If you are from India and have ordered Burger in McDonald’s, your personal details are at risk.
Security researchers from Fallible found a serious vulnerability McDonald’s India application that allows hackers to access millions of customer data.
There is no authentication or authorization check in API used in the application. Sending request to “https://services.mcdelivery.co.in/ProcessUser.svc/GetUserProfile” with customer id in the header allows to access customer details.
The customer id is a sequential number. All an attacker needs to do is create a script and increase the number to dump all customer data.
“The lack of strong data protection and privacy laws or penalties in India, unlike the European Union , United States or Singapore has led to companies ignoring user data protection” The researcher said.
“We have in the past discovered more than 50 instances of data leaks in several Indian organizations.” The researcher said.
The vulnerability allows attackers to obtain name, address, email address, phone number, Date of birth, GPS Co-ordinates and social profile details.
The researchers reported the issue to McDelivery on 4th February, 2017. After few days(13th Feb), they received an acknowledgement from the McDelivery IT Manager. From 7th march, Fallible tried to contact the McDelivery to know the status. However, there is no response from their side. The bug is still not fixed, at the time of writing.
Source:https://www.ehackingnews.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
