We Hacked Burger King: How Auth Bypass Led to Drive-Thru Audio Surveillance

Re:We Hacked Burger King: How Auth Bypass Led to Drive-Thru ... by kevincox on Sunday September 07, 2025 @06:55AM (#45157089)

If you assess that the best time to publicly disclose is immediately then disclose immediately.

But I find that this case is rare. Typically it would be something like many of the following being met:

- It is likely to be discovered by an attacker soon.

- History shows that the company is unlikely to fix it soon.

- Users have some way to protect themselves.

- Your disclosure is likely to reach a significant number of users.

[ Parent | on HN ]

Re:We Hacked Burger King: How Auth Bypass Led to Drive-Thru ... by akerl_ on Sunday September 07, 2025 @07:38AM (#45157323)

How do you know it hasn’t been discovered by another attacker already?

[ Parent | on HN ]

Re:We Hacked Burger King: How Auth Bypass Led to Drive-Thru ... by ranger_danger on Tuesday September 09, 2025 @02:07PM (#45185930)

You don't, but you make a judgement call based on different criteria, such as how difficult the issue was to find, maybe how popular/big the site is, etc., as to whether or not you think anyone else is likely to know about it already.

[ Parent | on HN ]