I’m Lovin’ It: Exploiting McDonald’s APIs to hijack deliveries and order food for a penny
A series of API flaws in McDelivery India made it possible to order food for a penny, hijack other people’s delivery orders, view user information, and more.
I’m Lovin’ It: Exploiting McDonald’s APIs to hijack deliveries and order food for a penny Eaton • Dec 19, 2024 Copy Link Share Discussion links: Reddit | Hacker News Thank you to the Reddit netsec community for making this the most upvoted post of 2024 with 300k+ views ! 🏆 News coverage: TechCrunch Verdict Food Service SecurityWeek Heise (German) WinFuture (German) TechRadar Want to watch a video version? Check out this great video by LowLevelTV covering this disclosure. Key Points / Summary API flaws in the McDonald’s McDelivery system in India, one of the world’
saved by
related reading
- Everything I know about good API designseangoedecke.com
- Doordash and Pizza Arbitragereadmargins.com
- APIs All the Way Down - Not Boring by Packy McCormicknotboring.co
- They Hacked McDonald’s Ice Cream Machines—and Started a Cold War | WIREDwired.com
- The Newest Instagram "Exploit" is the Goofiest I've Seen0xsid.com
- Why Fast Food Got So Expensiveyoutube.com
- Why We Don’t Trust the Database With Authentication – Sturdy Statisticsblog.sturdystatistics.com
- php situation is insaneyoutube.com
- How I found two api vulnerabilities by analyzing JS source codemedium.com
- GitHub - public-apis/public-apis: A collective list of free APIsgithub.com
- I built a tiny MCP server to use Reddit from Claude after Reddit blocked anonymous API access : r/ClaudeAIreddit.com
- Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies | by Alex Birsan | Mediummedium.com