@bobdahacker@infosec.exchange avatar bobdahacker , to random

🐱 New Blog Post: Petlibro Smart Pet Feeder Vulnerabilities (Partially Fixed, $500)

Found critical vulns in Petlibro - one of the biggest smart pet feeder companies:

  • Auth bypass via broken OAuth - just need Google ID (public info via Google APIs) to login as anyone
  • Access any pet's data, devices, serial numbers, MAC addresses
  • Hijack any device - change feeding schedules, access cameras
  • Access private audio recordings (mealtime messages to pets)
  • Add yourself as shared owner to any device

The worst part? They "fixed" the auth bypass by making a new endpoint... but left the old vulnerable one active for "legacy compatibility." Two months later, still working.

Also tried to get me to sign an NDA AFTER paying the bounty. That's not how contracts work.

Full writeup: https://bobdahacker.com/blog/petlibro

@bobdahacker@infosec.exchange avatar bobdahacker , to random

🔓 Found critical vulns in Taimi (LGBTQ+ dating app) - all fixed, $10k bounty

What I found:

  • "Expiring" videos didn't expire, URLs stayed valid forever
  • Decrement attachment ID = anyone's private videos
  • Location feature bypassed photo permission checks (why upload a map preview image through the photo system??)
  • Fake system messages (made a Raid Shadow Legends sponsorship lol)

The good news: Taimi actually handled this right. Fast response, $10k bounty, everything fixed quickly. No lawyers, no threats.

This is how disclosure should work. Take notes, Lovense.

Full writeup: https://bobdahacker.com/blog/taimi-idor

@bobdahacker@infosec.exchange avatar bobdahacker , to random

🍔 Just collabed with @BobTheShoplifter on a MASSIVE SECURITY BREACH: We exposed how Restaurant Brands International (Burger King, Tim Hortons, Popeyes) left their drive-thru systems etc completely vulnerable.

🎯 What we found:
• Unauthenticated API access to ALL drive-thru locations globally
• Drive-thru voice recordings of customers accessible
• Employee PII exposed.
• Bathroom feedback systems with zero auth
• Hardcoded passwords in client-side code

The scope was insane - we could access any drive-thru system globally. Even listen to your actual drive-thru orders 👂

Credit to RBI for lightning-fast response once disclosed, but the privacy implications were staggering.

Full technical breakdown: https://bobdahacker.com/blog/rbi-hacked-drive-thrus

@bobdahacker@infosec.exchange avatar bobdahacker , to random

🤖 Hacked China's Biggest Robotics Company (Pudu Robotics)

Pudu makes those cat-faced BellaBot robot waiters you see in restaurants, plus cleaning robots, disinfection bots, and even FlashBots with mechanical arms for offices.

Found critical vulnerabilities in their app controlling their entire global fleet:

  • Zero authentication on APIs
  • Could control any robot worldwide
  • Accept 20k store IDs in single request, no rate limiting
  • Could steal food, documents, redirect hospital medicine delivery
  • FlashBot with arms could grab files & use elevators

Reported Aug 12. Sent emails to sales, support, tech teams - all ignored.

Had to email Skylark Holdings (7000+ restaurants) and Zensho directly about their compromised robots.

Pudu responded in 48hrs with obvious ChatGPT template - forgot to replace "[Your Email Address]" placeholder. Fixed 2 days later.

Thousands of robots (BellaBots, KettyBots, FlashBots, etc) in hospitals, restaurants, offices worldwide were vulnerable for a long time.

Full Technical Writeup: https://bobdahacker.com/blog/hacked-biggest-chinese-robot-company

@bobdahacker@infosec.exchange avatar bobdahacker , to random

Hacked Monster Energy 💀

They think their customers are "lower income Caucasian males (skews Hispanic)" and left their ENTIRE file system exposed.

https://bobdahacker.com/blog/monster-energy

@bobdahacker@infosec.exchange avatar bobdahacker , to random

🚨 Hacked India's biggest dating app Flutrr (backed by The Times of India). Critical security flaws expose millions of users.

Technical details:

  • Zero authentication checks on ANY API endpoint
  • Can read/send messages as any user via WebSocket
  • Access anyone's sensitive profile data, matches, conversations
  • Update any user's data by just changing UID in requests
  • Delete anyones account

Reported November 2024, they responded in March 2025 with a $100 gift card offer. Still unfixed.

Every single endpoint trusts client-provided user IDs without verification. This is as bad as it gets for a dating app handling sensitive personal data.

Full Technical Writeup: https://bobdahacker.com/blog/indias-biggest-dating-app-hacked

@bobdahacker@infosec.exchange avatar bobdahacker , to random

🎢 Hacked South Park's Casa Bonita. Could access their entire POS system and see all customer payments/tips and more 😬

Technical details:

  • Founders Club admin panel: No auth required, all member emails exposed
  • POS registration: Form disabled client-side only, API endpoint still functional
  • Reservation enumeration: Sequential IDs exposed full customer data
  • Full control over customer tabs, payments, and inventory
  • Supabase misconfiguration: Public signups triggered automated membership cards

No security.txt anywhere. Had to email parkcounty.com addresses then get help from my friend whose company partners with South Park.

Fixed fast but never thanked me. Got a Founders Club card 6 months later though, because the system automatically sends them 😂

Full Technical Writeup: https://bobdahacker.com/blog/i-hacked-southpark

@bobdahacker@infosec.exchange avatar bobdahacker , to random

🍔 Found huge security flaws in McDonald's - crew members could access sites reserved for corporate employees with internal functions, API keys exposed, and more. Had to call their HQ and pretend to know people just to report it 🤦

Technical details:

  • Design Hub: Used to be client sided password, Registration endpoint exists and works even tho they dont want signups
  • TRT portal: Crew accounts could enumerate/impersonate all employees from general manager to CEO
  • GRS panel: Complete authentication bypass, arbitrary HTML injection
  • Magicbell API keys/secrets exposed in client-side JS
  • Algolia indexes listable with user PII
  • CosMc's: Server-side validation missing for coupon redemption

They fixed it but fired my friend who helped find the OAuth vulnerabilities.

Full Technical Writeup: https://bobdahacker.com/blog/mcdonalds-security-vulnerabilities

@bobdahacker@infosec.exchange avatar bobdahacker , to random

Found critical vulns in Lovense (the biggest sex toy company) affecting 11M+ users. They ignored researchers for 2+ years, then fixed in 2 days after public exposure. 🤦

What I found:

  • Email disclosure via XMPP (username→email)
  • Auth bypass (email→account takeover, no password)

History of ignoring researchers:

  • 2022: Someone else reports XMPP email leak, ignored
  • Sept 2023: Krissy reports account takeover + different email leak via HTTP API, paid only $350
  • 2024: Another person reports XMPP email leak AND Account Takeover vuln, offered 2 free sex toys (accepted for the meme)
  • March 2025: I report account takeover + XMPP email leak, paid $3000 (after pushing for critical)
  • Told me fix for email vuln needs 14 months because "legacy support" > user security (had 1-month fix ready)
  • July 28: I go public
  • July 30: Both fixed in 48 hours

Same bugs, different treatment. They lied to journalists saying it was fixed in June, tried to get me banned from HackerOne after giving permission to disclose.

News covered it but my blog has the full technical details:
https://bobdahacker.com/blog/lovense-still-leaking-user-emails/

@h4ckernews@mastodon.social avatar h4ckernews Bot , to random