21 ms·

18yo arrested for reporting a bug in the new Budapest e-Ticket system

874 points by atleta 9y ago

pmoriarty 9y ago
"this outrageous move from the police brought about fierce reaction resulting in tens of thousands of 1-star reviews on the facebook pages of the companies involved" In the old days, protesters used to physically go and picket in front of company offices. These days, protesters leave one-star reviews. I wonder which is more effective.
- emodendroket 9y ago
  People can, and do, do both things.
- atleta 9y ago
  Yep, a few people were frowning, especially since the democracy is in pretty bad shape in Hungary right know. However, in this case it works: it will be seen and remembered longer this way. Also, there were quite heated discussions on facebook, the case received a lot of attention even from non-tech people, the guy will be represented by the lawyers of a human rights association, etc. And actually there will be a protest in front of the office of the Public Transport Authority tomorrow. But I think in this case, the online petitioning worked pretty well.
  - ahoka 9y ago
    "democracy is in pretty bad shape in Hungary right know" I thought that Hungary has a democratically elected government. Did I miss something?
    - PeterisP 9y ago
      There's a saying that democracy is not when a government gets installed by fair elections, democracy is when a government gets removed by fair elections. Hitler was democratically elected as well, that is not sufficient to label his regime as democracy.
      - praptak 9y ago
        > Hitler was democratically elected as well No he wasn't, it is not that simple. His party at that time had no majority despite being the largest one. He got appointed chancellor not by democratic vote but by backroom negotiations - mostly because he was expected to be easy to control. From this state he went for the dictatorship but again not by democratic election but rather by scaring the other parties into voting him the Enabling Act in 1933 after the supposedly communist-inspired Reichstag Fire.
    - praptak 9y ago
      "Democratically elected government" does not imply "democracy is not in bad shape".
      - jacquesm 9y ago
        We have several examples of such situations right now.
      - bigbugbag 9y ago
        "Democratically elected government" implies that it is not a democracy but anything from aristocraty to plutocracy with q few things inbetween such as kleptocracy, oligarchy, etc. The very definition of election means aristocracy. To have a democracy it requires sortition instead.
    - SmellyGeekBoy 9y ago
      So does Russia. And many African countries.
    - tom_mellior 9y ago
      Here's Human Rights Watch on Hungary: https://www.hrw.org/europe/central-asia/hungary https://www.hrw.org/europe/central-asia/hungary Much of it focuses on the treatment of refugees, but you'll also find information about the suppression of free speech and the like. A "democratically elected government" in a country where the opposition is suppressed is not that democratically elected after all.
      - ahoka 9y ago
        Only the sentence about refugees is true, but that has nothing to do with democracy. <tinfoil>Financier and philanthropist George Soros of the Open Society Foundation announced in 2010 his intention to grant US $100 million to HRW over a period of ten years to help it expand its efforts internationally.</tinfoil>
        tom_mellior 9y ago
        > <tinfoil> Ah, I see. Presumably he also finances... Freedom House: https://freedomhouse.org/report/freedom-press/2015/hungary https://freedomhouse.org/report/freedom-press/2015/hungary The International Press Institute: https://ipi.media/civil-defamation-and-media-freedom-in-hungary/ https://ipi.media/civil-defamation-and-media-freedom-in-hung... The New York Times: https://www.nytimes.com/2014/09/09/opinion/hungarys-crackdown-on-the-press.html https://www.nytimes.com/2014/09/09/opinion/hungarys-crackdow... The US government: https://hu.usembassy.gov/hungary-media-freedom-press-statement-u-s-department-state/ https://hu.usembassy.gov/hungary-media-freedom-press-stateme... The LA Times: http://www.latimes.com/world/europe/la-fg-hungary-media-freedom-20201010-story.html http://www.latimes.com/world/europe/la-fg-hungary-media-free...
    - atleta 9y ago
