11 ms·

What's inside the QR code menu at this cafe?

464 points by captn3m0 2y ago

laeri 2y ago
I am confused, they didn't contact the company at all and just disclose this publicly? Very immature handling of a vulnerability finding.
- lordgrenville 2y ago
  The author says "I refuse to believe they’re unaware of this. This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care." Agree that this is an uncharitable way of looking at it.
  - appendix-rock 2y ago
    Yep. It’s just working backwards from some pre existing very negative worldview.
    - aitchnyu 2y ago
      Its a justifiable worldview. I'm an Indian dev and I've seen obvious backdoors like these added to the backlog as a low priority bug. If somebody spends time on this, that means features are being delayed and you are rewarded less. I've worked in lambda web editor (not in Git) and my lead considered replacing sql injection with parameterised queries was a distraction/insubordination. Cant wait till audits, data breach insurance and imprisonment becomes the reality.
  - AtNightWeCode 2y ago
    Could be as simple as no auth in debug builds and then deployed it by accident.
    - JKCalhoun 2y ago
      I don't mean to pick on your comment, but to respond to a prior comment, you are beginning with a very positive world view and interpreting the events from there. Lazy API that did not vet a simple backdoor? Good coders but accidentally pushed the debug version of the API? I am going to have to say the second option feels less likely (yes, I have been called cynical).
      - AtNightWeCode 2y ago
        Different confs in the same repo. Many CI/CD tools will pick debug/dev conf by default if nothing else is set. It was just an example. Maybe they knew.
  - deleted 2y ago
    [deleted]
- desultir 2y ago
  is it really a vulnerability if the entire thing is open by design?
  - inquisitor26234 2y ago
    same thoughts, annual reports of larger companies have more dense figures than these too.
  - filcuk 2y ago
    Who says it was? Why would they willingly give out their customers' and customers' customers data to any anonymous person or a bot? More likely a bad oversight
    - imiric 2y ago
      For 3 years? That would mean that no developer has ever raised these issues with management, to speak nothing of an actual pentest being conducted. No, this is not some obscure security hole they forgot about. This is plain incompetence and/or deliberate design decisions. I agree that full public disclosure like this is irresponsible, but exposing issues like this to the public is the only way for such companies to make a change or, preferably, lose business and shutdown.
    - TeMPOraL 2y ago
      Because they don't care, and their customers don't understand any of this shit? It feels like the usual case of vendors buying service to better exploit the users, and themselves getting burned and/or exploited by that service too.
    - cwillu 2y ago
      This is “the tire shop doesn't have a torque wrench” level shit. If it's an oversight, it's an oversight due to incompetency, not because a good team just happened to miss something in a crunch. Another possibility is that the issue was raised and management said to fix it later, and because software “engineering” isn't a real engineering field that holds its practitioners to any duty of care, those responsible (the engineers) just went along with it.
- globular-toast 2y ago
  If you discovered an incompetent healthcare provider was prescribing antibiotics for every condition would you "contact them privately" or contact the relevant authorities? Private disclosure is for when you believe the company cares about security but made a genuine mistake. For the company in the OP it would be more like free education in fundamental privacy and ethics. They're not entitled to that. Name and shame.
  - appendix-rock 2y ago
    Sure, but what you’re describing is not what is being suggested. Responsible disclosure typically involves disclosing publicly after a reasonable period of time.
    - globular-toast 2y ago
      Right but would you afford the same opportunity to the healthcare provider? You'd contact them privately and expect them to go and learn why over prescription of antibiotics is a bad thing and change their ways? Of course you wouldn't. You'd go to someone who cares. In healthcare there are ways you can report it without naming and shaming publicly, but how could the author do that?
    - TeMPOraL 2y ago
      Why? Why should they be the responsible ones, when the well-funded, well-connected service provider is acting like the fly-by-night startup (that they probably started as)? There's little public benefit in responsible disclosure here; all it would lead to is the whole thing being swept under the rug with some trivial "fix". There's lots of public benefit in immediate, wide disclosure - the scramble to fix this under pressure from vendors before potential abuse, and any real or imagined attempt at abuse, and subsequent lawsuits, would go far towards educating people and the industry about privacy, security, and bad business practice. It's a nice low real damage, high publicity case. It's not like this stuff is new. But without serious pressure, the businesses will never learn and never stop making or enrolling into such systems. Anyway, if it happened over here in the EU, I'd do the responsible disclosure thing and give a full, detailed advance expose to the local Data Protection Authority. (And if I sound adversarial, then consider that neither the vendor developing such systems, nor the venues using them, are doing it in the interest of the customers.)
- prmoustache 2y ago
  Is it a vulnerability when it is obvious the company do not care about security?
  - shreddit 2y ago
    Yes. Because who at the "company" does even know about this? Maybe just some coder who wrote it. But the legally liable CEO? Maybe not.
    - prmoustache 2y ago
      That is his job to make sure he employs people who take care of this and that the services they sell are audited by an independent organization.
    - deleted 2y ago
      [deleted]
    - friendzis 2y ago
      > Because who at the "company" does even know about this? Everyone who designed engineering requirements, technical requirements, test plan, everyone who wrote technical specifications, everyone who performed traceability. It was all approved by security engineers and management. > The company was founded during the pandemic when contactless dining became popular. There were tons of people intimately aware of the issue, yet for four years nobody cared.
    - Brian_K_White 2y ago
      Who at the company gets to keep all the money?
- AndyMcConachie 2y ago
  Disagree. Most likely the company will blame them for trying to help. Also, if the company is so incompetent that they allow this why bother. He's not getting paid to be their test engineer.
- yuye 2y ago
  And to add that he tried out the exploit on unknowing participants. It would be better to try this with a friend in-the-know at a separate table. It makes me think he did it more as a practical joke than testing his exploit, especially because he mentioned they were "not-too-intimidating-looking guys". I'll admit it is a bit funny and the damage caused is tiny(just the price of the food). However, things like this do harm the reputation of bug-bounty hunters.
  - lopis 2y ago
    He could have just tried it on his own table (order on the phone, and then on the laptop through the vulnerability) and avoid having to a) bother others, b) waste food. The result would have been the same.
- 4ndrewl 2y ago
  This is hardly a 0-day vuln exploit. This works as designed (and presumably design has been signed off etc)
kapitanjakc 2y ago
I found similar vulnerability in Bus State transport facility of government, where you can get list of everyone who did reservation online. You can get their gender, age, name, mobile number. I simply reported it to their website's support email and state cyber cell. This was 7 years ago, that vulnerability still exists.
- jeroenhd 2y ago
  This is why security researchers (threaten to) release this kind of information publicly. Reporting security issues doesn't fix anything until other people learn the details.
