Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

18yo arrested for reporting a bug in the new Budapest e-Ticket system

blog.marai.me

Post reply on HN
Print view View original

111–120 of 329 posts

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#111

Post by loup-vaillant »

rtpg wrote: post #99
goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

I understand that it's good to have cover for this sort of thing. I think the line is pretty grey though. One analogy is telling a company that their front door is unlocked. Another analogy is going into an unlocked front door, and going deeper into the building, and then reporting to the company that you could, in fact, get to classified information from this door. IRL Pentesters get permission before trying to snea…

Note: the nature of the reported vulnerability was such that the teenager didn't even have to access the servers to do it —only change a value that was sent by his own browser.

If that was tantamount to not-breaking & entering, it means the it is okay to legally forbid step by step debugging on your own computer. That it may not be legal to inspect code from another company, even if it runs on your computer. That whatever the code decides (here, the price of the ticket), must be observed by the rest of the system (here, the price sent in the HTTP request wasn't the price decided by the web page).

The consequences of such thinking are chilling. If this is the kind of cyberpunk we're heading to, I'll seriously consider becoming a Runner.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#112

Post by SmellyGeekBoy »

ahoka wrote: post #90
atleta wrote: post #9

Earlier quoted context omitted.

Yep, a few people were frowning, especially since the democracy is in pretty bad shape in Hungary right know. However, in this case it works: it will be seen and remembered longer this way. Also, there were quite heated discussions on facebook, the case received a lot of attention even from non-tech people, the guy will be represented by the lawyers of a human rights association, etc. And actually there will be a pro…

"democracy is in pretty bad shape in Hungary right know" I thought that Hungary has a democratically elected government. Did I miss something?

So does Russia. And many African countries.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#113

Post by lostboys67 »

grimskin wrote: post #83
ruc0la wrote: post #65

Earlier quoted context omitted.

Why does a group of criminals need a subway? As a local guy using the public transport on a daily basis, I highly doubt this.

That pretty easy. Let's say you're a government official who's in charge of a local subway. One of the stations is in need of renovation. You're opening a tender for that and got 3 participants - 2 of them are some independent companies with bids around market price of the work required. Lets say 105 and 107 thousands euro. And the third company belongs to your brother in law and he wants 500 thousand euros for his s…

Not Just former Warsaw pact countries, This is a common form of low level corruption in many companies I was told that in British Telecom it was the most common form on financial misconduct that people got disciplined for.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#114

Post by [deleted] »

jannes wrote: post #92
jogjayr wrote: post #47

Earlier quoted context omitted.

I'm having trouble understanding what exactly an org's thought process is when they elect to prosecute someone for reporting a security issue. Would they also prosecute a person who told them one of their doors was left unlocked after-hours? A normal person's reaction upon being told "You left your keys in the lock" is usually gratitude, not calling the cops. EDIT: Is it suspicion? "Hmm...this person found an unlocke…

My guess would be: - BKK is the client of T-Systems. They have a contract for the development and maintenance of this system which might contain clauses about liability or indemnification in cases of hacking, security bugs, negligency, etc. - This guy reported it to BKK who obviously don't have any technical knowledge - BKK (the client) forwards the email to T-Systems (the contractor): "What's this about? Looks like…

[deleted]

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#115

Post by bigbugbag »

praptak wrote: post #95
ahoka wrote: post #90

Earlier quoted context omitted.

"democracy is in pretty bad shape in Hungary right know" I thought that Hungary has a democratically elected government. Did I miss something?

"Democratically elected government" does not imply "democracy is not in bad shape".

"Democratically elected government" implies that it is not a democracy but anything from aristocraty to plutocracy with q few things inbetween such as kleptocracy, oligarchy, etc.

The very definition of election means aristocracy. To have a democracy it requires sortition instead.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#116

Post by askvictor »

jogjayr wrote: post #47
goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

I'm having trouble understanding what exactly an org's thought process is when they elect to prosecute someone for reporting a security issue. Would they also prosecute a person who told them one of their doors was left unlocked after-hours? A normal person's reaction upon being told "You left your keys in the lock" is usually gratitude, not calling the cops. EDIT: Is it suspicion? "Hmm...this person found an unlocke…

I don't know of it happening in hacking lore, but certainly it might be a strategy for a malicious actor to report a flaw so as to gain trust in order to exploit another flaw.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#118

Post by bigbugbag »

atleta wrote: post #9
pmoriarty wrote: post #2

"this outrageous move from the police brought about fierce reaction resulting in tens of thousands of 1-star reviews on the facebook pages of the companies involved" In the old days, protesters used to physically go and picket in front of company offices. These days, protesters leave one-star reviews. I wonder which is more effective.

Yep, a few people were frowning, especially since the democracy is in pretty bad shape in Hungary right know. However, in this case it works: it will be seen and remembered longer this way. Also, there were quite heated discussions on facebook, the case received a lot of attention even from non-tech people, the guy will be represented by the lawyers of a human rights association, etc. And actually there will be a pro…

As every other country on earth right now, Hungary is not a democracy at all. So there's that.

At some point we need to understand the novlang used here, by squatting the word democracy to label the political system based on elections, people in power manage to prevent to emergence of an actual democracy.

Please stop misusing this word so we have a better chance of actually having a democracy somwhere at some point in the future.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#119

Post by imhoguy »

alanfranzoni wrote: post #105
rtpg wrote: post #99

Earlier quoted context omitted.

I understand that it's good to have cover for this sort of thing. I think the line is pretty grey though. One analogy is telling a company that their front door is unlocked. Another analogy is going into an unlocked front door, and going deeper into the building, and then reporting to the company that you could, in fact, get to classified information from this door. IRL Pentesters get permission before trying to snea…

When you test for a vulnerability, many times you don't know whether it actually works unless you go "deep into the building". In this situation, it would have been difficult to report the parameter tampering without verifying that it actually worked (there're systems that pass params back and forth without apparent use, but they throw an error when client and server states don't match) - and, most probably, the repo…

Exactly. Often to validate the door is unlocked one needs to use the knob and open it a little - shall one get a permission for that just for a sake of a check. Is this already a breach to open the door without crossing the threshold?
Post reply on HN