Are you sure of your current data security position?
At least two users of the McDonalds mobile app aren’t lovin’ it after thieves hijacked their accounts and ordered hundreds of dollars of food for themselves.
Lauren Taylor of Halifax, Nova Scotia was shocked to find her bank account almost empty after someone used the McDonald’s mobile app to buy $500 of fast food over 1200 kilometres away in Montreal, Quebec.
The crook managed to compromise her account to run up the bills in a five-day period from 25-29 January. Every time the hungry hijacker scored a Big Mac and fries, a receipt showed up in her inbox. Unfortunately, she doesn’t check her email that regularly. By the time she did, she had just $1.99 left. She explained that she had to find rent, and presumably someone in Montreal had to find a larger pair of pants with an elasticated waist.
After ordering food through the McDonalds app, customers can check in when they reach the restaurant. The app then charges the debit card that they registered onto the system, and a member of staff will deliver it to them curbside. To get the food, the customer has to provide a four-digit code given to them by the app.
McDonalds Canada denied that there was a security problem with the app in an email to Canada’s CBC. A spokesperson said:
We take appropriate measures to keep personal information secure, including on our app. Just like any other online activity, we recommend that our guests use our app diligently by not sharing their passwords with others, creating unique passwords and changing passwords frequently.
Taylor claims that she did, though, arguing that she changes her passwords regularly, never shares them, and keeps them strong. The McDonalds app requires passwords to be eight to 12 characters long, with upper and lowercase characters and at least one number.
Taylor’s isn’t the only case. CTV also found a woman in Ontario who saw McDonalds purchases in another city racked up on her account. Then there were another two incidents involving Halifax residents Tracy Creaser and Brett O’Donnell.
It wouldn’t be the first time that McDonalds has served up hot, tasty customer data. In March 2017, McDonalds India urged people to upgrade its McDelivery app after it was reported that it was leaking the personal details of 2.2m users, including their name, email address, phone number, home address and coordinates and social profile links. Attackers could harvest the information by serially incrementing user ID parameters passed to the API, the security researchers said.
In January 2017, cybersecurity engineer Tijme Gommers disclosed a vulnerability showing how to steal customer passwords from the McDonalds website, drawing flak from readers of YCombinator’s Hacker News for not giving the fast food merchant enough time to serve up a response. However, that vulnerability was closed after the fast food chain upgraded its version of Angular to 1.6.
Are you sure of your current data security position?
If you’re unsure of your current data security position, or just simply want to have a chat, come and visit Macnair’s stand F04 at the Accounting Business Expo on the 21st and 22nd March 2019. We’ll be located just inside the entry on the right.
Click here to reserve your VIP Seat to any of our free seminars being held on our stand.
Not coming to the show, simply call me on 02 8814 5011 or shoot through an email to info@macnair.com.au and I’d be more than happy to answer your questions.
Brad Lynch | Macnair | blynch@macnair.com.au
www.macnair.com.au
- Five Eyes Nations Warn MSPs of Stepped-up Cybersecurity Threats - 13 July 2022
- Device as a Service (DaaS): Your Next Business model? - 14 May 2022
- 4 Ways to Strengthen Your Firm’s Cybersecurity Infrastructure to Prevent an Attack - 15 February 2022