krab 2y ago
Nice find! There's a problematic but not critical personal information leak, a mild business intelligence leak and that's about it. > They could keep this script running for months, even years, creating awkward scenes and uncomfortable conversations at every restaurant across the country. If that's about the worst thing you can actively do, then it's only about the data leak.
- sschueller 2y ago
  Aren't phone numbers being leaked if you iterate over the tables?
  - krab 2y ago
    Yeah, that's the PII leak.
- McDyver 2y ago
  "Why were you at X when you told me you were at Y? And why did you order for 2 people? Why have you been going there for the last Z months?" "By following the pattern of when you were there and what you ordered, I found the other person's details too"
- zekica 2y ago
  No, that's the most inconvenience you can cause. There are worse things you can do: target specific people with spurious orders, cancel everything they order, or if you want add random items to every order, making the entire system useless.
  - jatins 2y ago
    people are underestimating the havoc this could create in a country like India. Imagine serving chicken at a table that is strictly vegetarian (many people in India are vegetarian due to religious reasons), will lead to a lot of outrage.
    - sjamaan 2y ago
sschueller 2y ago
A guy went to prison for doing this with AT&Ts public subscriber data. The media didn't do him a favor by calling it a hack.
- globular-toast 2y ago
  I almost got into big trouble at school for "hacking a teachers email". I guessed their email address (they were systematically generated) and sent an email. It's true you can get into trouble for this, but we need to all take it upon ourselves to make sure this doesn't happen. If this guy got into trouble I would hope every software engineer would be up in arms defending them.
  - umbra07 2y ago
    you mean you guessed the systematically generated password, right?
    - mcpeepants 2y ago
      > I guessed their email address [...] and sent an email the old "HELO" hack
  - antimemetics 2y ago
    Nah I better err on the side of caution with this - plenty of examples in history where life’s were utterly destroyed even though every sensible person was ok their side - snowden is just one extreme example but there are many others.
  - dplgk 2y ago
    My 8th grade computer class teacher yelled at me for hacking the computer because I was rearranging the icons on the desktop.
  - necovek 2y ago
    It's not as simple: if you accessed something simply because it was badly protected yet you were obviously not supposed to access it, it's more of a grey area. I mean, imagine an uber-hacker for whom many a network is trivial to break in: they can always argue how it was insufficiently protected. You accidentally stumbling on something unprotected generally clears you from any liability as long as you stop as soon as you notice it. Code of conduct for white hat hackers is to explore but not abuse, and report as soon as they have enough clarity on the issue. But there is no legal basis for this avoiding any liability except if a company runs an official bounty program. In that sense, the OP author could face hacking charges if India has similar laws to the rest of the developed world, and the author doesn't even have the "well intentioned" for their defence since they never reached out: the only defence they have is they did not attempt to profit off it. IANAL, though :)
yawnxyz 2y ago
reminds me of this Aussie cleaning company's website that forced you to create an account to take an order. With a couple of clicks on the web app, you'd encounter a bug... and then you can see every single person's orders, email, and personal addresses. And it was my partner who discovered it (she was struggling to order service through the website bc it kept failing). Oh and they also never charged us for service despite multiple emails asking them how we should pay (somehow we were able to order service through the site but never paid?) Clearly they're not a serious company...
- prmoustache 2y ago
  Isn't service taken into account in the price of the meals?
  - grues-dinner 2y ago
    Probably depends if the cleaning company is bringing meals because it's an extra service they provide, or the place is such a mess they they think the customer deserves some charity?
rapnie 2y ago
> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.
- globular-toast 2y ago
  As a fully capable person I can't stand being waited on. For me the peak ordering experience is I choose an item from some written menu with prices on it, ask for said item and pay exactly the price written on the menu. Then I either take item immediately or come to collect it later to take it to the table myself. When I want to leave I just get up and go without the stupid ask to know how much I need to pay then ask again to actually pay with expectation that I pay more than what was asked like it's my choice to pay but really it isn't.
- gibolt 2y ago
  Even worse when the weird ass website has links to multiple PDF documents to download. Then you find out all the items you looked at aren't available when the waiter stares blankly at you about your order. Turns out the dinner menu requires horizontal scrolling on the page to find.
  - rapnie 2y ago
    For me peak worse is tables where you get dealt with a single iPad, even when visiting with six people. Which you then get to pass along. And then the 'tech experts' take care of ordering for those who don't get computers, like many elderly folks.
  - OvbiousError 2y ago
    I prefer the pdfs. Most of the time you can zoom out enough to actually have a sizeable part of the menu visitble instead of 3 items at a time.
- PUSH_AX 2y ago
  I’m not sure if this could be considered “peak”. The ratio of waiting staff to customers is an obvious bottleneck. This inefficiency is simply accepted and not even really thought about, it’s just the way things are. But one thing I can say for this tech is it fixed it and the difference is noticeable.
tomw1808 2y ago
Next up: "How I became a millionaire by consulting restaurants on Menu items and targeted Text Message Ads" ... Seriously, its a PII leak and it should be reported. And since you said Google is an investor someone (theoretically) should care.
- captn3m0 2y ago
  I looked around to find a security contact at DotPe, and couldn’t find anything. Hopefully, this HN post raises enough alarms.
  - tomw1808 2y ago
    The website really seems to follow Google's best practices on human interaction: hide as much as possible. If it wasn't so sad, it would be almost funny that their Terms & Conditions page errors out (for me). The whole page looks pretty broken and like the landingpage is an afterthought... Anyways, the closest to a contact us is this what I found (after looking for 15 seconds and randomly clicking links) https://dotpe.in/contact-us.html https://dotpe.in/contact-us.html maybe that helps to get in touch at least...
  - gorbachev 2y ago
    The fastest way to get in contact with DotPe would be to contact their biggest customer and informing them of this. They'd be on the phone with DotPe within an hour. Good thing the APIs can be used to easily identify that company. /s
Elfener 2y ago
From the title, I thought this was going to be about a very big QR code (presumably with a comically long URL).
Bengalilol 2y ago
Now, that went rogue quite fast and easily. I still find it confusing when some dev opt for the "let's not think about security, tokens, POST requests and whatever". I am sure some companies using that service will ask for more closed doors before everyone can lookup their revenues. That's one big example of a non technical vulnerability based on a 101 technical principle.
steinuil 2y ago
