Tag Archives: hacker

McDonalds Mobile Hack – Canadien Uses McDonalds Mobile App To Run Up Bills

The Canadian McDonald’s app, called My McD’s, is just the latest target for cyber criminals. Last year, they were busy stealing Aeroplan and PC Optimum rewards points from some members’ online accounts. Many of the fraudsters involved in PC Optimum cases also carried out their crimes in Quebec.

Cybersecurity expert Ritesh Kotak said that in the digital era, companies need to pull out all the stops to protect consumers from cyber criminals.

“We’re moving to a cashless society,” said Ritesh who’s based in Toronto. “They put all this money into app development, are they putting the same amount of money and rigour and research into the security component of it?”

Privacy Exploit – Easy Lobby Visitor Kiosk Access Systems and Others

Read full article on ThreatPost

Student researchers working with IBM X-Force Red team find security holes in five leading visitor management systems.

Excerpt:

Visitor-management systems protect business against physical threats such as unwanted and unidentified guests. But many of these lobby-based perimeter checkpoints are opening up companies to a bevy of cyber-threats.

On Monday, IBM’s penetration testing team, X-Force Red, released a report that outlines 19 bugs found across five leading visitor-management systems. Vulnerabilities range from data leakage, complete program takeover and the ability for a visitor to press Windows’ hotkeys to break out of the kiosk environment. Affected are systems made by HID Global (EasyLobby Solo), Threshold (eVisitorPass), Envoy (Envoy Passport) and The Receptionist (The Receptionist).

Interestingly, the research was conducted by IBM summer interns (Hannah Robbins and Scott Brink) under the guidance of the X-Force Red research team.

“These are really interesting targets. By their very nature, they are exposed to the public that has no credentials,” said Daniel Crowley, IBM X-Force Red’s research director.

Crowley said researchers had three goals in testing the visitor-management systems. “One, was how easy is to get checked-in as a visitor without any sort of real identifying information. Secondly, we set out to see how easy is it to get other people’s information out of the system. And third, is there a way that an adversary can break out of the application, cause it to crash or get arbitrary code-execution to run on the targeted device and gain a foothold to attack the corporate network,” he said.

Researchers said they were able to accomplish all three.

Read full article on ThreatPost