Researcher Who Privately Reported Flaws Receives Legal Threat
Burger King wants to have its way online by forcing a security researcher into taking down a blog post detailing security flaws allowing hackers to remotely eavesdrop on drive-through orders and access employees’ personal information.
See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense
Self-described ethical hacker “BobDaHacker” posted Saturday a blog post disclosing authentication bypass and other vulnerabilities in the “Assistant” system used by Toronto-based Restaurant Brands International, parent company to the hamburger chain as well as Tim Hortons, Popeyes and Firehouse Subs.
The “Assistant” system is deployed across RBI brands, BobDaHacker said in the now-deleted report, which remains archived online.
The blog post, titled “We Hacked Burger King,” was up for less than 48 hours, until the researcher said they received a copyright infringement notice transmitted by threat intel firm Cyble. “Their complaint specifically states that our use of the ‘Burger King’ trademark was unauthorized and creates ‘a high degree of confusion among the public that the website is in some way endorsed by/or linked with our client,'” BobDaHacker said in a statement posted to the URL where their research previously was live.
“The notice claims our security research content ‘promotes illegal activity and spreads false information’ and that such activities are ‘detrimental to the goodwill and reputation’ of their client and ‘actionable at law under gross unfair competition.'”
RBI and Cyble didn’t immediately respond to a request for comment. RBI is a publicly traded multinational that operates 30,000 restaurants globally with $45 billion in annual sales.
BobDaHacker said they retained no customer data encountered through their research and that “responsible disclosure protocols were followed throughout.” The hacker said they reported Assistant flaws to RBI one hour after their discovery. The same day, RBI fixed the vulnerabilities – and Cyble in short order sent a takedown request under the U.S. Digital Millennium Copyright Act, alleging that the researcher violated RBI’s trademark and promoted illegal activity. Cyble advertises “brand protection” as a service to clients.
In response to the researcher reporting why their report was no longer online, multiple cybersecurity professionals took to social platform Mastodon to post archived copies of the research as well as photographs of Barbra Streisand, referencing the Streisand effect, in which attempts to suppress public knowledge about something lead to it becoming much more widely disseminated and known.
List of Security Shortcomings
BobDaHacker’s research details how RBI’s drive-through system is built on AWS Cognito, a web and mobile app platform created by Amazon Web Services. “The good news? The system worked exactly as designed,” said BobDaHacker in the now-deleted report. “The bad news? They forgot to disable user signups. Oops.”
BobDaHacker said the system could be tricked into creating a new user, then emailing a password in plaintext to the user, after which BobDaHacker accessed the RBI system and found that it granted access to information pertaining to any store that used the system, without requiring any further authentication. The researcher also found a GraphQL mutation that allowed them to promote themselves to admin across the entire platform, allowing them to add or remove stores, view and edit employee accounts, send notifications to drive-through and bathroom-feedback tablets and more.
The system also gave them access to RBI’s equipment ordering website, which was password-protected, but using a password hardcoded in the HTML on the client side. The researcher also found a page franchisees use to order a drive-through starter pack that included an audio box for installing inside the restaurant, as well as a tablet for mounting next to the point-of-sale system for drive-through orders.
BobDaHacker said the audio was being stored and could be replayed. Audio interaction transcripts posted by the researcher verge on the highly mundane.
—Welcome to Burger King, where you rule. What can I get started for you?
—Can I get the enormous Burrito?
—I’m sorry?
—The enormous burrito.
—The enormous burrito?
—Yeah.
—OK, hold on one second.
The researcher said the dashboard also reported insights based on the audio being run through an artificial intelligence system designed to measure an employee’s “friendliness” score. The AI system also assessed how long an employee kept other customers waiting, recorded if they attempted to upsell customers and were successful – including how – and whether they opened every customer interaction with the phrase, “You rule.”
As alleged, the security smarts of whoever built RBI’s Assistant app didn’t rule.