I like to scan the "specialized" bar/QR codes I come across in my daily life in case they're not just URLs. Sometimes I find some interesting stuff and possibly some opportunities for mild exploits. The other day I was at burger king. They allow you to refill your drink as many times as you like within 60 minutes of purchasing it, and the way this restriction is implemented is by having you scan a QR code they print on your receipt at the drink machine. I scanned the QR code with Binary Eye (android app that reads all sorts of barcodes, highly recommended). It contained some numbers I couldn't immediately recognize as interesting, a timestamp in a format similar to 202409231049, and a UUID. Now, the UUID is probably the ID of the order in their internal system, so the question is: does the drink machine only read the timestamp or does it also use the UUID to query the internal system to re-validate it? Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills?
- TeMPOraL 2y ago
  > Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills? Well, can you? :). It's the obvious next thing to try, given that Binary Eye is conveniently also a barcode generator, not just a scanner.
  - steinuil 2y ago
    I know, but sadly I did not have enough time to stay there for more than an hour and try it out.
- always_imposter 2y ago
  >Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills? I'm hoping nobody is this naive to let your client have mission critical info to implement something as crucial as giving a discount or refills in your case. It would be just be an extra column in your db table, the only identifier available to the user should be just the UUID, along with some identifier.
  - steinuil 2y ago
rococode 2y ago
Not to be a party pooper, but posting detailed financial analysis of the exact sales data of a multi-million dollar business using numbers obtained through an obviously overlooked backdoor seems like a very bad idea. Haven't people have gone to jail for less? (iirc "but it was an insecure API" has not held up in court in the past) On a more positive note, I've used a QR menu recently and it really is a game changer. Scanned a code, pressed a few buttons, and my food was there in minutes! Looking forward to seeing it more often, especially in places where you're not looking for stellar service.
- 2Gkashmiri 2y ago
  eh. this is india my dude
- Tepix 2y ago
  > Looking forward to seeing it more often Not sure if you're serious after reading the paragraph where he ordered food for another table ;-)
  - snypox 2y ago
    When implemented properly, it’s a convenient system. I enjoyed using it at the Stockholm airport a few months ago.
    - vesinisa 2y ago
      What makes you think that system was implemented securely?
  - rococode 2y ago
    Haha :) Looking forward to seeing it more often... with proper security
- hoseja 2y ago
  "obviously overlooked backdoor" This is the front door. It's not even open, it's taken off the hinges. Scratch that, there never was a door in the first place, just a gaping hole right to the street.
2Gkashmiri 2y ago
this is fun because i can confidently say, "bureaucracy" runs on adverts. Whatever flashy, big banner photo op you can find, people lap that up. why? because of the immense population of india. EVERYTHING works here. You can spend countless hours trying to break your application, finding holes but who cares. Police cares about financial fraud. Did someone clickbait you into swindling money from you? well they will pounce on it because they will extract their cut from all involved and it gives them nice PR on the daily newspaper. PII fraud or vulnerability, eh well. whose gonna notice? we have enough on our plates. second thing. whatever government is doing, they protect themselves at all costs. they WILL throw you under the bus if it protects their interests. why? because of the massive population, jobs are scarce, people get college degrees and stuff to pad up their resumes because employers, govt or private REQUIRE documentary evidence you did something. doesn't matter your skills,y ou have the papers or not. this dotpe company, whatever its doing is indicative of the systemic problems in india. You have lots of people, lots of smart people, lots of dumb people and in the long run, bigger, cheaper, faster. that's all that matters
gyhnol 2y ago
> Armed with my two-week free trial of Cursor IDE, Makes this blog post sound like an advert for whatever this product is. Maybe the next big app for AI is to analyze web pages and scrub this crap out of otherwise decent articles.
- aulin 2y ago
  I think it was a sarcastic way to stress how low effort the whole endeavour required.
yas_hmaheshwari 2y ago
I know that Indian companies might not have a bug bounty program but you should get paid for finding such a big vulnerability And their CTO should take some blame for this. On the other hand, I agree with other comments that posting the whole financials of a company does not seem like a good idea PS: I really like your writing style. Subscribed your newsletter
- Wytwwww 2y ago
  > I agree with other comments that posting the whole financials of a company does not seem like a good idea Probably. But IMHO it's the right/moral thing to do, posting/showing how to access their client data is of course hardly justifiable.
thih9 2y ago
> Next time you're at a restaurant that makes you scan a QR code and enter your mobile number to order, I want you to remember that random strangers on the internet are looking over your shoulder and watching what you're eating. Isn’t this just sample size one? In other systems this information can be passed securely and not leaked later.
- TeMPOraL 2y ago
  Let's not forget though that these systems aren't made to make your ordering experience better (they do the opposite) - they're literally made to make it easier for more "random strangers" look over your shoulder and watch what you're eating. Strangers working for the vendor, working for the QR-menu solution provider, working for various marketing companies, etc.
  - deleted 2y ago
    [deleted]
dncornholio 2y ago
Scummy article to be honest. Also good reminder to not fill in your phone number online, ever.
- linhns 2y ago
  A better way would be to note down scammers numbers then fill those in instead.
qnleigh 2y ago
> I would have thought about privately disclosing these findings to Dotpe. But all the API requests are right there in plain sight... There are pretty common ethical standards about disclosing vulnerabilities privately before disclosing them publicly. I don't see how the obviousness of the vulnerability changes the situation. By warning the company, you give them the opportunity to remedy the problem before announcing to the world that anyone with a laptop can exploit it. Probably they were just hoping that nobody would notice, which is stupid of course, but now they don't have the chance to build up a better wall before the flood of fake orders that could cause real harm to the small businesses whose financial information you disclosed online. Perhaps I'm being too optimistic about how the company would respond, but I still think it's hard to justify not doing a private disclosure.
- mainframed 2y ago
  Adding to this, in some countries he is already past the gray-area to what constitutes as computer fraud. Pissing off the company, whose systems you accessed without authorization, is one way of getting to experience the full force of the justice system.
  - moralestapia 2y ago
    Curious. How is this, specifically, fraud?
    - cornel_io 2y ago
      People have been convicted of hacking for merely editing URL strings, under the theory that were knowingly accessing systems in ways that they were not supposed to. This would be similar. Whether or not that seems reasonable to us is a different matter, but basically it boils down to the fact that "they left the door unlocked" doesn't make it legal to walk in.
      - ensignavenger 2y ago
        I believe the conviction of which you are thinking was overturned on appeal, though.
yawpitch 2y ago
Well, this certainly is an interesting case of the abuse of servers to abuse servers. It’s almost teaching recursion. Please no one write that random script… f*king up high cash flow but ultimately usually pretty low margin businesses like these, while also pushing the poor staff around in a way that costs them time and very likely wages is really, really, really bad karma.
eleveriven 2y ago
A glaring example of how convenience can often come at the expense of privacy and security
siddharthgoel88 2y ago
