Open-source implementation of the password cryptographic method. https://github.com/moszinet/BKKCrypt
18yo arrested for reporting a bug in the new Budapest e-Ticket system
261–270 of 329 posts
Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system
#262Earlier quoted context omitted.
Like I said above, it is a crime. But it's ethical because it's intended to force them to fix their system before someone does something much worse.
Do you believe that you have a moral right to force them to do anything? Is there a moral imperative that they are morally required to secure their systems and that others should/could demand that they must do so? It definitely could be in certain cases (for example, a hospital storing confidential data of their customers), but in the usual situation where it's just their data and their money, isn't that their moral…
Yeah, I agree 100%. But in a lot of the cases mentioned in this thread the private data of the company's customers was at risk. For example system in the original article allowed you to access other people's name, address and national ID number. I was thinking only of situations like these, there's no reason to threaten a company if they're the only ones at risk.
Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system
#263A few years ago I also found a serious bug in a debt collection agencies web software. I ordered a phone and neglected to pay import tax and was chased by the agency. I found their website and saw that they developed their management software in-house and made it available for purchase for other agencies. They offered a demo which I used to navigate around, in the demo was a reporting tool which essentially allowed y…
I personally would have said to them "Would you like a fair trade? I've discovered a huge problem in your software that could allow anyone to remotely wipe their debt without you really knowing about it. I'll give that information in exchange for elimination of my debt. The money you'd lose from me is utterly dwarfed by the money you'd save by locking down this security issue, an issue which many bad actors would pay…
Sounds like you are threatening them. The idea is OK but the language should be much more subtle to be effective.
Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system
#264Earlier quoted context omitted.
I want to emulate that behavior somehow.
So I tried but the results were... um, unexpected: https://gfycat.com/negligiblesnivelingastarte Code: var db = document.body;document.onscroll = function(){db.style.transform = 'scaleY(1)'; db.style.transform = 'scaleY('+db.scrollHeight / (db.scrollHeight - db.scrollTop)+')'}
This result is by itself amazing, but if you want to make it behave a bit more like the bug you can set the transform-origin to "center bottom".
Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system
#265Earlier quoted context omitted.
I think legal's involvement is perfectly normal. Part of damage control consists of figuring out the legal ramifications of the product/service having technical vulnerabilities. Especially if those vulnerabilities leak customer data. What isn't cool is legal deciding to go after the party disclosing the vulnerability.
Not having much experience on this subject, I have to ask: would you not get your developers to verify that the vulnerability is there and fix it while the legal department is doing its thing? The vulnerability is already out there, and the sooner it's fixed the better. While would they forward everything to their lawyers first thing?
If the email contains code or something that looks like code, or otherwise looks like it is discussing technical things it is not unusual to run it through legal before letting any engineers see it.
That's because companies routine receive unsolicited product proposals, ideas for new features or enhancements, and the like. Often these overlap with things they have been working on internally but that are not known to the public.
If they let engineers see these unsolicited mails and then later come out with an even vaguely similar feature they may find themselves in an intellectual property dispute with the emailer.
Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system
#266Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system
#267This sort of thing teaches people to exploit or ignore rather than report. Anyone who reports should be commended, even if they did real hacking (which using dev tools on a web browser is not.)
Someone's going to probe your system; you should be glad to hear about it in email rather than in the news or your accountants or from angry customers.
Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system
#268Earlier quoted context omitted.
That's unlikely. Every if you don't develop the system on your own and buy it from a third party (be it T-Systems or someone else), you still need technical expertise to prepare the requirements, evaluate the proposed solution (possibly proposals from multiple vendors) and do then do acceptance testing. So the "BKK obviously don't have any technical knowledge" claim is bogus. It's possible the particular BKK person d…
Definitely not the case. Huge numbers of SME clients evaluate tendered work on visual inspection alone. I've only had one or two clients ever (having worked in-house, contract, and for an agency) have had any knowledge of cyber security. I think the hypothetical above is very reasonable. Lots of technical vendors will elect to shift blame. They should take responsibility for their issues, but they often don't.
Except that BKK is not a SME, but a company managing transportation in a city with nearly 2 million people. I've done work for similar organizations founded by municipalities (although smaller and not in Hungary), and pretty much all of them involved technically-skipped people in the process.
Perhaps BKK operates in a different way, but well - incompetence is not an excuse. It's a management failure.
Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system
#269Earlier quoted context omitted.
If your security is " http://example.com/1234/secret_data/" , but 1234 is your customer number, and changing the customer number gives you someone else's data, then the analogy is more like: "the sheriff has told everyone that there's a bad dude wandering round town trying doors, and [responsible citizen] noticed that everyone had identical door-keys which would open every lock". Is that still creepy?
I would find it creepy that someone was testing their key on other people's doors. If I caught someone trying their key on my door I would call the cops, even if they said they were just testing it to see if it would work.
[deleted]
Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system
#270> the poor 18 year old 'hacker' who was stupid enough to email them
s/stupid/trusting/. There's no reason to think this guy isn't bright, and he's faced enough trouble without piling on.