Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

18yo arrested for reporting a bug in the new Budapest e-Ticket system

blog.marai.me

Post reply on HN
Print view View original

201–210 of 329 posts

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#201

Post by etatoby »

loup-vaillant wrote: post #104
goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

Maybe they could use some threatening instead of a proper report. Go to a public spot, open up a Tor browser, then report the vulnerability. Something like this: "I have hacked your system, accessed and modified , using . You have to send Bitcoins to , or I your database. Thank you for your attention." Maybe they will panic strongly enough to actually do something about the issue.

Wrong. The latter half should read:

You have to fix the issue, or I your database.

Asking for extortion does not push them to fix their systems, only to pay you and/or find you.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#202

Post by robtaylor »

lebowen wrote: post #189

A few years ago I also found a serious bug in a debt collection agencies web software. I ordered a phone and neglected to pay import tax and was chased by the agency. I found their website and saw that they developed their management software in-house and made it available for purchase for other agencies. They offered a demo which I used to navigate around, in the demo was a reporting tool which essentially allowed y…

This is where anonymous notification / bug reports are useful, and then follow ups in public if no action after a period of time.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#203

Post by deefcee »

mintplant wrote: post #61
angus-g wrote: post #4

Side note: this page gives me the weirdest Firefox behaviour I've ever seen: https://gfycat.com/HandyRapidJabiru

That is weird! Would you mind providing your system configuration and Firefox version info so I can file a bug? (Or you could file one here yourself if you're so inclined: https://bugzilla.mozilla.org/enter_bug.cgi?format=guided#h=b... )

Do not file a bug, you might get arrested.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#204

Post by etatoby »

loup-vaillant wrote: post #111
rtpg wrote: post #99

Earlier quoted context omitted.

I understand that it's good to have cover for this sort of thing. I think the line is pretty grey though. One analogy is telling a company that their front door is unlocked. Another analogy is going into an unlocked front door, and going deeper into the building, and then reporting to the company that you could, in fact, get to classified information from this door. IRL Pentesters get permission before trying to snea…

Note: the nature of the reported vulnerability was such that the teenager didn't even have to access the servers to do it —only change a value that was sent by his own browser. If that was tantamount to not-breaking & entering, it means the it is okay to legally forbid step by step debugging on your own computer. That it may not be legal to inspect code from another company, even if it runs on your computer. That wha…

it means that it is okay to legally forbid step by step debugging on your own computer. That it may not be legal to inspect code from another company, even if it runs on your computer. That whatever the code decides, must be observed by the rest of the system

I don't know about Hungary, but in the US the DMCA has exactly these provisions.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#205

Post by aries1980 »

pgaddict wrote: post #190
jannes wrote: post #92

Earlier quoted context omitted.

My guess would be: - BKK is the client of T-Systems. They have a contract for the development and maintenance of this system which might contain clauses about liability or indemnification in cases of hacking, security bugs, negligency, etc. - This guy reported it to BKK who obviously don't have any technical knowledge - BKK (the client) forwards the email to T-Systems (the contractor): "What's this about? Looks like…

That's unlikely. Every if you don't develop the system on your own and buy it from a third party (be it T-Systems or someone else), you still need technical expertise to prepare the requirements, evaluate the proposed solution (possibly proposals from multiple vendors) and do then do acceptance testing. So the "BKK obviously don't have any technical knowledge" claim is bogus. It's possible the particular BKK person d…

> Every if you don't develop the system on your own and buy it from a third party (be it T-Systems or someone else), you still need technical expertise to prepare the requirements, evaluate the proposed solution (possibly proposals from multiple vendors) and do then do acceptance testing.

I don't think this is true. When you buy a house, do you have to be able to do the specification and evaluate? This is a good analogy, because T-Systems have delivered similar solutions to other clients, what they needed here is a little bit of tailoring and integration (which is not the part that failed).

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#206

Post by tom_mellior »

ahoka wrote: post #187
tom_mellior wrote: post #149

Earlier quoted context omitted.

Here's Human Rights Watch on Hungary: https://www.hrw.org/europe/central-asia/hungary Much of it focuses on the treatment of refugees, but you'll also find information about the suppression of free speech and the like. A "democratically elected government" in a country where the opposition is suppressed is not that democratically elected after all.

Only the sentence about refugees is true, but that has nothing to do with democracy. Financier and philanthropist George Soros of the Open Society Foundation announced in 2010 his intention to grant US $100 million to HRW over a period of ten years to help it expand its efforts internationally.

>

Ah, I see. Presumably he also finances...

Freedom House: https://freedomhouse.org/report/freedom-press/2015/hungary

The International Press Institute: https://ipi.media/civil-defamation-and-media-freedom-in-hung...

The New York Times: https://www.nytimes.com/2014/09/09/opinion/hungarys-crackdow...

The US government: https://hu.usembassy.gov/hungary-media-freedom-press-stateme...

The LA Times: http://www.latimes.com/world/europe/la-fg-hungary-media-free...

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#207

Post by niklasrde »

amingilani wrote: post #127

In my country, the laws are draconian and totally against this kind of responsible disclosure. But being a good guy, whenever I find something I write a strongly worded email explaining why the company's IT department messed up, how to test said mess-up, and how they can hire my company to ensure these kinds of stupid things don't happen again. I've reported several of these issues, sometimes all I get is single repl…

If they use Google's GSuite for their emails, I think that prefetches all content and makes beacons pretty useless (by design).

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#208

Post by snakeanus »

lebowen wrote: post #189

A few years ago I also found a serious bug in a debt collection agencies web software. I ordered a phone and neglected to pay import tax and was chased by the agency. I found their website and saw that they developed their management software in-house and made it available for purchase for other agencies. They offered a demo which I used to navigate around, in the demo was a reporting tool which essentially allowed y…

Such companies are usually extremely shady and unethical, I would not consider it evil at all to delete all of their recorded debts via tor or something.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#209

Post by Rjevski »

lebowen wrote: post #189

A few years ago I also found a serious bug in a debt collection agencies web software. I ordered a phone and neglected to pay import tax and was chased by the agency. I found their website and saw that they developed their management software in-house and made it available for purchase for other agencies. They offered a demo which I used to navigate around, in the demo was a reporting tool which essentially allowed y…

You don't erase just your debt, you open up Tor browser and drop the entire database. That'll teach them for next time.
Post reply on HN