From technical standpoint, I find the details interesting. However, this irresponsible disclosure of vulnerability troubles me. I am guessing that last year, Indian government has passed the bill of PDPA (https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf https://www.meity.gov.in/writereaddata/files/Digital%20Perso...) if I am not mistaken. Even though irresponsible disclosure of vulnerability is not explicitly mentioned in this Act, but I am pretty sure that such irresponsible disclosure are enough for the author to land into trouble. Leaving PDPA aside, as a Software professional I find this act kiddy and unethical. 10 years back I found a major vulnerability bug in an major multinational bank where I was able to see monthly statements of any person. I reported this to the bank and they took approx 1 year to fix that. I did not even mention about this bug to my friends or my CV till it was fixed.
- hoseja 2y ago
  If you leave the gate to your yard wide open don't be surprised to find kids playing ball there.
  - siddharthgoel88 2y ago
    Understandable in this case. But if the playground is of a developed nation (like US, Canada, Singapore, etc.) then unlikely that kids would be playing. In India, personal data is not yet taken seriously with both educated and un-educated people. It would take some time but I believe this realisation will come over time in people.
0xFEE1DEAD 2y ago
I was waiting for a "I disclosed the vulnerability and this is how they reacted" story arc but there wasn't one. Pretty disappointed OP went this route. The golden rule is to always disclose the issue and wait for them to fix it before you publish. The only exception to this rule is if the company isn't acknowledging, responding, or communicating in any way. In that case you'd wait around three months, send a follow-up email warning them you'll publicly disclose the vulnerability, wait another three months, and then publish it.
sylware 2y ago
A zero-click exploit targetting big tech web engines (blink|geeko/webkit).
hnbad 2y ago
Looks like the article was deleted and purged from archive.org. I wonder if anyone saved a copy elsewhere? From the comments it seems likely the author realized they may have accidentally committed a crime or at least done something that could cause real legal consequences for them and quickly destroyed the evidence. That's probably better than leaving it up but I'd wager it wouldn't protect them from any legal consequences publishing the article already made possible.
- greengoblin- 2y ago
  Check the thread here: https://x.com/deedydas/status/1838137082683728323?s=46 https://x.com/deedydas/status/1838137082683728323?s=46
- LukaD 2y ago
  It's still there on archive.org https://web.archive.org/web/20240923053856/https://peabee.substack.com/p/whats-inside-the-qr-code-menu-at https://web.archive.org/web/20240923053856/https://peabee.su...
- mpeg 2y ago
  According to Twitter they removed it due to a legal notice from Dotpe, author still seems to believe he was just accessing public data unfortunately which does not look good for him should Dotpe choose to take it further
deleted 2y ago
[deleted]
esquivalience 2y ago
https://archive.is/hVKzw https://archive.is/hVKzw
vijeet_ 2y ago
Why was this blog removed?
- aembleton 2y ago
  Maybe someone from the company behind the API got in contact with him.
- Wytwwww 2y ago
  https://archive.is/hVKzw#selection-853.37-853.44 https://archive.is/hVKzw#selection-853.37-853.44
  - sureglymop 2y ago
    Weirdly, the archival worked but the archived version can't be downloaded (Not Found).
- antimemetics 2y ago
  Author is afraid they conmitted fraud according to Indian laws
deleted 2y ago
[deleted]
coderbrahmin 2y ago
404 Not Found
layer8 2y ago
https://web.archive.org/web/20240923091701/https://peabee.substack.com/p/whats-inside-the-qr-code-menu-at https://web.archive.org/web/20240923091701/https://peabee.su...
- samanator 2y ago
  Thanks, apparently the article was taken down...
- mfkp 2y ago
  https://archive.is/Z7eIg https://archive.is/Z7eIg
jonplackett 2y ago
This is offline now. Can anyone do a recap of what was revealed without, without actually revealing whatever bad things were revealed.
- sureglymop 2y ago
  Yes. It was an article from someone who went into a café which had a QR code based ordering system. After ordering through the system they decide to open their laptop and inspect/look at the API of the system (a system apparently used across India). They realize that the whole API does not use authentication or authorization and start reverse engineering it/trying out various endpoints. They can then do things like ordering stuff for other tables, calculate earnings of restaurants, etc. They probably took it down because they disclosed it publicly directly instead of contacting that QR code based ordering service provider (which I won't mention the name of). Given that this is a substack which has a newsletter, this article has probably reached many people before being taken offline.
- deleted 2y ago
  [deleted]
voidfunc 2y ago
404 / Not Found. Looks like someone got to OP. Anyone have a cached copy?
- da44en 2y ago
  https://archive.ph/Z7eIg https://archive.ph/Z7eIg
jonplackett 2y ago
> This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care. Having a complete lack of any authentication and sequential IDs does seem like a design decision.
- shthed 2y ago
  Feels like a proof of concept demo app built by an intern.. to which the customer said: perfect! launch this in production tomorrow
andai 2y ago
https://archive.ph/Z7eIg https://archive.ph/Z7eIg
andai 2y ago
The other day I used one of these "order with QR" things for the first time. I ordered nachos and they brought me a fish! Curse you peabee!
explosion-s 2y ago
Page not found?
deleted 2y ago
[deleted]
mmsc 2y ago
> I checked on my laptop what other tables were ordering to get a quick vibe check of the place. I could've just looked around, but it felt cooler to do it on the laptop. I think it would be great if you could go to a restaurant and they had this data available. Sure, some menus say "best seller!" but I don't believe them all the time. And tastes change, chefs, etc.
deleted 2y ago
[deleted]
Technetium 2y ago
Author has removed the article.
mak8 2y ago
finally someone woke up and secured
- mak8 2y ago
  India today picked up: https://www.indiatoday.in/business/story/dotpe-security-lapse-api-hack-puts-sensitive-data-of-popular-restaurants-social-at-risk-2604964-2024-09-23 https://www.indiatoday.in/business/story/dotpe-security-laps...
  - ks2048 2y ago
    IndiaToday not doing this guy a favor using the word "hacker". Top bullet point: "Hackers accessed sensitive data...". Even the graphic at the top says "SYSTEM HACKED".
    - mak8 2y ago
      Yes, agree. at the same time, the company bears significant responsibility under the law. Their unconventional and insecure API implementation likely violates multiple provisions of the Act. They could face substantial penalties and legal consequences for failing to adequately protect personal data and implement appropriate security measures.
teom 2y ago
http://web.archive.org/web/20240923053856/https://peabee.substack.com/p/whats-inside-the-qr-code-menu-at http://web.archive.org/web/20240923053856/https://peabee.sub...
albert_e 2y ago
Author seems to have taken the post down ... in response to a legal notice from the platform source: https://x.com/prstb/status/1838179660959465596 https://x.com/prstb/status/1838179660959465596 Original blog post, archived copy: https://web.archive.org/web/20240923091701/https://peabee.substack.com/p/whats-inside-the-qr-code-menu-at https://web.archive.org/web/20240923091701/https://peabee.su...
jeanlucas 2y ago
It returns "Page not found"
kapilpatel 2y ago
Who says there was no security, indeed there was security by obscurity!
always_imposter 2y ago
The api is still up and they still haven't done anything to remedy this. Like, that should be your first priority, first send an email to your customers apologizing for this and then start working on it. Yikes. As one commenter on X(itter) said that the only way this company will think about fixing this is when another competitor who will gather all their customer's details and send emails to them to migrate to their service if they don't want their precious data to leak.
segalord 2y ago
My man’s got a legal notice out against him

