3 ms·

> I would have thought about privately disclosing these findings to Dotpe. But all the API requests are right there in plain sight... There are pretty common e

> I would have thought about privately disclosing these findings to Dotpe. But all the API requests are right there in plain sight... There are pretty common ethical standards about disclosing vulnerabilities privately before disclosing them publicly. I don't see how the obviousness of the vulnerability changes the situation. By warning the company, you give them the opportunity to remedy the problem before announcing to the world that anyone with a laptop can exploit it. Probably they were just hoping that nobody would notice, which is stupid of course, but now they don't have the chance to build up a better wall before the flood of fake orders that could cause real harm to the small businesses whose financial information you disclosed online. Perhaps I'm being too optimistic about how the company would respond, but I still think it's hard to justify not doing a private disclosure.

mainframed 2y ago
Adding to this, in some countries he is already past the gray-area to what constitutes as computer fraud. Pissing off the company, whose systems you accessed without authorization, is one way of getting to experience the full force of the justice system.
- moralestapia 2y ago
  Curious. How is this, specifically, fraud?
  - cornel_io 2y ago
    People have been convicted of hacking for merely editing URL strings, under the theory that were knowingly accessing systems in ways that they were not supposed to. This would be similar. Whether or not that seems reasonable to us is a different matter, but basically it boils down to the fact that "they left the door unlocked" doesn't make it legal to walk in.
    - ensignavenger 2y ago
      I believe the conviction of which you are thinking was overturned on appeal, though.
  - rvnx 2y ago
    He is in India: If any person without permission of the owner or any other person who is incharge of a computer, computer system or computer network - (a) accesses or secures access to such computer, computer system or computer network or computer resource; - (b) downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium; [...] - (e) disrupts or causes disruption of any computer, computer system or computer network; [...] - (g) provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made thereunder; If any person, dishonestly or fraudulently, does any act referred, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both. ==== Though, I prefer a lot the poster of the blog post than the company...
  - mainframed 2y ago
    I don't know Indian laws. But this wikipedia page [1] gives a list of types of computer fraud in the US under the CFAA: Types of computer fraud include: * [...] * Accessing unauthorized computers * [...] He accessed their computers to access purchase information of other people (e.g. his friend) and business data. I guess making it public, thereby damaging the companies reputation and potentially getting sued by their lawyers is one way to find out, whether he was "unauthorized" to do so. [1] https://en.wikipedia.org/wiki/Computer_fraud https://en.wikipedia.org/wiki/Computer_fraud
  - nkrisc 2y ago
    The gist of some various laws around the world is that simply obtaining credentials does not authorize you to access the system, and accessing it without authorization is the illegal part.
    - drdec 2y ago
      This principle is clear if you apply a real world analogy. Just because you happen to have keys to a building doesn't mean you can enter without authorization from the owner. (E.g. you may have kept copies after a lease expires or a sale, it maybe you found them, etc.)
      - whamlastxmas 2y ago
        Considering it’s a API available without any authorization, the better comparison would be walking around on unfenced private land. There’s nothing to indicate they don’t want people on it but it’s also obvious it’s private land.
        hunter2_ 2y ago
        Walking around isn't usually a big deal until told to leave (verbally or by way of conspicuously posted signs), since that is a prerequisite to trespassing. Otherwise, delivery people would operate in a gray area which would be very problematic for them, since not all deliveries are requested by the recipient/owner. However, although you are free to walk around in search of the front door, you can't start eating the fruit off the trees. Perhaps that's the better analogy: the trees are happy to serve up a delicious treat for anyone requesting something of it, but that doesn't mean the tree sets the rules. Just because fences preventing this are popular doesn't make them compulsory.
        ryathal 2y ago
        It doesn't matter. It's still just as illegal to get into an unlocked car or one with wide open doors without permission. The same premise applies to computers in a lot of places, access controls don't matter. If you access something on a computer not indented to be accessible, it's considered a crime.
