Hackers Reportedly Accessed RBI Restaurant Systems Through Weak AWS Controls

Summary

A report discussed by the hosts says two self-described ethical hackers accessed RBI International’s AWS environment, exposing employee information and an admin token with access to 30,000 restaurant locations. The hosts say RBI fixed the issues quickly.

Key points

The hosts say Bob the Hacker and Bob the Shoplifter reported accessing RBI International’s AWS environment.
The reported findings included a global store directory with employees’ personal information and an admin token granting access across 30,000 restaurant locations.
The hosts describe access through an account-creation function that should have been disabled and an easily guessable or default admin password.
The reported access included a drive-through system containing recordings of customer conversations.
The hosts say no customer data or point-of-sale data was compromised, and that RBI fixed the security issues quickly.
The hosts say the hackers were not hired to test RBI’s systems and discuss the access as unauthorized, despite the hackers’ self-description as ethical.
The hosts report that RBI contractor Cyel issued a DMCA takedown request concerning the hackers’ blog; they say a copy remained available through the Internet Archive.

Article Details

Topics: [03:08] Reported access to RBI International’s AWS environment and restaurant systems
[03:44] Exposed employee information, admin access, and drive-through recordings
[04:12] Account creation and weak or default admin password described as access paths
[05:21] RBI’s reported remediation and debate over whether the testing was authorized
[06:24] Contractor’s DMCA takedown request and the blog’s continued availability in the Internet Archive
[07:38] Hosts’ account of data not compromised and security weaknesses disclosed

MITRE ATT&CK

T1078.001 · Default AccountsThe hosts say access involved an easily guessable or default admin password, consistent with the use of default accounts.T1098 · Account ManipulationThe hosts say the hackers used an account-creation process and then promoted themselves to admin.

People

Dave BalesHost who discussed the reported incident, its access method, and remediation.Nick BradleyHost who discussed the reported RBI International security incident and its implications.Space RogueHost who discussed whether the reported testing was authorized and the security implications.

Products

AWS[03:17] poked around in the AWS infrastructure