464 points by captn3m0 2y ago

I am confused, they didn't contact the company at all and just disclose this publicly? Very immature handling of a vulnerability finding.

lordgrenville 2y ago
The author says "I refuse to believe they’re unaware of this. This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care." Agree that this is an uncharitable way of looking at it.
- appendix-rock 2y ago
  Yep. It’s just working backwards from some pre existing very negative worldview.
  - aitchnyu 2y ago
    Its a justifiable worldview. I'm an Indian dev and I've seen obvious backdoors like these added to the backlog as a low priority bug. If somebody spends time on this, that means features are being delayed and you are rewarded less. I've worked in lambda web editor (not in Git) and my lead considered replacing sql injection with parameterised queries was a distraction/insubordination. Cant wait till audits, data breach insurance and imprisonment becomes the reality.
- AtNightWeCode 2y ago
  Could be as simple as no auth in debug builds and then deployed it by accident.
  - JKCalhoun 2y ago
    I don't mean to pick on your comment, but to respond to a prior comment, you are beginning with a very positive world view and interpreting the events from there. Lazy API that did not vet a simple backdoor? Good coders but accidentally pushed the debug version of the API? I am going to have to say the second option feels less likely (yes, I have been called cynical).
    - AtNightWeCode 2y ago
      Different confs in the same repo. Many CI/CD tools will pick debug/dev conf by default if nothing else is set. It was just an example. Maybe they knew.
- deleted 2y ago
  [deleted]
desultir 2y ago
is it really a vulnerability if the entire thing is open by design?
- inquisitor26234 2y ago
  same thoughts, annual reports of larger companies have more dense figures than these too.
- filcuk 2y ago
  Who says it was? Why would they willingly give out their customers' and customers' customers data to any anonymous person or a bot? More likely a bad oversight
  - imiric 2y ago
    For 3 years? That would mean that no developer has ever raised these issues with management, to speak nothing of an actual pentest being conducted. No, this is not some obscure security hole they forgot about. This is plain incompetence and/or deliberate design decisions. I agree that full public disclosure like this is irresponsible, but exposing issues like this to the public is the only way for such companies to make a change or, preferably, lose business and shutdown.
  - TeMPOraL 2y ago
    Because they don't care, and their customers don't understand any of this shit? It feels like the usual case of vendors buying service to better exploit the users, and themselves getting burned and/or exploited by that service too.
  - cwillu 2y ago
    This is “the tire shop doesn't have a torque wrench” level shit. If it's an oversight, it's an oversight due to incompetency, not because a good team just happened to miss something in a crunch. Another possibility is that the issue was raised and management said to fix it later, and because software “engineering” isn't a real engineering field that holds its practitioners to any duty of care, those responsible (the engineers) just went along with it.
globular-toast 2y ago
If you discovered an incompetent healthcare provider was prescribing antibiotics for every condition would you "contact them privately" or contact the relevant authorities? Private disclosure is for when you believe the company cares about security but made a genuine mistake. For the company in the OP it would be more like free education in fundamental privacy and ethics. They're not entitled to that. Name and shame.
- appendix-rock 2y ago
  Sure, but what you’re describing is not what is being suggested. Responsible disclosure typically involves disclosing publicly after a reasonable period of time.
  - globular-toast 2y ago
    Right but would you afford the same opportunity to the healthcare provider? You'd contact them privately and expect them to go and learn why over prescription of antibiotics is a bad thing and change their ways? Of course you wouldn't. You'd go to someone who cares. In healthcare there are ways you can report it without naming and shaming publicly, but how could the author do that?
  - TeMPOraL 2y ago
    Why? Why should they be the responsible ones, when the well-funded, well-connected service provider is acting like the fly-by-night startup (that they probably started as)? There's little public benefit in responsible disclosure here; all it would lead to is the whole thing being swept under the rug with some trivial "fix". There's lots of public benefit in immediate, wide disclosure - the scramble to fix this under pressure from vendors before potential abuse, and any real or imagined attempt at abuse, and subsequent lawsuits, would go far towards educating people and the industry about privacy, security, and bad business practice. It's a nice low real damage, high publicity case. It's not like this stuff is new. But without serious pressure, the businesses will never learn and never stop making or enrolling into such systems. Anyway, if it happened over here in the EU, I'd do the responsible disclosure thing and give a full, detailed advance expose to the local Data Protection Authority. (And if I sound adversarial, then consider that neither the vendor developing such systems, nor the venues using them, are doing it in the interest of the customers.)
prmoustache 2y ago
Is it a vulnerability when it is obvious the company do not care about security?
- shreddit 2y ago
  Yes. Because who at the "company" does even know about this? Maybe just some coder who wrote it. But the legally liable CEO? Maybe not.
  - prmoustache 2y ago
    That is his job to make sure he employs people who take care of this and that the services they sell are audited by an independent organization.
  - deleted 2y ago
    [deleted]
  - friendzis 2y ago
    > Because who at the "company" does even know about this? Everyone who designed engineering requirements, technical requirements, test plan, everyone who wrote technical specifications, everyone who performed traceability. It was all approved by security engineers and management. > The company was founded during the pandemic when contactless dining became popular. There were tons of people intimately aware of the issue, yet for four years nobody cared.
  - Brian_K_White 2y ago
    Who at the company gets to keep all the money?
AndyMcConachie 2y ago
Disagree. Most likely the company will blame them for trying to help. Also, if the company is so incompetent that they allow this why bother. He's not getting paid to be their test engineer.
yuye 2y ago
And to add that he tried out the exploit on unknowing participants. It would be better to try this with a friend in-the-know at a separate table. It makes me think he did it more as a practical joke than testing his exploit, especially because he mentioned they were "not-too-intimidating-looking guys". I'll admit it is a bit funny and the damage caused is tiny(just the price of the food). However, things like this do harm the reputation of bug-bounty hunters.
- lopis 2y ago
  He could have just tried it on his own table (order on the phone, and then on the laptop through the vulnerability) and avoid having to a) bother others, b) waste food. The result would have been the same.
4ndrewl 2y ago
This is hardly a 0-day vuln exploit. This works as designed (and presumably design has been signed off etc)

kapitanjakc 2y ago

I found similar vulnerability in Bus State transport facility of government, where you can get list of everyone who did reservation online. You can get their gender, age, name, mobile number. I simply reported it to their website's support email and state cyber cell. This was 7 years ago, that vulnerability still exists.

jeroenhd 2y ago
This is why security researchers (threaten to) release this kind of information publicly. Reporting security issues doesn't fix anything until other people learn the details.

