The researcher figured out the following (pasted from the blogpost):
The ability to order any number of menu items for ₹1 ($0.01 USD).
The ability to steal/hijack/redirect other people's delivery orders through a specific sequence of carefully timed API calls.
The ability to retrieve the details of any order.
The ability to track any order in the "On the way" status. You could real-time track the location of the driver for any order.
The ability to download invoices for any order.
The ability to submit feedback for orders that are not your own.
The ability to view admin KPI reports.
Sensitive driver/rider information that could be accessed:
Name
Email address
Phone number
Vehicle license plate number
Profile picture
Saar please take this amazon giftcard I stole from your mother saar
The post is very boring as the techniques used were very basic. I'm not calling the researcher garbage, I'm saying that their website was very poorly setup.
Jump in the discussion.
No email address required.
They did him dirty, lmao. Should have just kept it to himself and got basically free food until they patched it.
Jump in the discussion.
No email address required.
he doesnt live in India tho, he lives in the US
Jump in the discussion.
No email address required.
Just have some Grubhub chump deliver it for $2.37 commission.
Jump in the discussion.
No email address required.
More options
Context
RIP even more. Have a nice 9 dollar big mac, stalker child
Jump in the discussion.
No email address required.
More options
Context
More options
Context
More options
Context
Jump in the discussion.
No email address required.
It's rough when you have thousand or tens of thousands of developers, one dumb team can cause something like this
Jump in the discussion.
No email address required.
Combination of r-slurred PM and not my problem atmosphere.
Jump in the discussion.
No email address required.
Too common sadly, we could probably make better products with 1/3 of the headcount if everyone cared
Jump in the discussion.
No email address required.
!kino !music
Jump in the discussion.
No email address required.
More options
Context
More options
Context
More options
Context
Especially if you buy the cheapest of the cheapest
Jump in the discussion.
No email address required.
More options
Context
More options
Context
*indian franchisee of major corporation developing local software using local "talent"
Jump in the discussion.
No email address required.
More options
Context
More options
Context
Isn't that almost the average Indian's monthly salary tho?
Jump in the discussion.
No email address required.
I truthfully do not know or care about the finances of a 3rd world
country; if you cannot pay researchers properly, then you'll be subject
to the bottom
of the barrel
Jump in the discussion.
No email address required.
True, he should've just exploited it to get free food forever
Jump in the discussion.
No email address required.
That's what the next person will do, or rather sell the details on how to do it
Jump in the discussion.
No email address required.
More options
Context
Ah, just checked and apparently he's in the states.
Jump in the discussion.
No email address required.
Jump in the discussion.
No email address required.
More options
Context
More options
Context
More options
Context
More options
Context
More options
Context
I remember reading somewhere that all McDonald's subsidiaries have to setup their own IT infra and software and maintain them out of their own pocket, resulting in most of them being made to be as cheap as possible.
I'm not surprised at all to see they are vulnerable, but allowing clients to update the order price is incredible
Jump in the discussion.
No email address required.
Having to set up their own IT infra + sexy Indian dudeware is a recipe for this sort of thing, yeah.
Jump in the discussion.
No email address required.
More options
Context
More options
Context
lol, it had an actual order id number 1, and then went sequentially
apparently the concept of uuids didn't occur to the devs
but then again neither did authentication, so idk.
Jump in the discussion.
No email address required.
More options
Context
These are the devs Elon wants to replace you with.
Jump in the discussion.
No email address required.
More options
Context
Most of the default subs are run by bots and shills.
Social media is the Matrix. Look into the ties between big tech and DARPA. The content is curated and contextualized to create a certain response in the public mind. Look up the original definition of Cybernetics.
You are human livestock and the internet is your digital enclosure. And like all good farmers, they have to make sure the herd gets their vaccines or it could mean disaster for the farm!
It's not individuals who just love vaccines making these gay pro vax memes. Someone is being paid to do it by some shitty organization likely with ties to the Rockefellers and the Vanderbilts or whatever.
Snapshots:
https://eaton-works.com/2024/12/19/mcdelivery-india-hack/:
ghostarchive.org
archive.org
archive.ph (click to archive)
Jump in the discussion.
No email address required.
More options
Context