  - ceejayoz 2y ago
    By the sensible definition, it isn’t. By the definition that killed Aaron Swartz, it probably is.
    - AdamN 2y ago
      He wasn't prosecuted for logging in and looking around. He overtly did copyleft type things like finding ways to take copyrighted journal articles and release them into the public domain. Overzealous prosecution for sure regardless.
      - ceejayoz 2y ago
        https://en.wikipedia.org/wiki/Aaron_Swartz#United_States_v._Aaron_Swartz_case https://en.wikipedia.org/wiki/Aaron_Swartz#United_States_v._... > On July 11, 2011, he was indicted by a federal grand jury on charges of wire fraud, computer fraud, unlawfully obtaining information from a protected computer, and recklessly damaging a protected computer. > On November 17, 2011, Swartz was indicted by a Middlesex County Superior Court grand jury on state charges of breaking and entering with intent, grand larceny, and unauthorized access to a computer network. > On September 12, 2012, federal prosecutors filed a superseding indictment adding nine more felony counts, increasing Swartz's maximum criminal exposure to 50 years of imprisonment and $1 million in fines. The only civil copyright proceedings were JSTOR settling with him out of court.
tomalaci 2y ago
In this case? Nope. This must be treated as willful design decision to open up API to entire public (including PII/phone-number leak as per design), even if they say they totally didn't meant that to happen. Government itself should then be notified to go after these guys for failing to do the most basic access controls. I mean, come on! To treat this as a proper security vulnerability just gives too much leeway for these fast-and-loose businesses/systems. It will just encourage more such crap to proliferate. I am with the author on this one, I am fairly certain the issue of this was raised internally already, probably multiple times. Fortunately for the business, their management did the right decision - focus on quick and easy features, security is a non-issue, we will just blame the hackers and have legal channels deal with them. I mean, you even have people here berating someone uncovering gross negligence for Google-backed company. Why would businesses bother with basic security when they can play the victim so damn easy?
- krsdcbl 2y ago
  Fully agree with you! The API being unauthd is clearly a core design choice, and finding out any customer or service data is openly accessible with consecutive numbers through that API is not a zero day or something. There is no "responsible disclosure" to be made here, going to the company and explaining what's the issue with all of this amounts to "handing out free consulting" if anything
  - mpeg 2y ago
    Unfortunately that is not how the law works, at least in most countries. As soon as you enumerate ids regardless of whether there is any security in place it is unauthorised access and it's illegal.
    - komali2 2y ago
      Right, I believe they're posting as if the ethical standpoint is normalized, to further highlight the absurdity and injustice of the current legal framework.
ffsm8 2y ago
> 37,529 restaurants use Dotpe for QR codes. At that scale, it would take years to get fixed without forcing it like this. It's too small for them to care about the liability of security and too large to move quickly
- loktarogar 2y ago
  > At that scale, it would take years to get fixed without forcing it like this. But it also might not take years. The point of responsible disclosure is to give them the opportunity. If they don't take it, fine - that's now on them. Instead this guy is committing fraud with actual financial damages (wasted food) and then sharing how others can commit the same fraud on a massive scale, potentially causing more damage. This is now on him and Dotpe, not Dotpe alone.
  - hunter2_ 2y ago
    > fine - that's now on them Is that legally true? The legal risk of having published this without responsible disclosure vanishes if the conventional period of opportunity is ignored? That smells fishy.
    - loktarogar 2y ago
      I'm not a lawyer so I'm not speaking to the legality of this. Legality is not the only thing that matters. If you publish an exploit without at least making an attempt to fix it, and someone follows you and exploits it, then there's a direct moral line between you and that exploitation. They more likely than not wouldn't have exploited it without you putting that published info in their path. It's now on you, them and the company, morally. Any damages that result from this interaction are because you and the company enabled them to happen. That's different to someone else stumbling on it and exploiting it. That's purely on the company and the exploiter.
- chippiewill 2y ago
  Maybe, maybe not. But in responsible disclosure you usually give a 90 day notice period before publicly disclosing and "forcing" them.
ryukoposting 2y ago
Well, the link leads to a 404 so it seems like the author has been convinced.