krab 2y ago

Nice find! There's a problematic but not critical personal information leak, a mild business intelligence leak and that's about it. > They could keep this script running for months, even years, creating awkward scenes and uncomfortable conversations at every restaurant across the country. If that's about the worst thing you can actively do, then it's only about the data leak.

sschueller 2y ago
Aren't phone numbers being leaked if you iterate over the tables?
- krab 2y ago
  Yeah, that's the PII leak.
McDyver 2y ago
"Why were you at X when you told me you were at Y? And why did you order for 2 people? Why have you been going there for the last Z months?" "By following the pattern of when you were there and what you ordered, I found the other person's details too"
zekica 2y ago
No, that's the most inconvenience you can cause. There are worse things you can do: target specific people with spurious orders, cancel everything they order, or if you want add random items to every order, making the entire system useless.
- jatins 2y ago
  people are underestimating the havoc this could create in a country like India. Imagine serving chicken at a table that is strictly vegetarian (many people in India are vegetarian due to religious reasons), will lead to a lot of outrage.
  - sjamaan 2y ago

sschueller 2y ago

A guy went to prison for doing this with AT&Ts public subscriber data. The media didn't do him a favor by calling it a hack.

globular-toast 2y ago
I almost got into big trouble at school for "hacking a teachers email". I guessed their email address (they were systematically generated) and sent an email. It's true you can get into trouble for this, but we need to all take it upon ourselves to make sure this doesn't happen. If this guy got into trouble I would hope every software engineer would be up in arms defending them.
- umbra07 2y ago
  you mean you guessed the systematically generated password, right?
  - mcpeepants 2y ago
    > I guessed their email address [...] and sent an email the old "HELO" hack
- antimemetics 2y ago
  Nah I better err on the side of caution with this - plenty of examples in history where life’s were utterly destroyed even though every sensible person was ok their side - snowden is just one extreme example but there are many others.
- dplgk 2y ago
  My 8th grade computer class teacher yelled at me for hacking the computer because I was rearranging the icons on the desktop.
- necovek 2y ago
  It's not as simple: if you accessed something simply because it was badly protected yet you were obviously not supposed to access it, it's more of a grey area. I mean, imagine an uber-hacker for whom many a network is trivial to break in: they can always argue how it was insufficiently protected. You accidentally stumbling on something unprotected generally clears you from any liability as long as you stop as soon as you notice it. Code of conduct for white hat hackers is to explore but not abuse, and report as soon as they have enough clarity on the issue. But there is no legal basis for this avoiding any liability except if a company runs an official bounty program. In that sense, the OP author could face hacking charges if India has similar laws to the rest of the developed world, and the author doesn't even have the "well intentioned" for their defence since they never reached out: the only defence they have is they did not attempt to profit off it. IANAL, though :)

yawnxyz 2y ago

reminds me of this Aussie cleaning company's website that forced you to create an account to take an order. With a couple of clicks on the web app, you'd encounter a bug... and then you can see every single person's orders, email, and personal addresses. And it was my partner who discovered it (she was struggling to order service through the website bc it kept failing). Oh and they also never charged us for service despite multiple emails asking them how we should pay (somehow we were able to order service through the site but never paid?) Clearly they're not a serious company...

prmoustache 2y ago
Isn't service taken into account in the price of the meals?
- grues-dinner 2y ago
  Probably depends if the cleaning company is bringing meals because it's an extra service they provide, or the place is such a mess they they think the customer deserves some charity?

rapnie 2y ago

> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.

globular-toast 2y ago
As a fully capable person I can't stand being waited on. For me the peak ordering experience is I choose an item from some written menu with prices on it, ask for said item and pay exactly the price written on the menu. Then I either take item immediately or come to collect it later to take it to the table myself. When I want to leave I just get up and go without the stupid ask to know how much I need to pay then ask again to actually pay with expectation that I pay more than what was asked like it's my choice to pay but really it isn't.
gibolt 2y ago
Even worse when the weird ass website has links to multiple PDF documents to download. Then you find out all the items you looked at aren't available when the waiter stares blankly at you about your order. Turns out the dinner menu requires horizontal scrolling on the page to find.
- rapnie 2y ago
  For me peak worse is tables where you get dealt with a single iPad, even when visiting with six people. Which you then get to pass along. And then the 'tech experts' take care of ordering for those who don't get computers, like many elderly folks.
- OvbiousError 2y ago
  I prefer the pdfs. Most of the time you can zoom out enough to actually have a sizeable part of the menu visitble instead of 3 items at a time.
PUSH_AX 2y ago
I’m not sure if this could be considered “peak”. The ratio of waiting staff to customers is an obvious bottleneck. This inefficiency is simply accepted and not even really thought about, it’s just the way things are. But one thing I can say for this tech is it fixed it and the difference is noticeable.

tomw1808 2y ago

Next up: "How I became a millionaire by consulting restaurants on Menu items and targeted Text Message Ads" ... Seriously, its a PII leak and it should be reported. And since you said Google is an investor someone (theoretically) should care.

captn3m0 2y ago
I looked around to find a security contact at DotPe, and couldn’t find anything. Hopefully, this HN post raises enough alarms.
- tomw1808 2y ago
  The website really seems to follow Google's best practices on human interaction: hide as much as possible. If it wasn't so sad, it would be almost funny that their Terms & Conditions page errors out (for me). The whole page looks pretty broken and like the landingpage is an afterthought... Anyways, the closest to a contact us is this what I found (after looking for 15 seconds and randomly clicking links) https://dotpe.in/contact-us.html https://dotpe.in/contact-us.html maybe that helps to get in touch at least...
- gorbachev 2y ago
  The fastest way to get in contact with DotPe would be to contact their biggest customer and informing them of this. They'd be on the phone with DotPe within an hour. Good thing the APIs can be used to easily identify that company. /s

Elfener 2y ago

From the title, I thought this was going to be about a very big QR code (presumably with a comically long URL).

Bengalilol 2y ago

Now, that went rogue quite fast and easily. I still find it confusing when some dev opt for the "let's not think about security, tokens, POST requests and whatever". I am sure some companies using that service will ask for more closed doors before everyone can lookup their revenues. That's one big example of a non technical vulnerability based on a 101 technical principle.

steinuil 2y ago

I like to scan the "specialized" bar/QR codes I come across in my daily life in case they're not just URLs. Sometimes I find some interesting stuff and possibly some opportunities for mild exploits. The other day I was at burger king. They allow you to refill your drink as many times as you like within 60 minutes of purchasing it, and the way this restriction is implemented is by having you scan a QR code they print on your receipt at the drink machine. I scanned the QR code with Binary Eye (android app that reads all sorts of barcodes, highly recommended). It contained some numbers I couldn't immediately recognize as interesting, a timestamp in a format similar to 202409231049, and a UUID. Now, the UUID is probably the ID of the order in their internal system, so the question is: does the drink machine only read the timestamp or does it also use the UUID to query the internal system to re-validate it? Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills?

