Hacker News Reader

Comment by martinald | Hacker News Reader

That disclosure timeline is very aggressive over the holiday period.

Did they ever get in touch with you after the 5th?

Agreed - the timeline is over the most popular period of the year when most 'back office' people (i.e. IT teams, management, and others not involved in direct customer service) are away. The least the OP could have done is waited until mid-January to release to public to allow them time to get some resources onto the problem IMO.

Would be surprised if a company like McDonalds had no emergency crisis procedure to handle issues that would damage their reputation anytime, anywhere and recall people even when they are off on holidays. Maybe they thought it was not worth taking it seriously.

I agree, but like someone else pointed out on this thread, this was probably a third party agency who built the site. If they had closed shop for the holidays, and everyone at the agency was overseas visiting family etc., then the response would be difficult.

At best, perhaps a programmer could be pulled away from his Christmas pudding to hack a patch remotely on his laptop, or take down the site entirely until they could handle it properly?

Just speaking from my own experience here - I run a small web dev agency, and I know that during the Christmas break, we can only offer rudimentary patch up work for our clients, and that is only depending on the internet connection at wherever our team members are.

Just a reply of "Hi, our IT staff confirms this is a security issue. We intend to fix it as soon as possible. Thank you for your help." doesn't need to wait for the 3rd party agency to come back from holiday.

Edit: Realised I was being dumb here. I get it now.

If you can sniff other users' cookies, you can get their passwords. Good thing no one reuses passwords across sites!

Where the proof-of-concept shows the password in an alert box, a malicious implementation can send it to a remote server. What his proof-of-concept page does, any website can do.

Yeah, the disclosure comes close to violating their own Responsible Disclosure policy, which is 3 business days.

If McDonald's enployees get the holidays off and go back to work on the 3rd, they would have had 2 days to respond. Meaning that if McDonald's disclosed a vulnerabilty to Finnwea.com over the same time period, finnwea.com says they might have sued them.

So maybe that guy was a little trigger happy. Great hack, though.

I could be wrong but it sounds like your comment is confused about what a business day is. If a firm decides to let some individuals have the whole time off during the holiday period, that doesn't mean those aren't business days from an external perspective.

Yes, because a company at #109 on the Fortune 500 shouldn't bother spending money on 24/7 infosec.

"Responsible disclosure" is simply a meme to reframe "instant full disclosure" as irresponsible, which is dishonest.

Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act?

Look at this bug, in particular. This is not about this bug; this is about basic negligence. It would have been completely appropriate to blog about this on day zero of discovery. This is not about "time to patch", this is about "time to convince the widest number of people that you should never trust McDonalds with your data".

> Do you think journalists sit on the final results of corporate negligence investigations while giving the guilty parties time to clean up their act?

I've worked at a newspaper. Your framing of the question is deliberately silly - they'd sit on it to prevent innocents from being harmed, not to protect the guilty.

Once it's fixed (or after a reasonable amount of time not getting fixed), then they happily nail the guilty people to the wall.

Agreed. It can take months to connect with some big companies. Reported via Twitter? Come on.

Tip: InMail on LinkedIn can be quite effective if you're having trouble. Start at the ceo and work your way down.

Is your hit rate on LinkedIn for security issues that high? Mine's in the single digits, almost as bad as email.

What do you say in your InMail messages that give you a higher response rate? Are you using premium services?

Yes you have to pay for InMail. Just be clear and concise. Worked for a Freshdesk vuln we reported. I pinged the ceo.

That brings up an interesting question though. How long is long enough for disclosure in cases where the company has made it impossible to notify them of a vulnerability? If someone tries 10 different ways to get in touch and makes absolutely no progress it would seem that it would be better to disclose sooner rather than later.

Giving companies plenty of time to fix a vulnerability is one thing but if the company isn't even working on the issue because they've isolated all external contact at least if disclosure happens sooner that's less time that an unknown attacker can use that vulnerability without anyone being aware of the issue.

This isn't a buffer overrun that's hard to detect though, this seems like something that should have been found using more proactive measures.

No excuse. It's the middle of January now, the holidays are long over, and they're one of the biggest companies on the planet. They had plenty of time to respond.

> they're one of the biggest companies on the planet

Yeah, making hamburgers! Out of 420,000 employees, they have all of 17 IT jobs on their career site.

They deserve a break today.

I get both of you, yeah its a big company and it is a fast food restaurant. Considering that a company this big has a lot of workers that do not have that many days off during the holidays, there should still be mail read, and IT can't just up and leave for weeks. There surely have to be a few people on standby. But the IT department probably doesn't know much about the website, and for the website makers it does not make sense to be available all the time. IT could still remove the login feature(shutdown the login server) until after the holidays, provided that IT gets the message.

Conclusion: Bad excuse for a company this big, their communications being offline for so long is bad. But it is within reasonable to wait a little longer with disclosure, considering the mistakes made on the website, publisher should realise that the company hasnt put that much resources into this who security thing.

Nah, they deserved this disclosure and proof of concept today.

> Yeah, making hamburgers! Out of 420,000 employees, they have all of 17 IT jobs on their career site.

How many credit cards get swiped/waved per day at their PoS terminals? If they don't have a 24/7 infosec team they're Doing It Wrong™.

I'm not sure that agrees with the franchise model. McDonald's corporate owns the real estate, but not most of the businesses. So most of those terminals aren't actually theirs.

It's not as if franchisees can just choose to purchase whatever equipment they want. It all has to come from corporate, so corporate is the place to enforce security standards.

Oh wow. That model is atrocious in terms of providing decent security.

>Public Disclosure: 05 Jan 2017 23:31:42 GMT Which was roughly 2-3 days after returning from New Year's.

Public release was way too early, author should have waited.

Sounds like a northern hemisphere mentality. Likely where the team a based, but anyone not up top is doing the best to avoid work at the moment as it's mid summer and fantastic.

Reply on news.ycombinator.com