Security researcher BobDaHacker identified vulnerabilities in McDonald’s digital infrastructure that potentially allowed access to internal systems and customer personal data. The company has fixed some of the issues, but its slow response and lack of a convenient channel for security reports raise questions about its information security.
Renowned security researcher BobDaHacker has discovered serious vulnerabilities in McDonald’s digital infrastructure that could allow attackers to gain access to internal systems and customer data. This was reported by Tom’s Hardware, citing Glavkom.
According to the researcher, it took three months to implement a full-fledged account system in the Feel-Good Design Hub service for McDonald’s employees, but the problem remained: by replacing the word ‘login’ with ‘register’ in the URL, it was possible to gain access to accounts.
In addition, the registration system had errors with mandatory fields, which made it easier to create accounts, and passwords were sent to new users in plain text. API keys and McDonald’s secrets were found in the JavaScript code, which could potentially be used for dangerous actions.
The researcher had to make a considerable effort to communicate the vulnerability to the company. Although McDonald’s has fixed ‘most of the issues,’ a security reporting channel has not yet been established, and the employee who helped resolve the issues has been dismissed.
Experts note that the company’s slow response and lack of a convenient way to report security issues call into question the level of information protection at McDonald’s and highlight the need to review its approach to cybersecurity.