mainframed 2y ago

Adding to this, in some countries he is already past the gray-area to what constitutes as computer fraud. Pissing off the company, whose systems you accessed without authorization, is one way of getting to experience the full force of the justice system.

moralestapia 2y ago
Curious. How is this, specifically, fraud?
- cornel_io 2y ago
  People have been convicted of hacking for merely editing URL strings, under the theory that were knowingly accessing systems in ways that they were not supposed to. This would be similar. Whether or not that seems reasonable to us is a different matter, but basically it boils down to the fact that "they left the door unlocked" doesn't make it legal to walk in.
  - ensignavenger 2y ago
    I believe the conviction of which you are thinking was overturned on appeal, though.
- rvnx 2y ago
  He is in India: If any person without permission of the owner or any other person who is incharge of a computer, computer system or computer network - (a) accesses or secures access to such computer, computer system or computer network or computer resource; - (b) downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium; [...] - (e) disrupts or causes disruption of any computer, computer system or computer network; [...] - (g) provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made thereunder; If any person, dishonestly or fraudulently, does any act referred, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both. ==== Though, I prefer a lot the poster of the blog post than the company...
- mainframed 2y ago
  I don't know Indian laws. But this wikipedia page [1] gives a list of types of computer fraud in the US under the CFAA: Types of computer fraud include: * [...] * Accessing unauthorized computers * [...] He accessed their computers to access purchase information of other people (e.g. his friend) and business data. I guess making it public, thereby damaging the companies reputation and potentially getting sued by their lawyers is one way to find out, whether he was "unauthorized" to do so. [1] https://en.wikipedia.org/wiki/Computer_fraud https://en.wikipedia.org/wiki/Computer_fraud
- nkrisc 2y ago
  The gist of some various laws around the world is that simply obtaining credentials does not authorize you to access the system, and accessing it without authorization is the illegal part.
  - drdec 2y ago
    This principle is clear if you apply a real world analogy. Just because you happen to have keys to a building doesn't mean you can enter without authorization from the owner. (E.g. you may have kept copies after a lease expires or a sale, it maybe you found them, etc.)
    - whamlastxmas 2y ago
      Considering it’s a API available without any authorization, the better comparison would be walking around on unfenced private land. There’s nothing to indicate they don’t want people on it but it’s also obvious it’s private land.
      - hunter2_ 2y ago
        Walking around isn't usually a big deal until told to leave (verbally or by way of conspicuously posted signs), since that is a prerequisite to trespassing. Otherwise, delivery people would operate in a gray area which would be very problematic for them, since not all deliveries are requested by the recipient/owner. However, although you are free to walk around in search of the front door, you can't start eating the fruit off the trees. Perhaps that's the better analogy: the trees are happy to serve up a delicious treat for anyone requesting something of it, but that doesn't mean the tree sets the rules. Just because fences preventing this are popular doesn't make them compulsory.
      - ryathal 2y ago
        It doesn't matter. It's still just as illegal to get into an unlocked car or one with wide open doors without permission. The same premise applies to computers in a lot of places, access controls don't matter. If you access something on a computer not indented to be accessible, it's considered a crime.
- ceejayoz 2y ago
  By the sensible definition, it isn’t. By the definition that killed Aaron Swartz, it probably is.
  - AdamN 2y ago
    He wasn't prosecuted for logging in and looking around. He overtly did copyleft type things like finding ways to take copyrighted journal articles and release them into the public domain. Overzealous prosecution for sure regardless.
    - ceejayoz 2y ago
      https://en.wikipedia.org/wiki/Aaron_Swartz#United_States_v._Aaron_Swartz_case https://en.wikipedia.org/wiki/Aaron_Swartz#United_States_v._... > On July 11, 2011, he was indicted by a federal grand jury on charges of wire fraud, computer fraud, unlawfully obtaining information from a protected computer, and recklessly damaging a protected computer. > On November 17, 2011, Swartz was indicted by a Middlesex County Superior Court grand jury on state charges of breaking and entering with intent, grand larceny, and unauthorized access to a computer network. > On September 12, 2012, federal prosecutors filed a superseding indictment adding nine more felony counts, increasing Swartz's maximum criminal exposure to 50 years of imprisonment and $1 million in fines. The only civil copyright proceedings were JSTOR settling with him out of court.

tomalaci 2y ago

In this case? Nope. This must be treated as willful design decision to open up API to entire public (including PII/phone-number leak as per design), even if they say they totally didn't meant that to happen. Government itself should then be notified to go after these guys for failing to do the most basic access controls. I mean, come on! To treat this as a proper security vulnerability just gives too much leeway for these fast-and-loose businesses/systems. It will just encourage more such crap to proliferate. I am with the author on this one, I am fairly certain the issue of this was raised internally already, probably multiple times. Fortunately for the business, their management did the right decision - focus on quick and easy features, security is a non-issue, we will just blame the hackers and have legal channels deal with them. I mean, you even have people here berating someone uncovering gross negligence for Google-backed company. Why would businesses bother with basic security when they can play the victim so damn easy?

krsdcbl 2y ago
Fully agree with you! The API being unauthd is clearly a core design choice, and finding out any customer or service data is openly accessible with consecutive numbers through that API is not a zero day or something. There is no "responsible disclosure" to be made here, going to the company and explaining what's the issue with all of this amounts to "handing out free consulting" if anything
- mpeg 2y ago
  Unfortunately that is not how the law works, at least in most countries. As soon as you enumerate ids regardless of whether there is any security in place it is unauthorised access and it's illegal.
  - komali2 2y ago
    Right, I believe they're posting as if the ethical standpoint is normalized, to further highlight the absurdity and injustice of the current legal framework.

ffsm8 2y ago

> 37,529 restaurants use Dotpe for QR codes. At that scale, it would take years to get fixed without forcing it like this. It's too small for them to care about the liability of security and too large to move quickly

loktarogar 2y ago
> At that scale, it would take years to get fixed without forcing it like this. But it also might not take years. The point of responsible disclosure is to give them the opportunity. If they don't take it, fine - that's now on them. Instead this guy is committing fraud with actual financial damages (wasted food) and then sharing how others can commit the same fraud on a massive scale, potentially causing more damage. This is now on him and Dotpe, not Dotpe alone.
- hunter2_ 2y ago
  > fine - that's now on them Is that legally true? The legal risk of having published this without responsible disclosure vanishes if the conventional period of opportunity is ignored? That smells fishy.
  - loktarogar 2y ago
    I'm not a lawyer so I'm not speaking to the legality of this. Legality is not the only thing that matters. If you publish an exploit without at least making an attempt to fix it, and someone follows you and exploits it, then there's a direct moral line between you and that exploitation. They more likely than not wouldn't have exploited it without you putting that published info in their path. It's now on you, them and the company, morally. Any damages that result from this interaction are because you and the company enabled them to happen. That's different to someone else stumbling on it and exploiting it. That's purely on the company and the exploiter.
chippiewill 2y ago
Maybe, maybe not. But in responsible disclosure you usually give a 90 day notice period before publicly disclosing and "forcing" them.

ryukoposting 2y ago

Well, the link leads to a 404 so it seems like the author has been convinced.