position that this type of stuff only gets the reporters into trouble, after seeing it happening time and time ago. People doing cool stuff get in trouble, and it's sad to watch.
deleted 3y ago
[deleted]
binwiederhier 3y ago
I suggest using ntfy [1] for this. It's open source and self-hostable. It lets you push notifications to your phone like this: ./myscript.sh; curl -d "Script done" \ ntfy.sh/mytopic Disclaimer: I am the maintainer of ntfy. [1] https://ntfy.sh/ https://ntfy.sh/ + https://github.com/binwiederhier/ntfy https://github.com/binwiederhier/ntfy
FrustratedMonky 3y ago
Yeah, what happened to the "Hacker" in Hacker News. (responding to people blaming the 'hacker', not the sites). This guy just grabbed publicly available information, and by 'public' I mean put out onto the web un-protected, just put out there. If you can just basically browse to something, is it really his fault for finding it. It's like if I have a front door on my house, and just in the front hallway I have a huge naked picture of my wife. If I leave the door open, can I get mad at pedestrians walking by, for seeing the picture. Maybe they walkup to ring the door bell just to get closer look, walking up to the door, but not going in, is allowed.

Sparkyte 3y ago

Ethical hacking is a good thing. Nice to see someone doing good.

deleted 3y ago
[deleted]
refulgentis 3y ago
They reworded things since yesterday: Before, one collaborator had them in a chat sneering about chattr, checking their Javascript, then getting a GUI pwn tool for firebase. i.e targeted attack with malice, followed up a blog post wildly exaggerating what happened, with a disclosure policy of 'we emailed them once and they fixed and didn't email us back so we'll just publish' Only spelling this out because it's important to point out the significant gaps between white hat culture and these actions, not only for the authors, but for people who are inspired and want to practice it
- internetter 3y ago
  > Before, one collaborator had them in a chat sneering about chattr "Wow this thing looks crappy" > checking their Javascript "I wonder if it is crappy" > then getting a GUI pwn tool for firebase. "Huh, it seems crappy. Let's just check to be sure" > with a disclosure policy of 'we emailed them once and they fixed ...' "Well, this thing is really crappy. we don't want to harm people. Let's tell them about how crappy it is to avoid harm" > and didn't email us back so we'll just publish' "They fixed the thing, nobody will be harmed. We still think it's crappy so let's talk about it" Why wouldn't they go public at this point? They've gotten nothing else out of it, and since the issue has been fixed there is zero harm to customers. Do you propose they go like "Hey company, we found this really embarrassing thing you did. I see you fixed it now, so can we talk about it" silence "Oh well the company didn't say anything so we won't talk about it. So sad" In what world do we not hold companies accountable? In what world do we blame the people who find these issues for free?
  - refulgentis 3y ago
    Note I'm not claiming disclosure is bad, but rather, this is a copy of a copy of a copy of a copy of a copy of a copy of how professionals handle these situations, to the point there's nothing left except the "1) pick a target 2) email them 3) write a blog post when fixed" parts.

bikamonki 3y ago

You are a good human. Seems they had not tweaked the database rules correctly, maybe even left the default setup! That means you could have executed this: Firebase.database().ref('/').set('All your data is gone'). Better yet, download the whole DB and then: Firebase.database().ref('/').set('I have all your data, pay me to get it back').

deleted 3y ago
[deleted]

lwhi 3y ago

It seems crazy that no thanks or recognition has been given. Is this because doing so might be seen as an admission of liability, and could be used in any legal cases that are brought?

didntcheck 3y ago
To give the benefit of the doubt, it appears he only contacted them less than 48 hours ago. Their first priority should correctly be to fix the problem. They could be discussing a bug bounty right now and just haven't finalized the email yet
- pge 3y ago
  American readers may not have noticed that the dates are in European DD/MM format, so they thought disclosure was Sept 1 rather than Jan 9.
  - MrDunham 3y ago
    I 100% saw it as MM/DD and was wondering why it took them three months to write up the vulnerability and a month to patch it. Thanks for the clarification
- zopa 3y ago
  “Thanks for coming to us with this, we’re looking at it right away” wouldn’t take a lot of time or commit then to anything