Reverse-engineering the Starbucks ordering API

Re:Reverse-engineering the Starbucks ordering API by coworkerblues on Thursday July 13, 2017 @12:40AM (#14758764)

I want to write a similar write-up for a company which basically does everything over HTTP with their own half-baked hardcoded AES key in app for sending credit card info. and that their confirmation checkup is stupid (for SMS) and can be bypassed.

The problem is that their site TOS forbids reverse engineering, and I am afraid their lawyers will go after me instead of fixing the security issues (even if I just contact them), any tips for me ?

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by Rjevski on Thursday July 13, 2017 @05:14AM (#14759841)

Disclose everything over Tor. The kind of scum that sends credit card data over insecure homebrew crypto deserves no mercy.

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by coworkerblues on Thursday July 13, 2017 @01:59PM (#14763572)

I would rather contact them anonymously first, also I don't understand exactly how Tor would help me with this.

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by Rjevski on Thursday July 13, 2017 @07:17PM (#14766116)

Tor will help you by hiding your identity so they will be in a dead end when they sue and try to find you.

And yes of course you can also use Tor to contact them anonymously before disclosing.

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by coworkerblues on Saturday July 15, 2017 @01:49AM (#14775199)

Besides telling me to use tor (which I know in general what it is), is there a guide I can use ? (i.e. how to send / recv anonymous email on tor from a non tor address ?) or something ???

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by Rjevski on Saturday July 15, 2017 @02:36PM (#14778166)

Use the following to get a live OS with Tor preinstalled: https://tails.boum.org

Once you're in there you can just use the Tor browser to create an email account at any email provider (make sure you give them fake details though) and send your email.

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by coworkerblues on Saturday July 15, 2017 @04:04PM (#14778649)

Which email provider allow opening an account from a known tor exit node ?

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by mplewis on Thursday July 13, 2017 @04:50PM (#14765096)

Rjevski suggests you publicly disclose the vulnerability in an anonymous way that can't be traced back to you.

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by cwsx on Thursday July 13, 2017 @01:21AM (#14758915)

Just formally ask the company, if they don't want you to they will tell you. Could be worth including a pitch of sorts ('Hey, Ive noticed a few problems using your site...') but MAKE SURE you don't incriminate yourself. Do NOT show evidence of you 'reverse engineering' anything.

Do not do anything without gaining permission, as there's a very good chance you're going to run into their legal team.

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by coworkerblues on Thursday July 13, 2017 @01:59PM (#14763569)

I don't want to contact them in a way that they can trace me, since I'm pretty sure that they will try to covert up / threat me (I would hope that someone there already knows this is an issue....).

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by shinolajla1 on Thursday July 13, 2017 @04:19PM (#14764808)

Starbucks has a bug bounty program, and they do actually pay out. https://www.starbucks.com/whitehat

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by coworkerblues on Saturday July 15, 2017 @01:59AM (#14775220)

Nice (altough the URL does not work) unfortunately in our startup nation there are 0 programs like this :(

[ Parent | on HN ]

Re:Reverse-engineering the Starbucks ordering API by qb45 on Thursday July 13, 2017 @04:00AM (#14759531)

> HTTP with their own half-baked hardcoded AES key in app for sending credit card info.

You mean, no TLS, JavaScript crypto and credit card info?

Are there no authorities to report that kind of garbage? No certification they are supposed to pass? I would research that angle first before hacking. It doesn't take any reversing to realize everyone can pwn you on a public WiFi.

Otherwise, at the very least use tor...

[ Parent | on HN ]