Get all your news in one place.
100's of premium titles.
One app.
Start reading
Tom’s Hardware
Tom’s Hardware
Technology
Nathaniel Mott

Security researcher driven by free nuggets unearths McDonald's security flaw — changing 'login' to 'register' in URL prompted site to issue plain text password for a new account

McDonald LinkedIn
McDonalds storefront.

"Would you like to access sensitive information?" might be the new "Would you like fries with that?" A security researcher called "BobDaHacker" has just revealed how he went from scoring free McNuggets via the fast food chain's mobile app to repeatedly gaining access to a McDonald's platform meant only for employees and franchisees.

"The McDonald's Feel-Good Design Hub is their central platform for brand assets and marketing materials - used by teams and agencies across 120 countries. It used to be 'protected' by a client-side password. Yes, CLIENT-SIDE," BobDaHacker said, an issue he first spotted while trying to use a reward for some free nuggets. "After I reported this, they took 3 months to implement a proper account system with different login paths for McDonald's employees (using their EID/MCID) and external partners ... Except there was still an issue. All I had to do was change 'login' to 'register' in the URL" to create a new account that could access the platform.

Sign up to read this article
Read news from 100's of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Does your sleep tracker get it right? A Pittsburgh neuroscientist weighs in
On a typical night, I go to bed wearing a tracking watch on one wrist and another type of tracker on the other wrist. Then I compare their sleep findings while I drink my morning coffee.
The Conversation
The Conversation
There's A Reason Taxi Cabs Are Almost Always Yellow
Yellow taxis are easy to spot in traffic, but the color's history goes far beyond simple visibility.
Motor1
Motor1
How ‘technoference’ can disrupt parent-child connections
Have you ever been telling someone a story when their phone lights up, and their eyes flicker toward their device?
The Conversation
The Conversation
Holding Lightning by Emily Lordi review – an intimate portrait of Whitney Houston
An empathetic biography of the the singer recasts her tumultuous later career as a triumph of self-expression
The Guardian - UK
The Guardian - UK
Brian May says Queen are retiring from live tours: ‘Maybe 50 years is enough’
Rock guitarist suggested creating an interactive experience for fans similar to the ‘Abba Voyage’ show
The Independent UK
The Independent UK
"Lanterns" finds its power in fear
To fulfill his destiny, John Stewart embraces what he was trained to reject — and so should we
Salon
Salon
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.
Download on the AppStore Get it on Google Play