some of the worst API security i've EVER seen

Web APIs are hard to get right... but not THIS hard. In this video we react to an article by a security researcher who hacked McDonalds India.

🏫 MY COURSES

🧙‍♂️ HACK YOUR CAREER

🔥COME HANG OUT

[zaibachien]

$240 in giftcards is an absolutely pathetic payout for the value he provided with his tests regardless of where the tester lives.

[dextroz]

For any org especially of the size of McDonald's India, $240 is nothing. Even by Indian standard he should have been awarded at least$2K+. It could have cost them upwords of $5K+ dollars to get a security report even from an Indian company (decent one). And probably they would have run this report at least 3-4 times before extracting all faults.

[EatonZveare]

Author/researcher here 👋

Thanks for covering - really enjoyed your commentary!

[yassine-sa]

Hack McDonald's API to steal users' credentials: ❌️
Hack McDonald's API to get free meals: ✅️

[simaesthesia]

I once speculatively "hacked" a CMS that I'd never come across before by simply changing the user id to zero in a form and magically gained uber admin rights. When you have nothing better to do than "I wonder if..."

[Little-bird-told-me]

Mc Donald Bug Bounty Reward Section says : "The reward for a valid bug will be Rs. 2, 500/- in the form of coupons (applicable only in McDonald’s India)"- That's 31 USD of coupons valid only in India. The fact that he got 250 USD was probably because he exposed multiple area like SQL injection, api vulnerabilities, session flaws etc. Still not worth it unless you are some college grad trying to build your resume'

[maotseovich]

I'm a school office lady by profession. I taught myself JavaScript to I could build webscrapers to do my data entry work for me. That "just change the 'disabled' property of the submit button" trick works so much more often than it should.

[WilliamHostman]

You didn't mention the ultimate in white-hat-hacking: He got approval from the target to publish the article!

[kgamerplays]

This guy just saved McDonalds from losing millions of dollar and they gave him $250 gift card wow.

[chadyways]

not surprised the mcdonalds API and services are full of holes

Back in 2017-2018, it was easy to essentially get infinite 1€ cheese burgers through just sending requests to the API endpoint that gave out cupoun codes for giving feedback

[djbremsespor]

The $240 gift card is absolutely ridiculous when you consider the high potentials for monetary and privacy abuse.
What a disgrace to the bug bounty program.

[davidmorton]

You have to do both authentication AND authorization.

[rohitrmohanty]

They do have the doordash equivalents, swiggy and zomato which went public. But you get discounts on the McDelivery app so it's popular for restaurants to have separate apps too for discounts and community stuff. That's why having those restaurant apps are useful when you specifically want their food and get a discount. Example KFC or Dominoes.

[FeckOffTeaCup]

Came for the API security, stayed to get shamed over my Mc. D's ordering habits.

[sambhatia]

The fact that I am watching this first thing on a Saturday should show my love for this channel.

[brodie]

getting paid more for reacting to it than discovering it is crazy

[chipredacted]

Dude I used the McDonalds app the other day, and with how terrible it is, I was thinking "if they're this bad at front end, imagine how their back end is"

[smartperson]

"People in India are fairly healthy" - loll nope, very high rates of obesity and diabetes in India these days :-(

[artemus]

"It's interesting McDonald's India takes security more seriously." Yeah sure, very very seriously.😂

[_Aarius_]

15:00 thats why web developers should practice postman-first development. Dont trust the UI, base everything on the requests themselves