Live data from Hacker News

18yo arrested for reporting a bug in the new Budapest e-Ticket system

blog.marai.me

271–280 of 329 posts

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#271
Two takeaways, one from this and one from my other past experience.

First, when testing whether you can change a price and have a transaction go through successfully, RAISE THE PRICE. If you lower the price the affected entity may come back and say "See??? He's STEALING from us! Lock him up!" If you've overpaid for something through their web interface that complaint and issue goes completely away.

Second, if you're going to suggest that they contact you for assistance in fixing it also suggest other options. My typical handling for this is with hacked websites, so I'll basically say "Your website has problems X, Y and Z. You should work with whoever you have working on your site to resolve these. If you don't have anyone I may be able to assist you, or I recommend talking with a firm like Sucuri.net which has dealing with and preventing issues like this as their primary business. (My only link with Sucuri is having seen some of their folks do presentations at trade shows.)"

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#272
post #236

Earlier quoted context omitted.

You don't erase just your debt, you open up Tor browser and drop the entire database. That'll teach them for next time.

Better to pay your debt, wait till your PII has been removed, then issue a public disclosure of the bug. Public disclosure because everybody should know about something like this that may impact them. Not because some random vigilante will see it and drop their DB for which they probably have no backups.

Make a backup for them first too, just in case they don't have one..

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#273
post #175

Earlier quoted context omitted.

To clarify: they're drifting towards a political system reminiscent of Russia today, but they would never ally with Russia. The Soviet regime is still fresh in the zeitgeist's memory.

Unfortunately they just need a "bigger evil" to forget it and move into their arms.

[deleted]

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#274

Earlier quoted context omitted.

I really can't see how this is unethical or immoral in any way.

You don't see anything unethical or immoral about telling a company "I hacked your systems, send me money or I'll delete all your data"? It's obviously a crime.

It's obviously a crime.

Perhaps. But being a crime does not automatically mean something is immoral or unethical.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#275

> the poor 18 year old 'hacker' who was stupid enough to email them s/stupid/trusting/. There's no reason to think this guy isn't bright, and he's faced enough trouble without piling on.

I believe the author meant it to sound sarcastic

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#276
post #86
post #78

Earlier quoted context omitted.

In Poland there was a case few years back of a company (I have no idea if that means a one person company or a bigger one) owner finding out by putting a name of his client into google that it indexed documents containing private information of over a 1000 of companies that are clients of PKO BP and reported it to the bank. At first the bank security department said no one will find it so it's safe and later when he…

Ah, yes. Actually Poland is the other bad child in EU... The European commission is currently threatening to remove Poland's voting rights due to the changes to the juridical system, but it will not happen as Hungary will veto. I think they are on their own cultural axis somehow.

[deleted]

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#277
post #9

Earlier quoted context omitted.

Yep, a few people were frowning, especially since the democracy is in pretty bad shape in Hungary right know. However, in this case it works: it will be seen and remembered longer this way. Also, there were quite heated discussions on facebook, the case received a lot of attention even from non-tech people, the guy will be represented by the lawyers of a human rights association, etc. And actually there will be a pro…

As every other country on earth right now, Hungary is not a democracy at all. So there's that. At some point we need to understand the novlang used here, by squatting the word democracy to label the political system based on elections, people in power manage to prevent to emergence of an actual democracy. Please stop misusing this word so we have a better chance of actually having a democracy somwhere at some point i…

Please stop misusing this word so we have a better chance of actually having a democracy somwhere at some point in the future.

Please stop promoting democracy as the be-all end-all of systems for organizing human society. As the old saw goes "Democracy is two wolves and a lamb voting on what to have for dinner. Liberty is a well armed sheep contesting the outcome".

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#278
post #182
post #150

Earlier quoted context omitted.

...stateless cloud interactive real-time connection through highly sophisticated authentication featuring dual way private/public key encryption services with single use time-limited tokens ...

Don't forget the blockchain! It needs more blockchain! ;-)

... seamlessly integrated via blockchain into ...

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#279
post #182

Earlier quoted context omitted.

Don't forget the blockchain! It needs more blockchain! ;-)

Also wouldn't mind some "cyber" in there :D

... cyberspace with optional IoT interfacing ...

(I had completely forgotten IoT)

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#280
post #272
post #236

Earlier quoted context omitted.

Better to pay your debt, wait till your PII has been removed, then issue a public disclosure of the bug. Public disclosure because everybody should know about something like this that may impact them. Not because some random vigilante will see it and drop their DB for which they probably have no backups.

Make a backup for them first too, just in case they don't have one..

This is very evil...
Post reply on HN