Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

18yo arrested for reporting a bug in the new Budapest e-Ticket system

blog.marai.me

Post reply on HN
Print view View original

101–110 of 329 posts

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#101

Post by reallydattrue »

kpil wrote: post #63
patryn20 wrote: post #42

Earlier quoted context omitted.

I was more naive, but it worked out. Reported a vulnerability and how to fix it to a regional bank when applying for a student loan. They asked me to come in person to explain it and dropped a point off my interest rate. In hindsight it was a huge risk and I was dangerously trusting.

If you are nice and don't threaten to publish, at least without giving them any time to fix it - which for a large back is a couple of months - then I don't think it's a risk at all. What they don't like is the publicity. Edit: but maybe not in Hungary. It's the bad child in EU.

Hungary, bad child of the EU? Oh, I know what you are getting at. No, they are actually the last sanest in the western hemisphere. A country should do what it's best for itself and not have some supposed authority tell it what to do!

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#102

Post by reallydattrue »

kpil wrote: post #86
FRex wrote: post #78

Earlier quoted context omitted.

In Poland there was a case few years back of a company (I have no idea if that means a one person company or a bigger one) owner finding out by putting a name of his client into google that it indexed documents containing private information of over a 1000 of companies that are clients of PKO BP and reported it to the bank. At first the bank security department said no one will find it so it's safe and later when he…

Ah, yes. Actually Poland is the other bad child in EU... The European commission is currently threatening to remove Poland's voting rights due to the changes to the juridical system, but it will not happen as Hungary will veto. I think they are on their own cultural axis somehow.

Poland, bad child of the EU? Oh, I know what you are getting at. No, they are actually the last sanest in the western hemisphere. A country should do what it's best for itself and not have some supposed authority tell it what to do!

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#103

Post by minademian »

this reminds me of a dark joke.

a rabbit was detained by the secret police. the interrogator asks him, "what are you?" the rabbit says, "rabbit"

They torture, beat, and electrocute him for days.

Then, the interrogator asks him, "who told you you're a rabbit?"

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#104

Post by loup-vaillant »

goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

Maybe they could use some threatening instead of a proper report. Go to a public spot, open up a Tor browser, then report the vulnerability. Something like this:

"I have hacked your system, accessed and modified , using . You have to send Bitcoins to , or I your database. Thank you for your attention."

Maybe they will panic strongly enough to actually do something about the issue.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#105

Post by alanfranzoni »

rtpg wrote: post #99
goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

I understand that it's good to have cover for this sort of thing. I think the line is pretty grey though. One analogy is telling a company that their front door is unlocked. Another analogy is going into an unlocked front door, and going deeper into the building, and then reporting to the company that you could, in fact, get to classified information from this door. IRL Pentesters get permission before trying to snea…

When you test for a vulnerability, many times you don't know whether it actually works unless you go "deep into the building".

In this situation, it would have been difficult to report the parameter tampering without verifying that it actually worked (there're systems that pass params back and forth without apparent use, but they throw an error when client and server states don't match) - and, most probably, the report would have been ignored without the verification.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#106

Post by pfisch »

loup-vaillant wrote: post #104
goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

Maybe they could use some threatening instead of a proper report. Go to a public spot, open up a Tor browser, then report the vulnerability. Something like this: "I have hacked your system, accessed and modified , using . You have to send Bitcoins to , or I your database. Thank you for your attention." Maybe they will panic strongly enough to actually do something about the issue.

So you should just become a malicious actor and actually break the law? Good plan.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#107

Post by madaxe_again »

rtpg wrote: post #99
goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

I understand that it's good to have cover for this sort of thing. I think the line is pretty grey though. One analogy is telling a company that their front door is unlocked. Another analogy is going into an unlocked front door, and going deeper into the building, and then reporting to the company that you could, in fact, get to classified information from this door. IRL Pentesters get permission before trying to snea…

I disagree. It's more akin to trying the handle on the door, and noticing it's unlocked, and then telling them, and being arrested for touching the door handle.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#109

Post by jacquesm »

praptak wrote: post #95
ahoka wrote: post #90

Earlier quoted context omitted.

"democracy is in pretty bad shape in Hungary right know" I thought that Hungary has a democratically elected government. Did I miss something?

"Democratically elected government" does not imply "democracy is not in bad shape".

We have several examples of such situations right now.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#110

Post by bigbugbag »

angus-g wrote: post #4

Side note: this page gives me the weirdest Firefox behaviour I've ever seen: https://gfycat.com/HandyRapidJabiru

Using firefox too, I cannot replicate the behaviour. Could it be something from your side of things causing this ? Have you tried turning it off and on again ?
Post reply on HN