<div dir="ltr"><a href="http://www.itsecurityguru.org/2017/01/17/mcdonalds-website-insecurity-leaves-users-passwords-vulnerable/">http://www.itsecurityguru.org/2017/01/17/mcdonalds-website-insecurity-leaves-users-passwords-vulnerable/</a><br><br>McDonald’s has been caught by <a href="https://finnwea.com/blog/stealing-passwords-from-mcdonalds-users">Dutch security expert Tijme Gommers</a> running
an insecure website that could lead to users passwords being stolen.
According to Gommers, by abusing an insecure cryptographic storage
vulnerability (<a href="https://www.owasp.org/index.php/Top_10_2007-Insecure_Cryptographic_Storage" target="_blank" rel="noopener">link</a>) and a reflected server cross-site-scripting vulnerability (<a href="https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_%28XSS%29" target="_blank" rel="noopener">link</a>)
it is possible to steal and decrypt the password from a McDonald’s
user. Besides that, other personal details like the user’s name, address
& contact details can be stolen too.
<p>Security experts share their views on the insecurity, with advice for users:</p>
<p><strong>Mark James, IT Security Specialist at <a href="http://www.eset.co.uk/">ESET</a> explains why this was bad practise from McDonald’s:</strong></p>
<p>“It’s hard enough these days keeping your passwords unique and safe
from modern threats and cybercriminals without companies making life
easy for them. Encrypting passwords on the client side is plain and
simply bad security practise. An attacker could, through a phishing
attack, fairly easily compromise those passwords and indeed anyone
else’s password used on the McDonalds site, as the same key is used for
every user. If that user were to use the same username (email address)
and password on other websites (that may of course include financial
logins) those credentials could easily be stolen and used elsewhere.”</p>
<p>“Making sure your server and applications are using the latest and
indeed secure software is one of the ways of maintaining the level of
security that users would expect from the companies entrusted with their
safety. Software improves at an astonishing rate and likewise some
software is proven to not actually be safe enough for purpose. When this
happens the simple truth is you have to move to something safer. Yes,
there’s a cost and yes it takes time but ultimately you have an
obligation to do all you can to protect your users’ data if you store
it. The AngularJS sandbox was removed from version 1.6 onwards as it was
found to give a false sense of security, at that point alarm bells
should be ringing, time to upgrade and or evaluate the consequences of
running outdated insecure versions of software with known security
vulnerabilities.”</p>
<p><strong>Tim Erlin, Sr. Director, Product Management at <a href="http://www.tripwire.com/">Tripwire</a>:</strong></p>
<p>“It’s easy to see why financial information like credit card or bank
account details are valuable to criminals, but simple personal
information can be a target for cybercrime as well. High quality
personal information, including full names and email addresses, can be
sold for profit.</p>
<p>It’s important for companies to work with security researchers,
rather than against them. While it can be tough to accept vulnerability
reports from third-parties, a policy of cooperation generally delivers
better results.”</p>
<p><strong>Javvad Malik, security advocate at <a href="https://www.alienvault.com/?utm_source=google&utm_medium=cpc&utm_term=kwd-54306795668&utm_campaign=BRAND-EMEA-GGL-SE&gclid=CJnU9Pz9xtECFRQ8GwodSQ8PKw">AlienVault</a>:</strong></p>
<p>“There’s no need to ever encrypt passwords. (I made a <a href="https://youtu.be/FYfMZx2hy_8">video</a> on
this topic a couple of years ago). The thing with encryption is that it
is designed to be two-way. So if you can encrypt something, it is
possible to decrypt it. Which is why a one-way hash (with salt) is
commonly used to protect passwords. A hash is one way (like a
fingerprint) just like a finger can always create the same finerprint,
but the fingerprint can’t create the finger. Use of any out-dated or
vulnerable software is always a risky prospect, particularly on
public-facing websites.</p>
<p>These are not obscure vulnerabilities or zero days. There are
well-established standards on how to secure web applications and
securely implement user authentication, including how to manage
passwords.”</p>
<p><strong>Jonathan Sander, VP of Product Strategy at <a href="https://liebsoft.com/">Lieberman Software</a>:</strong></p>
<p>“When you’re thinking of places you need to apply special care to
your online life’s security, the McDonald’s website doesn’t leap
immediately to mind. However, imagine the hapless user who has been
exploited on the McDonald’s site finding they can’t supersize their meal
today because their bank account has been emptied by a bad guy who had
it his way with the person’s bank account since they used that same
McDonald’s password on their bank’s site.</p>
<p>Not all Internet services are created equal. All good sense and
advice tells you to take more care managing your bank’s website password
than a password you use for some fast food joint. You can work out that
your Facebook password is a little less important than your bank, but
still more important than McDonald’s. What this McDonald’s vulnerability
reminds us is that everyone needs to have at least a minimum amount of
caution everywhere online. This serves to reinforce the advice users are
given all the time – never use the same password for multiple sites,
especially not low priority sites. McDonald’s isn’t exactly protecting
the world’s most important data on their customer website. All the same,
using very old servers and tools on the site which have well known
security problems seems irresponsible.”</p><br></div>