Restaurant chain McDonalds is running an insecure website that could enable users‘ passwords to be compromised.
The vulnerability was uncovered by Dutch security expert Tijme Gommers, who informed McDonalds, but decided against waiting the customary 30 days before telling everyone else as the company didn’t condescend to reply to his security reports.
The problem, claims Gommers, isn’t just the frowned-upon practice of storing the user password on the client, but also the outdated version of Angular JS that McDonalds runs on its website.
„By abusing an insecure cryptographic storage vulnerability and a reflected server cross-site-scripting vulnerability it is possible to steal and decrypt the password from a McDonald’s user,“ he wrote in a blog uncovering the security shortcoming .
Rather than hash user passwords like all the cool kidz do, McDonald’s instead encrypts passwords on the client – a somewhat frowned-upon security practice, to say the least.
