What's inside the QR code menu at this cafe?
A recent investigation revealed significant security flaws in Dotpe's QR code menu system, allowing unauthorized access to sensitive customer data, raising concerns about data privacy and the need for improved security measures.
Read original article
A recent exploration of a cafe's QR code menu revealed significant security vulnerabilities in the Dotpe platform, which facilitates contactless dining. After scanning the QR code, the user was able to place an order without any verification, leading to concerns about data privacy. Upon further investigation, the user discovered that the API endpoints were poorly secured, allowing access to sensitive information such as ongoing orders, purchase history, and personal details of other customers. This included the ability to view the names and orders of patrons at different tables, raising alarms about potential data breaches. The user also noted that Dotpe's services are utilized by numerous restaurants across India, including major chains, but many have seen a decline in usage post-pandemic. The findings suggest that Dotpe's API design lacks basic security measures, potentially exposing customer data to unauthorized access. The user expressed disbelief at the ease of accessing such information and questioned whether Dotpe was aware of these vulnerabilities. The situation highlights the need for improved data protection practices in digital ordering systems.
- Dotpe's QR code system allows easy access to sensitive customer data without proper authentication.
- Users can view ongoing orders and personal information of other patrons at the same restaurant.
- Many restaurants using Dotpe have seen a decline in QR code usage since the end of COVID restrictions.
- The findings raise concerns about data privacy and the potential for misuse of customer information.
- There is a call for better security practices in digital ordering systems to protect consumer data.
Related
Man makes money buying his own pizza on DoorDash app
A US pizza restaurant owner discovered DoorDash selling his pizzas at lower prices without permission. DoorDash conducted a trial without informing owners, sparking scrutiny over its business practices and CEO's controversial remarks.
Client-side filtering of private data is a bad idea
Matthew Garrett revealed security vulnerabilities in the dating app Feeld, indicating misleading privacy claims, retrievable sensitive data, and challenges in reporting issues, stressing the need for robust security measures.
32M invoices, contracts, patient consent forms, and more exposed to the internet
A non-password-protected database belonging to ServiceBridge exposed approximately 31.5 million documents, including sensitive personal and business information, raising significant privacy concerns and highlighting the need for better data protection practices.
Feeld dating app – Your nudes and data were publicly available
The Feeld dating app has critical security vulnerabilities allowing unauthorized access to user data, including private messages and sensitive media, highlighting an urgent need for improved security measures.
Using Security Engineering to Prevent Phishing – Doyensec
Doyensec's security review identified critical vulnerabilities in a Communication Platform as a Service, including file upload bypasses and subdomain validation flaws, recommending stricter filtering and user warnings to enhance security.
- Many commenters criticize the public disclosure of the vulnerabilities without prior notification to Dotpe, arguing it is unethical and could harm businesses.
- Several users share personal experiences with similar vulnerabilities, emphasizing the importance of responsible reporting.
- There are discussions about the potential legal consequences for the author of the article due to the sensitive nature of the disclosed information.
- Some commenters express skepticism about the effectiveness of QR code systems in ensuring data privacy and security.
- Overall, there is a call for better security practices and ethical standards in handling vulnerabilities.
46 commentsThere are pretty common ethical standards about disclosing vulnerabilities privately before disclosing them publicly. I don't see how the obviousness of the vulnerability changes the situation. By warning the company, you give them the opportunity to remedy the problem before announcing to the world that anyone with a laptop can exploit it. Probably they were just hoping that nobody would notice, which is stupid of course, but now they don't have the chance to build up a better wall before the flood of fake orders that could cause real harm to the small businesses whose financial information you disclosed online.
Perhaps I'm being too optimistic about how the company would respond, but I still think it's hard to justify not doing a private disclosure.
Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.
On a more positive note, I've used a QR menu recently and it really is a game changer. Scanned a code, pressed a few buttons, and my food was there in minutes! Looking forward to seeing it more often, especially in places where you're not looking for stellar service.
Leaving PDPA aside, as a Software professional I find this act kiddy and unethical. 10 years back I found a major vulnerability bug in an major multinational bank where I was able to see monthly statements of any person. I reported this to the bank and they took approx 1 year to fix that. I did not even mention about this bug to my friends or my CV till it was fixed.
You can get their gender, age, name, mobile number.
I simply reported it to their website's support email and state cyber cell.
This was 7 years ago, that vulnerability still exists.
The other day I was at burger king. They allow you to refill your drink as many times as you like within 60 minutes of purchasing it, and the way this restriction is implemented is by having you scan a QR code they print on your receipt at the drink machine. I scanned the QR code with Binary Eye (android app that reads all sorts of barcodes, highly recommended). It contained some numbers I couldn't immediately recognize as interesting, a timestamp in a format similar to 202409231049, and a UUID.