TeMPOraL 2y ago
> Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills? Well, can you? :). It's the obvious next thing to try, given that Binary Eye is conveniently also a barcode generator, not just a scanner.
- steinuil 2y ago
  I know, but sadly I did not have enough time to stay there for more than an hour and try it out.
always_imposter 2y ago
>Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills? I'm hoping nobody is this naive to let your client have mission critical info to implement something as crucial as giving a discount or refills in your case. It would be just be an extra column in your db table, the only identifier available to the user should be just the UUID, along with some identifier.
- steinuil 2y ago

rococode 2y ago

Not to be a party pooper, but posting detailed financial analysis of the exact sales data of a multi-million dollar business using numbers obtained through an obviously overlooked backdoor seems like a very bad idea. Haven't people have gone to jail for less? (iirc "but it was an insecure API" has not held up in court in the past) On a more positive note, I've used a QR menu recently and it really is a game changer. Scanned a code, pressed a few buttons, and my food was there in minutes! Looking forward to seeing it more often, especially in places where you're not looking for stellar service.

2Gkashmiri 2y ago
eh. this is india my dude
Tepix 2y ago
> Looking forward to seeing it more often Not sure if you're serious after reading the paragraph where he ordered food for another table ;-)
- snypox 2y ago
  When implemented properly, it’s a convenient system. I enjoyed using it at the Stockholm airport a few months ago.
  - vesinisa 2y ago
    What makes you think that system was implemented securely?
- rococode 2y ago
  Haha :) Looking forward to seeing it more often... with proper security
hoseja 2y ago
"obviously overlooked backdoor" This is the front door. It's not even open, it's taken off the hinges. Scratch that, there never was a door in the first place, just a gaping hole right to the street.

2Gkashmiri 2y ago

this is fun because i can confidently say, "bureaucracy" runs on adverts. Whatever flashy, big banner photo op you can find, people lap that up. why? because of the immense population of india. EVERYTHING works here. You can spend countless hours trying to break your application, finding holes but who cares. Police cares about financial fraud. Did someone clickbait you into swindling money from you? well they will pounce on it because they will extract their cut from all involved and it gives them nice PR on the daily newspaper. PII fraud or vulnerability, eh well. whose gonna notice? we have enough on our plates. second thing. whatever government is doing, they protect themselves at all costs. they WILL throw you under the bus if it protects their interests. why? because of the massive population, jobs are scarce, people get college degrees and stuff to pad up their resumes because employers, govt or private REQUIRE documentary evidence you did something. doesn't matter your skills,y ou have the papers or not. this dotpe company, whatever its doing is indicative of the systemic problems in india. You have lots of people, lots of smart people, lots of dumb people and in the long run, bigger, cheaper, faster. that's all that matters

gyhnol 2y ago

> Armed with my two-week free trial of Cursor IDE, Makes this blog post sound like an advert for whatever this product is. Maybe the next big app for AI is to analyze web pages and scrub this crap out of otherwise decent articles.

aulin 2y ago
I think it was a sarcastic way to stress how low effort the whole endeavour required.

yas_hmaheshwari 2y ago

I know that Indian companies might not have a bug bounty program but you should get paid for finding such a big vulnerability And their CTO should take some blame for this. On the other hand, I agree with other comments that posting the whole financials of a company does not seem like a good idea PS: I really like your writing style. Subscribed your newsletter

Wytwwww 2y ago
> I agree with other comments that posting the whole financials of a company does not seem like a good idea Probably. But IMHO it's the right/moral thing to do, posting/showing how to access their client data is of course hardly justifiable.

thih9 2y ago

> Next time you're at a restaurant that makes you scan a QR code and enter your mobile number to order, I want you to remember that random strangers on the internet are looking over your shoulder and watching what you're eating. Isn’t this just sample size one? In other systems this information can be passed securely and not leaked later.

TeMPOraL 2y ago
Let's not forget though that these systems aren't made to make your ordering experience better (they do the opposite) - they're literally made to make it easier for more "random strangers" look over your shoulder and watch what you're eating. Strangers working for the vendor, working for the QR-menu solution provider, working for various marketing companies, etc.
- deleted 2y ago
  [deleted]

dncornholio 2y ago

Scummy article to be honest. Also good reminder to not fill in your phone number online, ever.

linhns 2y ago
A better way would be to note down scammers numbers then fill those in instead.

qnleigh 2y ago

> I would have thought about privately disclosing these findings to Dotpe. But all the API requests are right there in plain sight... There are pretty common ethical standards about disclosing vulnerabilities privately before disclosing them publicly. I don't see how the obviousness of the vulnerability changes the situation. By warning the company, you give them the opportunity to remedy the problem before announcing to the world that anyone with a laptop can exploit it. Probably they were just hoping that nobody would notice, which is stupid of course, but now they don't have the chance to build up a better wall before the flood of fake orders that could cause real harm to the small businesses whose financial information you disclosed online. Perhaps I'm being too optimistic about how the company would respond, but I still think it's hard to justify not doing a private disclosure.

mainframed 2y ago
Adding to this, in some countries he is already past the gray-area to what constitutes as computer fraud. Pissing off the company, whose systems you accessed without authorization, is one way of getting to experience the full force of the justice system.
- moralestapia 2y ago
  Curious. How is this, specifically, fraud?
  - cornel_io 2y ago
    People have been convicted of hacking for merely editing URL strings, under the theory that were knowingly accessing systems in ways that they were not supposed to. This would be similar. Whether or not that seems reasonable to us is a different matter, but basically it boils down to the fact that "they left the door unlocked" doesn't make it legal to walk in.
    - ensignavenger 2y ago
      I believe the conviction of which you are thinking was overturned on appeal, though.

yawpitch 2y ago

Well, this certainly is an interesting case of the abuse of servers to abuse servers. It’s almost teaching recursion. Please no one write that random script… f*king up high cash flow but ultimately usually pretty low margin businesses like these, while also pushing the poor staff around in a way that costs them time and very likely wages is really, really, really bad karma.

eleveriven 2y ago

A glaring example of how convenience can often come at the expense of privacy and security

siddharthgoel88 2y ago

From technical standpoint, I find the details interesting. However, this irresponsible disclosure of vulnerability troubles me. I am guessing that last year, Indian government has passed the bill of PDPA (https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf https://www.meity.gov.in/writereaddata/files/Digital%20Perso...) if I am not mistaken. Even though irresponsible disclosure of vulnerability is not explicitly mentioned in this Act, but I am pretty sure that such irresponsible disclosure are enough for the author to land into trouble. Leaving PDPA aside, as a Software professional I find this act kiddy and unethical. 10 years back I found a major vulnerability bug in an major multinational bank where I was able to see monthly statements of any person. I reported this to the bank and they took approx 1 year to fix that. I did not even mention about this bug to my friends or my CV till it was fixed.

hoseja 2y ago
If you leave the gate to your yard wide open don't be surprised to find kids playing ball there.
- siddharthgoel88 2y ago
  Understandable in this case. But if the playground is of a developed nation (like US, Canada, Singapore, etc.) then unlikely that kids would be playing. In India, personal data is not yet taken seriously with both educated and un-educated people. It would take some time but I believe this realisation will come over time in people.

