Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

18yo arrested for reporting a bug in the new Budapest e-Ticket system

blog.marai.me

Post reply on HN
Print view View original

151–160 of 329 posts

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#151

Post by qb45 »

kpil wrote: post #63
patryn20 wrote: post #42

Earlier quoted context omitted.

I was more naive, but it worked out. Reported a vulnerability and how to fix it to a regional bank when applying for a student loan. They asked me to come in person to explain it and dropped a point off my interest rate. In hindsight it was a huge risk and I was dangerously trusting.

If you are nice and don't threaten to publish, at least without giving them any time to fix it - which for a large back is a couple of months - then I don't think it's a risk at all. What they don't like is the publicity. Edit: but maybe not in Hungary. It's the bad child in EU.

> What they don't like is the publicity.

> Edit: but maybe not in Hungary. It's the bad child in EU.

The article suggests that they reported this guy to the police only after the info leaked out (or possibly was independently discovered by others) and made it to the press.

Scapegoating of non-malicious hackers isn't really anything new or unique to Hungary. It's a common reaction of IT-illiterates to people "cheating" on their systems everywhere.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#152

Post by nthcolumn »

Someone pointed out to me the other day that just connecting to a poorly configured system is illegal in some places (Finland in his case). A form of trespass he said. This was a ship in international waters registered in Russia Federation so not sure whose law applies lol. Perhaps if there were more cases where full advantage was taken of such incompetence with spectacular newsworthy results then people would be more appreciative of the work we do and the laws changed to protect whistle-blowers and activists generally.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#153

Post by qb45 »

lovich wrote: post #50
Gustomaximus wrote: post #45

Earlier quoted context omitted.

I get where you coming from but I would still encourage people to report. Most companies will want to fix and hush it up. I have previously found a way to access very personal information in a large corporate billing system. When I contacted them I specifically used careful language that what I'd done was unintentional, and easy mistake that could lead others to this, that I kept zero data and exited the system as so…

Doing the right thing is admirable. Doing something that helps a little bit, when the group that you are trying to help may or may not try to destroy you, seems like its not such a great idea. If a company doesn't have a set of published procedures for reporting a bug its not worth helping them

It depends. Sometimes the organization may be handling your personal data, other times a bug in some Ukrainian tax software may be exploited and cause downtime in a global shipping company.

I realize that big incidents are probably the only way to get laypeople to care about IT security in the long run, but still it may be preferable to help averting them when possible for various quite practical reasons.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#154

Post by qb45 »

Gustomaximus wrote: post #45
goodplay wrote: post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

I get where you coming from but I would still encourage people to report. Most companies will want to fix and hush it up. I have previously found a way to access very personal information in a large corporate billing system. When I contacted them I specifically used careful language that what I'd done was unintentional, and easy mistake that could lead others to this, that I kept zero data and exited the system as so…

> And you can always do it anonymously.

Assuming you have done the hacking anonymously in the first place.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#155

Post by kowdermeister »

StreamBright wrote: post #80
nithinm wrote: post #73

Earlier quoted context omitted.

By purchasing the ticket, he was confirming the vulnerability. I am sure he knew that they would cancel the ticket when he reported it. I don't find any wrong doing here.

And you think that this is going to be enough at the court? Have a look at this list, many of them thought they are not doing anything wrong: https://en.wikipedia.org/wiki/List_of_computer_criminals The point is that we live by the law, not how you feel about a certain action. I agree that the law is a bit problematic but regardless we cannot cherrypick which law to follow and which not.

Yes, that should be enough. You won't get into any trouble if you break a window when the house is on fire. This time, the site was on fire.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#156

Post by qb45 »

loup-vaillant wrote: post #111
rtpg wrote: post #99

Earlier quoted context omitted.

I understand that it's good to have cover for this sort of thing. I think the line is pretty grey though. One analogy is telling a company that their front door is unlocked. Another analogy is going into an unlocked front door, and going deeper into the building, and then reporting to the company that you could, in fact, get to classified information from this door. IRL Pentesters get permission before trying to snea…

Note: the nature of the reported vulnerability was such that the teenager didn't even have to access the servers to do it —only change a value that was sent by his own browser. If that was tantamount to not-breaking & entering, it means the it is okay to legally forbid step by step debugging on your own computer. That it may not be legal to inspect code from another company, even if it runs on your computer. That wha…

On the Internet there is also the problem of remote attackers. Even if you preemptively jail all people in your jurisdiction, your system still isn't safe. It doesn't make any sense at all to call sending some malicious data to your server "breaking in" when anybody and his dog can do it from the comfort of their chair on the other side of the planet.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#158

Post by nWjbyf45T »

sgentle wrote: post #62
tekromancr wrote: post #30

Earlier quoted context omitted.

I want to emulate that behavior somehow.

So I tried but the results were... um, unexpected: https://gfycat.com/negligiblesnivelingastarte Code: var db = document.body;document.onscroll = function(){db.style.transform = 'scaleY(1)'; db.style.transform = 'scaleY('+db.scrollHeight / (db.scrollHeight - db.scrollTop)+')'}

It seems from the code you first stretch it out to Infinity and then when scrollTop is bigger than scrollHeight, you go from negative Infinity back to 1. Negative values of scale() 'mirrors' the element. Maybe make sure scrollTop is never equal to or bigger than scrollHeight.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#159

Post by underyx »

pmoriarty wrote: post #2

"this outrageous move from the police brought about fierce reaction resulting in tens of thousands of 1-star reviews on the facebook pages of the companies involved" In the old days, protesters used to physically go and picket in front of company offices. These days, protesters leave one-star reviews. I wonder which is more effective.

There are still protests at their offices as well. Source: I went to one a little while ago.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#160

Post by TechnicalVault »

ascorbic wrote: post #145
amingilani wrote: post #127

In my country, the laws are draconian and totally against this kind of responsible disclosure. But being a good guy, whenever I find something I write a strongly worded email explaining why the company's IT department messed up, how to test said mess-up, and how they can hire my company to ensure these kinds of stupid things don't happen again. I've reported several of these issues, sometimes all I get is single repl…

Offering your company's services could be risky. Whatever your good intentions, it could be portrayed as extortion.

That's why you speak to a lawyer first, the law is an ass, and they're the right tool for telling you how to avoid these nasty little traps.
Post reply on HN