Now, the UUID is probably the ID of the order in their internal system, so the question is: does the drink machine only read the timestamp or does it also use the UUID to query the internal system to re-validate it? Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills?
With a couple of clicks on the web app, you'd encounter a bug... and then you can see every single person's orders, email, and personal addresses. And it was my partner who discovered it (she was struggling to order service through the website bc it kept failing).
Oh and they also never charged us for service despite multiple emails asking them how we should pay (somehow we were able to order service through the site but never paid?)
Clearly they're not a serious company...
source: https://x.com/prstb/status/1838179660959465596
Original blog post, archived copy: https://web.archive.org/web/20240923091701/https://peabee.su...
I am sure some companies using that service will ask for more closed doors before everyone can lookup their revenues. That's one big example of a non technical vulnerability based on a 101 technical principle.
On the other hand, I agree with other comments that posting the whole financials of a company does not seem like a good idea
PS: I really like your writing style. Subscribed your newsletter
Yikes.
As one commenter on X(itter) said that the only way this company will think about fixing this is when another competitor who will gather all their customer's details and send emails to them to migrate to their service if they don't want their precious data to leak.
From the comments it seems likely the author realized they may have accidentally committed a crime or at least done something that could cause real legal consequences for them and quickly destroyed the evidence. That's probably better than leaving it up but I'd wager it wouldn't protect them from any legal consequences publishing the article already made possible.
There's a problematic but not critical personal information leak, a mild business intelligence leak and that's about it.
> They could keep this script running for months, even years, creating awkward scenes and uncomfortable conversations at every restaurant across the country.
If that's about the worst thing you can actively do, then it's only about the data leak.
Isn’t this just sample size one? In other systems this information can be passed securely and not leaked later.
Having a complete lack of any authentication and sequential IDs does seem like a design decision.
Anyone have a cached copy?
You can spend countless hours trying to break your application, finding holes but who cares.
Police cares about financial fraud. Did someone clickbait you into swindling money from you? well they will pounce on it because they will extract their cut from all involved and it gives them nice PR on the daily newspaper.
PII fraud or vulnerability, eh well. whose gonna notice? we have enough on our plates.
second thing. whatever government is doing, they protect themselves at all costs. they WILL throw you under the bus if it protects their interests.
why? because of the massive population, jobs are scarce, people get college degrees and stuff to pad up their resumes because employers, govt or private REQUIRE documentary evidence you did something. doesn't matter your skills,y ou have the papers or not.
this dotpe company, whatever its doing is indicative of the systemic problems in india. You have lots of people, lots of smart people, lots of dumb people and in the long run, bigger, cheaper, faster. that's all that matters
I think it would be great if you could go to a restaurant and they had this data available. Sure, some menus say "best seller!" but I don't believe them all the time. And tastes change, chefs, etc.
Please no one write that random script… f*king up high cash flow but ultimately usually pretty low margin businesses like these, while also pushing the poor staff around in a way that costs them time and very likely wages is really, really, really bad karma.
Seriously, its a PII leak and it should be reported. And since you said Google is an investor someone (theoretically) should care.
Makes this blog post sound like an advert for whatever this product is.
Maybe the next big app for AI is to analyze web pages and scrub this crap out of otherwise decent articles.
Related
Man makes money buying his own pizza on DoorDash app
A US pizza restaurant owner discovered DoorDash selling his pizzas at lower prices without permission. DoorDash conducted a trial without informing owners, sparking scrutiny over its business practices and CEO's controversial remarks.
Client-side filtering of private data is a bad idea
Matthew Garrett revealed security vulnerabilities in the dating app Feeld, indicating misleading privacy claims, retrievable sensitive data, and challenges in reporting issues, stressing the need for robust security measures.
32M invoices, contracts, patient consent forms, and more exposed to the internet
A non-password-protected database belonging to ServiceBridge exposed approximately 31.5 million documents, including sensitive personal and business information, raising significant privacy concerns and highlighting the need for better data protection practices.
Feeld dating app – Your nudes and data were publicly available
The Feeld dating app has critical security vulnerabilities allowing unauthorized access to user data, including private messages and sensitive media, highlighting an urgent need for improved security measures.
Using Security Engineering to Prevent Phishing – Doyensec
Doyensec's security review identified critical vulnerabilities in a Communication Platform as a Service, including file upload bypasses and subdomain validation flaws, recommending stricter filtering and user warnings to enhance security.