Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

18yo arrested for reporting a bug in the new Budapest e-Ticket system

blog.marai.me

Post reply on HN
Print view View original

211–220 of 329 posts

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#211

Post by kogepathic »

Rjevski wrote: post #209
lebowen wrote: post #189

A few years ago I also found a serious bug in a debt collection agencies web software. I ordered a phone and neglected to pay import tax and was chased by the agency. I found their website and saw that they developed their management software in-house and made it available for purchase for other agencies. They offered a demo which I used to navigate around, in the demo was a reporting tool which essentially allowed y…

You don't erase just your debt, you open up Tor browser and drop the entire database. That'll teach them for next time.

> you open up Tor browser and drop the entire database

Apart from being a federal crime (CFAA), it would be rather obvious by the logs that a user was testing SQL injection on the demo system minutes before the production system was vandalised.

A better option would be to pay the debt, and then let them know you found a potential issue on their demo system. Let them connect the dots between demo system and production system. If they can't make the logical leap, then they deserve whatever someone else does.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#212

Post by snakeanus »

PeterisP wrote: post #176
loup-vaillant wrote: post #104

Earlier quoted context omitted.

Maybe they could use some threatening instead of a proper report. Go to a public spot, open up a Tor browser, then report the vulnerability. Something like this: "I have hacked your system, accessed and modified , using . You have to send Bitcoins to , or I your database. Thank you for your attention." Maybe they will panic strongly enough to actually do something about the issue.

That is quite straightforward and makes it clear from all perspectives. From the hacker "hat classification" perspective, that's obviously black hat, nothing gray about it. From the legal perspective it's not a debate anymore (like in the original article) if you do this, it's clearly a crime, if you get caught in whatever way (e.g. by bragging about it someplace later that leads to your person, or by testing a "disc…

I really can't see how this is unethical or immoral in any way.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#213

Post by Rjevski »

kogepathic wrote: post #211
Rjevski wrote: post #209

Earlier quoted context omitted.

You don't erase just your debt, you open up Tor browser and drop the entire database. That'll teach them for next time.

> you open up Tor browser and drop the entire database Apart from being a federal crime (CFAA), it would be rather obvious by the logs that a user was testing SQL injection on the demo system minutes before the production system was vandalised. A better option would be to pay the debt, and then let them know you found a potential issue on their demo system. Let them connect the dots between demo system and production…

Well obviously if you do that you wouldn't be testing the SQL injection for your main connection to begin with.

I'm not arguing against paying the debt - I would pay it in either case. However leaving such a vulnerability exposed is so bad they deserve to get their entire database dropped (and in this case I hope they don't have backups).

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#214

Post by grimskin »

StreamBright wrote: post #181
grimskin wrote: post #66

Earlier quoted context omitted.

Actually that is a critique of a problem. Because one of the biggest problem of Eastern Europe is corruption which leads to many different problems, that eventually result in such stories.

The biggest problem in Eastern Europe is corruption? Citation needed. In the USA you can influence politicians, even elections and it is called lobbying. The result is that roughly 70% of the legislation passed for companies. In Eastern Europe people keep re-electing politicians who are corrupt than it is on the voters not on the corrupt politicians. I think the real issue is exactly that, people cannot use their pow…

Yeah, right, because in countries with high corruption level elections are always work as they supposed to.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#215

Post by lightbyte »

snakeanus wrote: post #212
PeterisP wrote: post #176

Earlier quoted context omitted.

That is quite straightforward and makes it clear from all perspectives. From the hacker "hat classification" perspective, that's obviously black hat, nothing gray about it. From the legal perspective it's not a debate anymore (like in the original article) if you do this, it's clearly a crime, if you get caught in whatever way (e.g. by bragging about it someplace later that leads to your person, or by testing a "disc…

I really can't see how this is unethical or immoral in any way.

You don't see anything unethical or immoral about telling a company "I hacked your systems, send me money or I'll delete all your data"? It's obviously a crime.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#216

Post by graphitezepp »

dreen wrote: post #193
grimskin wrote: post #48

Earlier quoted context omitted.

TBH in Eastern Europe something being owned by government usually means that it's being ran (basically owned) by mafia.

No, it isn't. Sorry but this is exactly the kind of "there must be a hidden agenda to this" thinking which skews your reality. Our governments are simply highly incompetent and terribly mismanaged, but not in the hands of organised crime. You can still draw parallels between ANY government and mafia.

Hanlon's Razor - Don't attribute malice to what could just as easily be explained by incompetence.

Turns out there are just a lot of incompetent people.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#217

Post by bondant »

imhoguy wrote: post #131
goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

I have read some advice in the past that one should report vulnerabilties via officially known independent security related group (white hat) or via a journalist. The point is to get some legal backing just in case. Does anybody have an experience with such way?

In France, you can report vulnerabilities to the ANSSI (National Cybersecurity Agency of France). The agency stays somewhat neutral between justice and the company with vulnerabilities since ANSSI must protect confidentiality of their informer. Informations can be sent by email or postal service.

http://www.ssi.gouv.fr/en-cas-dincident/vous-souhaitez-decla...

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#218

Post by garaetjjte »

satyanash wrote: post #210
angus-g wrote: post #4

Side note: this page gives me the weirdest Firefox behaviour I've ever seen: https://gfycat.com/HandyRapidJabiru

I am having this exact issue. - Firefox 54.0.1 (64-bit) - Arch Linux 4.11.5-1-ARCH

I also have this issue, interestingly also on Arch. I also seen other site with that issue before but I can't find it now.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#219

Post by TimJYoung »

The software industry better start investing more in educating the general public/government officials about how web applications work, or this is only going to get worse with technologies like WebAssembly in the hands of similar companies. If anything, people need to understand that these endpoints can be accessed without a browser, and we can't be arresting people/hauling them in for questioning for sending bad data to such an endpoint. After all, what does "bad data" even mean in such a context ?

Also, a question: does the EU have the legal concept of "fair use" ? I would have thought that messing around with a web application would fall under fair use, given that the web application can, and probably will, be stored on a person's computer. A computer that they (also probably) personally own, I might add...

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#220

Post by Zekio »

gargravarr wrote: post #185
skinnymuch wrote: post #33

The list of bullet points of the egregious flaws in the software just get worse and worse. It's crazy how I thought the first one or two would be the worst since, but it just got worse.

It's 20 freaking 17. How can people release software with these totally elementary mistakes? Just one is bad enough, but... admin/admin?? This is easily worthy of a Daily WTF article to itself. And this software was written by a professional contractor - pretty sure you'd get better quality from a kid fresh out of university, because on my course, it was drilled into me - NEVER TRUST THE CLIENT BROWSER! Companies nee…

"NEVER TRUST THE CLIENT BROWSER!"

Isn't it mostly in multiplayer game programming where this gets said over and over "Never trust the game client" even though it should be said in all aspects of programming really

Post reply on HN