Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

18yo arrested for reporting a bug in the new Budapest e-Ticket system

blog.marai.me

Post reply on HN
Print view View original

81–90 of 329 posts

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#81

Post by jasonzemos »

jogjayr wrote: post #47
goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

I'm having trouble understanding what exactly an org's thought process is when they elect to prosecute someone for reporting a security issue. Would they also prosecute a person who told them one of their doors was left unlocked after-hours? A normal person's reaction upon being told "You left your keys in the lock" is usually gratitude, not calling the cops. EDIT: Is it suspicion? "Hmm...this person found an unlocke…

Never underestimate the diversity of the concept of Justice in those who are uneducated, unwise, and dishonest to what is real. If you try to trace this behavior you'll find truly random causes. There are an infinite number of ideas one can substitute for something they don't know or willfully ignore in their own perceived interests. The real problem is when those substitutions are guiding determinations for someone with authority over others.

I'll also add: when I was a teenager I've been in this position countless times, reporting security issues at school, etc. The reactions I received from fully grown adults was nothing short of stochastic. This fascinated me enough to minor in political science and philosophy/ethics. I draw on that for insight, but it doesn't really provide a final answer.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#83

Post by grimskin »

ruc0la wrote: post #65
grimskin wrote: post #48

Earlier quoted context omitted.

TBH in Eastern Europe something being owned by government usually means that it's being ran (basically owned) by mafia.

Why does a group of criminals need a subway? As a local guy using the public transport on a daily basis, I highly doubt this.

That pretty easy. Let's say you're a government official who's in charge of a local subway. One of the stations is in need of renovation. You're opening a tender for that and got 3 participants - 2 of them are some independent companies with bids around market price of the work required. Lets say 105 and 107 thousands euro. And the third company belongs to your brother in law and he wants 500 thousand euros for his services. In perfect world such bid won't stand a chance. But, since you're the one responsible for the tender, you can change requirements for the set of documents required for participation like one day before start, making it impossible for other participants to provide documents in time and thus making them unable to participate. So your brother in law wins the tender, sub-contract work to some third party for the market price and you split the rest of the money. And even if you're will be charged with "improper use of municipal funds" you'll be fined with something around 500 euro and will keep your job.

That is what I've meant by saying "basically own" - you can do whatever you want with company and you can't be held responsible for any of your actions.

And that's not just some imaginary scheme - that shit happens on daily basis in most of Eastern Europe countries. I'm from Ukraine and we're trying to fight that shit for several years now.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#84

Post by StreamBright »

ruc0la wrote: post #71
StreamBright wrote: post #69

Earlier quoted context omitted.

No, they brought him in as a person of interest following Hungarian law. If you do not like the law please vote the next election a party that changes that or move to a country that does not require police to follow the law. Determining if he is going to be charged with a crime is at later stage in the investigation anyways. There is no such a thing as "They took him as a criminal". Moreover, it is not only Hungarian…

Corruption is also a crime, I do not see the police visiting Mészáros or other entities involving corruption skandals. But ofc I got your point.

I see so following up on a cyber crime is corruption?

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#85

Post by posterboy »

goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

report anonymously!?

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#86

Post by kpil »

FRex wrote: post #78
kpil wrote: post #63

Earlier quoted context omitted.

If you are nice and don't threaten to publish, at least without giving them any time to fix it - which for a large back is a couple of months - then I don't think it's a risk at all. What they don't like is the publicity. Edit: but maybe not in Hungary. It's the bad child in EU.

In Poland there was a case few years back of a company (I have no idea if that means a one person company or a bigger one) owner finding out by putting a name of his client into google that it indexed documents containing private information of over a 1000 of companies that are clients of PKO BP and reported it to the bank. At first the bank security department said no one will find it so it's safe and later when he…

Ah, yes. Actually Poland is the other bad child in EU...

The European commission is currently threatening to remove Poland's voting rights due to the changes to the juridical system, but it will not happen as Hungary will veto.

I think they are on their own cultural axis somehow.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#87

Post by csomar »

jogjayr wrote: post #47
goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

I'm having trouble understanding what exactly an org's thought process is when they elect to prosecute someone for reporting a security issue. Would they also prosecute a person who told them one of their doors was left unlocked after-hours? A normal person's reaction upon being told "You left your keys in the lock" is usually gratitude, not calling the cops. EDIT: Is it suspicion? "Hmm...this person found an unlocke…

Because if they acknowledge it, it shows their own incompetence. It is much better to blame the issue on some "hacker" than to acknowledge that you failed. The latter might mean that you get kicked out by investors.

And multi-billion companies or governments are in the business of bending over customers and effing them. So another guy getting fked is business as usual.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#88

Post by Casseres »

sgentle wrote: post #62
tekromancr wrote: post #30

Earlier quoted context omitted.

I want to emulate that behavior somehow.

So I tried but the results were... um, unexpected: https://gfycat.com/negligiblesnivelingastarte Code: var db = document.body;document.onscroll = function(){db.style.transform = 'scaleY(1)'; db.style.transform = 'scaleY('+db.scrollHeight / (db.scrollHeight - db.scrollTop)+')'}

That looks like it would be a good April Fool's Day prank.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#89

Post by posterboy »

atleta wrote: post #15
beters wrote: post #10

When I was in Budapest a few weeks ago, I heard from multiple locals that the metro system was owned by some sort of mafia. I wonder if that explains the subpar security and overreaction to the bug report. edit: a few weeks ago, not this past summer that is still occurring

I'm not aware of any actual mafia. They were almost certainly metaphorical and they must have been just bashing the local government. Because what they do is really a shame. One of the lines is de facto in a life threatening condition. Trains caught fire multiple times. Instead of being replaced, the 40 year old cars are being refurbished/modernized. This has something to do with the EU (they gave money for this, but…

Nothing like the cars build for berlin that were slightly too big for the narrowest part of the tunnels.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#90

Post by ahoka »

atleta wrote: post #9
pmoriarty wrote: post #2

"this outrageous move from the police brought about fierce reaction resulting in tens of thousands of 1-star reviews on the facebook pages of the companies involved" In the old days, protesters used to physically go and picket in front of company offices. These days, protesters leave one-star reviews. I wonder which is more effective.

Yep, a few people were frowning, especially since the democracy is in pretty bad shape in Hungary right know. However, in this case it works: it will be seen and remembered longer this way. Also, there were quite heated discussions on facebook, the case received a lot of attention even from non-tech people, the guy will be represented by the lawyers of a human rights association, etc. And actually there will be a pro…

"democracy is in pretty bad shape in Hungary right know"

I thought that Hungary has a democratically elected government. Did I miss something?

Post reply on HN