HN Reader

'123456' password exposed chats for 64M McDonald's job applicants

141

6 months agoby nan60

My favourite part form the original report was that paradox had no way to find their security team ( to contact) and their security page just had "We worry about security, so you don't have to."

https://web.archive.org/web/20250208000940/https://www.parad...

6 months agoby jofzar

It sounds like there were two separate problems:

The first was that 123456 was the credentials for the admin panel.

The second was an insecure direct object reference, where the lead_id querystring parameter can be changed on an API call to retrieve another applicant's data.

6 months agoby bsuvc

Discussion (125 points, 2 days ago, 69 comments) https://news.ycombinator.com/item?id=44513940

6 months agoby gnabgib

It's funny how mcdonalds did everything in their power to make it almost impossible to run their mcdonalds app on a rooted phone, but their backend infrastructure is beyond broken (security wise)

6 months agoby ajsnigrutin

There was also https://www.techspot.com/news/108619-mcdonalds.html

> Moreover, when Carroll attempted to alert Paradox to the breach, he was unable to find a security disclosure contact. The company's security page mostly consists of a simple assurance that users shouldn't need to worry about security. Eventually, after the researchers emailed "random people," Paradox and McDonald's confirmed that they resolved the issue in early July.

Shouldn't need to worry indeed. McDonald's evidently doesn't either.

Can someone tell them to put "Set a password a five-year-old child can't guess" onto their deployment checklist?

6 months agoby aaronmdjones

Wait, 64 million applicants, not applications? That's like 20% of the US population!

6 months agoby micw

This is what happens when "Minimum Viable Product" meets modern threat environments.

'Move fast and break things' indeed.

6 months agoby ezekiel68

Incredible! That’s the combination to my matched luggage!

6 months agoby deafpolygon

Stupid question, if we really tried brute forcing websites with less than 100k monthly traffic, how many such cases would be actually run into?

6 months agoby vivzkestrel