breakingcups 4 days ago

The author seems a bit... immature in their handling of things? Using a friend's login to pentest stuff (causing the friend to get fired, rightfully so), defacing internal applications, creating bogus orders...

They're cocky and they don't fully seem to grasp yet how their behavior works against them.

  • gnfargbl 12 hours ago

    It's pretty standard for the infosec world, it attracts somewhat unusual personalities. This is why it's so important for larger companies to have clearly signposted responsible disclosure channels: if the channels are there, then people like Bob often will use them, even if there's no reward on offer.

    > causing the friend to get fired, rightfully so

    Given that the intent of the friend was to help improve McDonalds' security, I'd have to disagree that the firing was rightful. However, it is something that probably 90%+ of multinationals would do in this situation.

    • smelendez 11 hours ago

      > Given that the intent of the friend was to help improve McDonalds' security, I'd have to disagree that the firing was rightful.

      I’d be inclined to fire someone who shared their credentials with an outsider running an unauthorized security test or discussed unpatched vulnerabilities in detail with outsiders.

      An employee poking around and finding stuff on their own and reporting it might be a different story, though the details would still matter a lot.

      • ycombinatrix 7 hours ago

        OP did not use their employee friend's credentials, they created their own account through the registration page.

  • etchalon 12 hours ago

    Maybe, but it's not like McDonald's comes out look great here.

    • rs186 10 hours ago

      Unless this becomes news on mainstream media (hint: it won't), nothing happened and nothing will change.

      The only thing that will actually make them change how they handle security is an event where their internal system gets hacked in a really bad way, like PSN, potentially affecting restaurant operations and involving customer info. Then executives will start paying attention. Otherwise, this is what it is.

    • junga 12 hours ago

      I guess they couldn't care less. A few people on a site called Cracker News read about this. Same on other platforms. There will be no measurable impact.

  • martin-t 11 hours ago

    I hate this idea that you always have to be professional when dealing with a corporation and have to follow rules exactly, often rules made up by the corporation. (Laws are just rules too, they are enforced by violence.)

    The corporation showed gross incompetence and was punished for it. Sending passwords in plaintext indicates deeper security issues and systemic failures. HN can cry about companies leaking people's personal details but to actually make it affect their bottom line and force them to fix it, it has to affect their bottom line - they must get punished.

    Sure, this was not a legal punishment but it was not wrong and it was very minor anyway.

    Legality is not morality. Laws are written to protect peace (absence of visible conflict), not to protect justice.

Atotalnoob 11 hours ago

The security researcher could definitely be arrested for this.

He used employee credentials, and of course his friend got fired, it’s literally the first thing places tell you: don’t share your password.

  • ycombinatrix 7 hours ago

    They did not use or have access to employee credentials. They registered their own account.

mettamage 12 hours ago

Given the sloppiness of McDonald's security, my conclusion is that they don't really care about being secure. Being hacked is an annoying business expense to them, but that's it.

Given that his friend was fired, if I ever had an inkling of doing free pentesting for McDonald's, I sure as hell don't now. They don't deserve it.

  • tredre3 11 hours ago

    > Given that his friend was fired, if I ever had an inkling of doing free pentesting for McDonald's, I sure as hell don't now.

    What is a company supposed to do when they detect an employee repeatedly try to access different systems they shouldn't have access to (nor have reason to even try)?

    • ycombinatrix 7 hours ago

      Nothing? The employee is using their own legitimate credentials on an internal system.

comrade1234 12 hours ago

I wonder who programmed it? I had a project in India with a giant multi-national consulting company and McDs was one of their clients. I wasn't in that project but it looked like it was a couple of dozen of developers on it.

  • sitzkrieg 11 hours ago

    [flagged]

    • radio4fan 11 hours ago

      Yes, we sure are lucky that natural born Americans have never implemented anything poorly

0cf8612b2e1e 8 hours ago

I am not sure why they found access to the company directory so enticing. There was plenty of red meat in the post, but being able to lookup other people in the company is just kind of essential. My employers have always had some kind of search functionality which gives you name, title, email, department, etc.

pizzalife 12 hours ago

This guy could easily get indicted under CFAA. This isn’t how you conduct “white hat” security research lmao. If they don’t have a clearly outlined bug bounty program, you are in a pickle. Especially with using legitimate employee credentials.

billy99k 4 days ago

In my experience, if a company doesn't have a security team and is asking for your free pentesting services, you are asking for trouble.

  • akerl_ 9 hours ago

    Did the company ask for free pentesting?

Danborg 11 hours ago

this reads like a confession for his CFAA deposition