0xFEE1DEAD 2y ago

I was waiting for a "I disclosed the vulnerability and this is how they reacted" story arc but there wasn't one. Pretty disappointed OP went this route. The golden rule is to always disclose the issue and wait for them to fix it before you publish. The only exception to this rule is if the company isn't acknowledging, responding, or communicating in any way. In that case you'd wait around three months, send a follow-up email warning them you'll publicly disclose the vulnerability, wait another three months, and then publish it.

sylware 2y ago

A zero-click exploit targetting big tech web engines (blink|geeko/webkit).

hnbad 2y ago

Looks like the article was deleted and purged from archive.org. I wonder if anyone saved a copy elsewhere? From the comments it seems likely the author realized they may have accidentally committed a crime or at least done something that could cause real legal consequences for them and quickly destroyed the evidence. That's probably better than leaving it up but I'd wager it wouldn't protect them from any legal consequences publishing the article already made possible.

greengoblin- 2y ago
Check the thread here: https://x.com/deedydas/status/1838137082683728323?s=46 https://x.com/deedydas/status/1838137082683728323?s=46
LukaD 2y ago
It's still there on archive.org https://web.archive.org/web/20240923053856/https://peabee.substack.com/p/whats-inside-the-qr-code-menu-at https://web.archive.org/web/20240923053856/https://peabee.su...
mpeg 2y ago
According to Twitter they removed it due to a legal notice from Dotpe, author still seems to believe he was just accessing public data unfortunately which does not look good for him should Dotpe choose to take it further

deleted 2y ago

[deleted]

esquivalience 2y ago

https://archive.is/hVKzw https://archive.is/hVKzw

vijeet_ 2y ago

Why was this blog removed?

aembleton 2y ago
Maybe someone from the company behind the API got in contact with him.
Wytwwww 2y ago
https://archive.is/hVKzw#selection-853.37-853.44 https://archive.is/hVKzw#selection-853.37-853.44
- sureglymop 2y ago
  Weirdly, the archival worked but the archived version can't be downloaded (Not Found).
antimemetics 2y ago
Author is afraid they conmitted fraud according to Indian laws

deleted 2y ago

[deleted]

coderbrahmin 2y ago

404 Not Found

layer8 2y ago

https://web.archive.org/web/20240923091701/https://peabee.substack.com/p/whats-inside-the-qr-code-menu-at https://web.archive.org/web/20240923091701/https://peabee.su...

samanator 2y ago
Thanks, apparently the article was taken down...
mfkp 2y ago
https://archive.is/Z7eIg https://archive.is/Z7eIg

jonplackett 2y ago

This is offline now. Can anyone do a recap of what was revealed without, without actually revealing whatever bad things were revealed.

sureglymop 2y ago
Yes. It was an article from someone who went into a café which had a QR code based ordering system. After ordering through the system they decide to open their laptop and inspect/look at the API of the system (a system apparently used across India). They realize that the whole API does not use authentication or authorization and start reverse engineering it/trying out various endpoints. They can then do things like ordering stuff for other tables, calculate earnings of restaurants, etc. They probably took it down because they disclosed it publicly directly instead of contacting that QR code based ordering service provider (which I won't mention the name of). Given that this is a substack which has a newsletter, this article has probably reached many people before being taken offline.
deleted 2y ago
[deleted]

voidfunc 2y ago

404 / Not Found. Looks like someone got to OP. Anyone have a cached copy?

da44en 2y ago
https://archive.ph/Z7eIg https://archive.ph/Z7eIg

jonplackett 2y ago

> This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care. Having a complete lack of any authentication and sequential IDs does seem like a design decision.

shthed 2y ago
Feels like a proof of concept demo app built by an intern.. to which the customer said: perfect! launch this in production tomorrow

andai 2y ago

https://archive.ph/Z7eIg https://archive.ph/Z7eIg

andai 2y ago

The other day I used one of these "order with QR" things for the first time. I ordered nachos and they brought me a fish! Curse you peabee!

explosion-s 2y ago

Page not found?

deleted 2y ago

[deleted]

mmsc 2y ago

> I checked on my laptop what other tables were ordering to get a quick vibe check of the place. I could've just looked around, but it felt cooler to do it on the laptop. I think it would be great if you could go to a restaurant and they had this data available. Sure, some menus say "best seller!" but I don't believe them all the time. And tastes change, chefs, etc.

deleted 2y ago

[deleted]

Technetium 2y ago

Author has removed the article.

mak8 2y ago

finally someone woke up and secured

mak8 2y ago
India today picked up: https://www.indiatoday.in/business/story/dotpe-security-lapse-api-hack-puts-sensitive-data-of-popular-restaurants-social-at-risk-2604964-2024-09-23 https://www.indiatoday.in/business/story/dotpe-security-laps...
- ks2048 2y ago
  IndiaToday not doing this guy a favor using the word "hacker". Top bullet point: "Hackers accessed sensitive data...". Even the graphic at the top says "SYSTEM HACKED".
  - mak8 2y ago
    Yes, agree. at the same time, the company bears significant responsibility under the law. Their unconventional and insecure API implementation likely violates multiple provisions of the Act. They could face substantial penalties and legal consequences for failing to adequately protect personal data and implement appropriate security measures.

teom 2y ago

http://web.archive.org/web/20240923053856/https://peabee.substack.com/p/whats-inside-the-qr-code-menu-at http://web.archive.org/web/20240923053856/https://peabee.sub...

albert_e 2y ago

Author seems to have taken the post down ... in response to a legal notice from the platform source: https://x.com/prstb/status/1838179660959465596 https://x.com/prstb/status/1838179660959465596 Original blog post, archived copy: https://web.archive.org/web/20240923091701/https://peabee.substack.com/p/whats-inside-the-qr-code-menu-at https://web.archive.org/web/20240923091701/https://peabee.su...

jeanlucas 2y ago

It returns "Page not found"

kapilpatel 2y ago

Who says there was no security, indeed there was security by obscurity!

always_imposter 2y ago

The api is still up and they still haven't done anything to remedy this. Like, that should be your first priority, first send an email to your customers apologizing for this and then start working on it. Yikes. As one commenter on X(itter) said that the only way this company will think about fixing this is when another competitor who will gather all their customer's details and send emails to them to migrate to their service if they don't want their precious data to leak.

segalord 2y ago

My man’s got a legal notice out against him