Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

18yo arrested for reporting a bug in the new Budapest e-Ticket system

blog.marai.me

Post reply on HN
Print view View original

91–100 of 329 posts

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#91

Post by ruc0la »

StreamBright wrote: post #84
ruc0la wrote: post #71

Earlier quoted context omitted.

Corruption is also a crime, I do not see the police visiting Mészáros or other entities involving corruption skandals. But ofc I got your point.

I see so following up on a cyber crime is corruption?

You know exactly, what I have been referring to. The system is broken. Honestly, who cares if a young guy purchased a ticket to prove his right regarding a bug? How could he do otherwise? You need to make sure about the backend part of the system, too. Meanwhile, the company that developed this "service" is silent and the financing part is also not public, but we can be sure it was not cheap. The whole BKK e-ticket system is plain simple, a mediocre dev team could create a better one.

I understand that you are experienced in law, I understand what you wrote. Although, I do not think that it was the right thing to do. And maybe because of the reactions and the scandal, it will change in the future.

Would not have happened anything if we had just ignored this. We did the right thing.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#92

Post by jannes »

jogjayr wrote: post #47
goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

I'm having trouble understanding what exactly an org's thought process is when they elect to prosecute someone for reporting a security issue. Would they also prosecute a person who told them one of their doors was left unlocked after-hours? A normal person's reaction upon being told "You left your keys in the lock" is usually gratitude, not calling the cops. EDIT: Is it suspicion? "Hmm...this person found an unlocke…

My guess would be:

- BKK is the client of T-Systems. They have a contract for the development and maintenance of this system which might contain clauses about liability or indemnification in cases of hacking, security bugs, negligency, etc.

- This guy reported it to BKK who obviously don't have any technical knowledge

- BKK (the client) forwards the email to T-Systems (the contractor): "What's this about? Looks like hacking or something."

- Now T-Systems has two options: 1. Blame it on the guy, or 2. Take the blame for overpromising and screwing it up, possibly taking a financial loss of an unkown amount (depending on the contract and how widespread exploitation was)

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#93

Post by ahoka »

grimskin wrote: post #48
kodfodrasz wrote: post #38

Earlier quoted context omitted.

Please don't spread fake news! The metro system is owned by the city, and ultimately the government. With all its problems, it is still not a mafia. Although you are in a different part of the world, but when visiting the poor and backwards Eastern Europe, please use your common sense, or at least do some fact check.

TBH in Eastern Europe something being owned by government usually means that it's being ran (basically owned) by mafia.

It's just the old commie era thinking. Some people think of the government as a hostile entity. Strangely the same people believe in a strong state acting as a nanny, so they don't have to solve their problems themselves. Hopefully this will heal with time and people start to take responsibility in both their private life and politically.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#94

Post by oblio »

ikeboy wrote: post #34

>Didn't any of the engineers on the team tell their managers that something isn't right? I find it hard to believe. Or, the managers knew full well the system was shit and they had no time to fix it, but 80k/month is 80k/month.

This is Hungary we're talking about, more likely it was 24k or less.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#95

Post by praptak »

ahoka wrote: post #90
atleta wrote: post #9

Earlier quoted context omitted.

Yep, a few people were frowning, especially since the democracy is in pretty bad shape in Hungary right know. However, in this case it works: it will be seen and remembered longer this way. Also, there were quite heated discussions on facebook, the case received a lot of attention even from non-tech people, the guy will be represented by the lawyers of a human rights association, etc. And actually there will be a pro…

"democracy is in pretty bad shape in Hungary right know" I thought that Hungary has a democratically elected government. Did I miss something?

"Democratically elected government" does not imply "democracy is not in bad shape".

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#96

Post by ikeboy »

oblio wrote: post #94
ikeboy wrote: post #34

>Didn't any of the engineers on the team tell their managers that something isn't right? I find it hard to believe. Or, the managers knew full well the system was shit and they had no time to fix it, but 80k/month is 80k/month.

This is Hungary we're talking about, more likely it was 24k or less.

The article says

>BKK pays T-Systems 80kEUR/month to operate this system.

If you were offered that, would you turn it down because you can't actually deliver a secure system in time?

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#97

Post by ruc0la »

grimskin wrote: post #83
ruc0la wrote: post #65

Earlier quoted context omitted.

Why does a group of criminals need a subway? As a local guy using the public transport on a daily basis, I highly doubt this.

That pretty easy. Let's say you're a government official who's in charge of a local subway. One of the stations is in need of renovation. You're opening a tender for that and got 3 participants - 2 of them are some independent companies with bids around market price of the work required. Lets say 105 and 107 thousands euro. And the third company belongs to your brother in law and he wants 500 thousand euros for his s…

I see I admit I was naive when I thought we do not play with services that are used by hundreds of thousands of people in the capital. But yeah the same shit happened here, too. We have to pay back part of the EU money we received for Subway 4 (Négyes metró) due to corruption investigated by EU.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#99

Post by rtpg »

goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

I understand that it's good to have cover for this sort of thing.

I think the line is pretty grey though.

One analogy is telling a company that their front door is unlocked.

Another analogy is going into an unlocked front door, and going deeper into the building, and then reporting to the company that you could, in fact, get to classified information from this door.

IRL Pentesters get permission before trying to sneak into buildings, so there's some argument for it being the same for these sorts of things.

EDIT: I 100% think that users that are acting in good faith shouldn't be thrown in prison. This case is a pretty good example of this

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#100

Post by StreamBright »

ruc0la wrote: post #91
StreamBright wrote: post #84

Earlier quoted context omitted.

I see so following up on a cyber crime is corruption?

You know exactly, what I have been referring to. The system is broken. Honestly, who cares if a young guy purchased a ticket to prove his right regarding a bug? How could he do otherwise? You need to make sure about the backend part of the system, too. Meanwhile, the company that developed this "service" is silent and the financing part is also not public, but we can be sure it was not cheap. The whole BKK e-ticket s…

No I do not know.
Post reply on HN