Trusting clients is probably a security flaw
The article highlights security flaws in the McDonald's app, emphasizing that client trust can create vulnerabilities, as checks can be bypassed, leading to false positives and poor user experience.
Read original article
The article discusses the security flaws associated with trusting clients in app development, particularly in the context of the McDonald's app. It highlights how the app employs various checks to prevent users with modified devices from accessing its features, such as checking for root access or specific app installations. However, these measures can be easily bypassed by knowledgeable users, raising concerns about the effectiveness of such security protocols. The author notes that the app's reliance on client trust can lead to vulnerabilities, as the server does not adequately verify requests. This situation is exacerbated by the fact that many legitimate users may face issues due to false positives triggered by the app's checks. The article concludes that while the intention behind these security measures is to prevent fraud, they may ultimately hinder user experience and fail to stop determined attackers.
- Trusting clients in app security can lead to significant vulnerabilities.
- The McDonald's app employs strict checks that can be easily bypassed by knowledgeable users.
- False positives from security checks can frustrate legitimate users.
- The server's lack of verification for requests contributes to security flaws.
- Effective security measures should balance user experience with protection against fraud.
Related
Smartphone apps are a headache for travel, banking, hotels, apartments, laundry
Frustration grows over reliance on smartphone apps for services like travel and banking. Concerns include accessibility challenges, app reliability, and impact on older adults and individuals with disabilities. Maintaining a balance is crucial.
Has my mobile security advice changed?
Terence Eden reviews mobile security advice from a decade ago, emphasizing skepticism towards messages from trusted contacts, the importance of two-factor authentication, and the use of password managers and physical security measures.
Beware of Deceiving Authenticator Apps on Apple and Google Devices
Misleading authenticator apps on Apple and Google devices pose security risks. Users are advised to install only reputable apps, avoid those with fees, and share direct download links for safety.
Exploiting McDonald's APIs to hijack deliveries and order food for a penny
A security researcher found multiple vulnerabilities in McDonald's McDelivery system in India, allowing unauthorized access to user orders and sensitive information, highlighting the need for improved security measures.
Why it's hard to trust software, but you mostly have to anyway
The article highlights the challenges of trusting software, emphasizing reliance on vendors, verification difficulties, and the complexities of the software supply chain, while suggesting code signing as a partial solution.
- Many users express frustration with the app's excessive anti-root measures, leading to false positives and a poor user experience.
- There is a consensus that client-side validation is inadequate and that server-side validation is essential for security.
- Some commenters share experiences of other apps with similar issues, highlighting a trend in poor app security practices across industries.
- Users question the rationale behind McDonald's app development strategy, suggesting it may be driven by misguided corporate policies.
- Overall, there is a call for better practices in app development to enhance user trust and security.
20 commentsWhy am I so sure about this? I live on the other side of the world, the app is almost certainly an entirely separate codebase from the Polish one the article is about, and yet here too it has the worst anti-root measures of any app by any remotely large company, including finance, healthcare and government apps. Enormous numbers of false positives. Even for those with the most mainstream Android models around.
This will all just come down to one person at McD's HQ who is forcing through these ridiculous ideas and costing their company a bunch of money in the process. No other multinational employs this strategy to any similar degree.
Ah, this reminds me of the Tuya app.
I've done some ssl unpinning and mitm to see requests going in and out of my phone, it's pretty fun and there's often really nice and easy to use restful APIs underneath. Among them I've also done a couple of banking apps and they weren't particularly defensive either. That's great; as a user I'm empowered by it and like TFA says, it's totally fine from a security standpoint if you just don't trust the client to do anything they shouldn't be able to do. It shouldn't be your form validation that stops me from transferring a trillion dollars, and though I haven't tried, I'm sure that's not the case for those apps. All it does is allow me to get my monthly statements with a for loop rather than waiting for a laggy UI and clicking through each month.
Now, Tuya is a Chinese company offering a bunch of cheap IoT devices like smart power switches and IR motion detectors. You can interact with everything through their app. That app for some reason has spent by far the most resources on anti-RE of any apps I've seen. I already bought your hardware, mate. Please let me use it on my local network. My smart home infrared motion sensors were meant to turn lights on when I enter a room. But they don't feel very smart when I'm standing in the dark for 4 seconds while they check with a server in China. I don't even need a clean API; just let me see what you do, and I'll do something similar, no support or documentation necessary. But they go through extensive measures to prevent you from interacting with the hardware you bought and which is sitting in your home.
This was a while ago, but I think for the motion sensing in particular, I managed to just put them in a subnetwork with blocked internet access, and snooped on the network to catch their DHCP requests when they tried to call home. This would happen every once in a while presumably for settings/update checks, but crucially also when there was motion detected, and I didn't mind a few false positives. So in the end they were very quick, locally functioning, privacy-friendly little devices!
"But the problem with checking if the user is a god, is that the user is a god. They can just tell you what you want to hear."
NISUS: Good. Out of the door. Line on the left. One cross each. Next. Crucifixion?
MR. CHEEKY: Ah, no. Freedom.
JAILER: Hmm?
NISUS: What?
MR. CHEEKY: Eh, freedom for me. They said I hadn't done anything, so I could go free and live on an island somewhere.
NISUS: Oh. Oh, well, that's jolly good. Well, off you go, then.
MR. CHEEKY: Naa, I'm only pulling your leg. It's crucifixion, really.
The author earned a discount on his Big Mac.
Given the audience here, I hope many would agree it's pitiful that developers are wasting their time building this junk. Some poor sap had to make this, probably sighing and shrugging at the end of each line of code.
Unions or professional body membership is becoming more important for programmers. People need to be able to say "I studied what you asked me to make, and refuse to work on this illegal, insecure, depressing cruft, and if you fire me for having professional ethics my lawyers will empty your company bank account." Otherwise technologists become just tools of destruction.
The main problem is not that mcdonald's app, it's what else has the same team worked on...
Related
Smartphone apps are a headache for travel, banking, hotels, apartments, laundry
Frustration grows over reliance on smartphone apps for services like travel and banking. Concerns include accessibility challenges, app reliability, and impact on older adults and individuals with disabilities. Maintaining a balance is crucial.
Has my mobile security advice changed?
Terence Eden reviews mobile security advice from a decade ago, emphasizing skepticism towards messages from trusted contacts, the importance of two-factor authentication, and the use of password managers and physical security measures.
Beware of Deceiving Authenticator Apps on Apple and Google Devices
Misleading authenticator apps on Apple and Google devices pose security risks. Users are advised to install only reputable apps, avoid those with fees, and share direct download links for safety.
Exploiting McDonald's APIs to hijack deliveries and order food for a penny
A security researcher found multiple vulnerabilities in McDonald's McDelivery system in India, allowing unauthorized access to user orders and sensitive information, highlighting the need for improved security measures.
Why it's hard to trust software, but you mostly have to anyway
The article highlights the challenges of trusting software, emphasizing reliance on vendors, verification difficulties, and the complexities of the software supply chain, while suggesting code signing as a partial solution.