      Yes, you probably missed a few lessons in high school. When I went there, I was taught that separation of powers is an important element, amongst others. This clearly does not apply to Hungary anymore, as the highest juridical power is an inner circle person (Tunde Hando), other important positions have also been filled with Fidesz's (the ruling party) people without any consensus with the opposition. This includes the constitutional court, the president of the republic (wait, what? Hungary is not even a republic anymore :) ). The police got and executed on direct commands from the PM. But if you don't like that, here's a short excerpt from Wikipedia: "No consensus exists on how to define democracy, but legal equality, political freedom and rule of law have been identified as important characteristics."[1] We don't have any of these. Or, to put it in an easier to digest way: all of these have been regularly (and increasingly) violated by the govt. As probably a fellow Hungarian who likes (is emotionally attached to) this government, I understand you are OK with it, but it doesn't make the current system any more democratic. Fun fact: the Kadar system called itself democratic too. But it's judged from the outside, for obvious reasons. [1]: https://en.wikipedia.org/wiki/Democracy#Characteristics https://en.wikipedia.org/wiki/Democracy#Characteristics
  - bigbugbag 9y ago
    As every other country on earth right now, Hungary is not a democracy at all. So there's that. At some point we need to understand the novlang used here, by squatting the word democracy to label the political system based on elections, people in power manage to prevent to emergence of an actual democracy. Please stop misusing this word so we have a better chance of actually having a democracy somwhere at some point in the future.
    - willbw 9y ago
      A practical democracy must be an abstraction of a pure, idealistic democracy. You cannot have millions of people deciding on every issue. Democratically elected representatives are one way we can do this. There may be better ways of doing things but it doesn't make democracies not democracies.
      - bb611 9y ago
        > You cannot have millions of people deciding on every issue. From a technical perspective, this is clearly untrue.
        dragonwriter 9y ago
        > From a technical perspective, this is clearly untrue. It's impossible if you take “every issue” literally, as you are multiplying the number of pdecisions that must be made by each participant per unit of time so much that the time to consider them is non-existent. It's less impossible if you reduce it to the kind of decisions typically made by a legislature, which mainly just sets rules for executive and judicial officials to apply in deciding more specific issues. But even then it's of dubious practicality; obviously not every citizen can have a full-time legislative staff, and most of other things besides legislation to devote their time to.
    - mindcrime 9y ago
      Please stop misusing this word so we have a better chance of actually having a democracy somwhere at some point in the future. Please stop promoting democracy as the be-all end-all of systems for organizing human society. As the old saw goes "Democracy is two wolves and a lamb voting on what to have for dinner. Liberty is a well armed sheep contesting the outcome".
- skinnymuch 9y ago
  I'm as much of a curmudgeon when it comes to slacktivism as you can get. But damaging a companies online presence with negative reviews, ratings, posts on social media, blogs, and more, will live on. It will hurt the company quite a bit. In this case I think the online element is quite effective. Also there seems to be some irl protesting going on as well, at least in this case.
- tikhonj 9y ago
  Honestly, I wouldn't be surprised if the reviews are effective—I bet reviews are a metric that's tied a lot more directly to executive compensation/promotions than "number of people protesting outside HQ"! Both attack the company's reputation, and, unless a protest gets on a major news network, I suspect acting out on Facebook has greater reach.
  - kowdermeister 9y ago
    Furthermore the 4500 1* review is there to stay and a single protest fades away :)
- underyx 9y ago
  There are still protests at their offices as well. Source: I went to one a little while ago.
- aries1980 9y ago
  Having 1.1 avg review on the T-Systems International's official FB and Google page can affect the sentiment of their investors.
- ddebernardy 9y ago
  https://www.facebook.com/bkkbudapest https://www.facebook.com/bkkbudapest When the story made it to Slashdot's front page, it had ~46k 1-start reviews and a few hundred ratings in the 2-5 stars range. Methinks whoever is in charge of company reviews at BKK is despairing right now. Unless they somehow convince FB to drop the recent cohort of 1-star ratings (which will almost certainly yield a Streisand effect) and keep a low profile for a very long time before allowing star ratings again, there's simply no way the BKK will rescue the rating. It's unfortunate for the BKK and its staff. The quality of their service and vehicles is good overall and the staff is friendly. It's admittedly not 5-star grade, but it's certainly not 1-star material either. Yet this sequence of event might haunt them for years.
deleted 9y ago
[deleted]
angus-g 9y ago
Side note: this page gives me the weirdest Firefox behaviour I've ever seen: https://gfycat.com/HandyRapidJabiru https://gfycat.com/HandyRapidJabiru
- deleted 9y ago
  [deleted]
- synicalx 9y ago
  That's probably the weirdest browser behaviour I've seen on any browser! I don't even know how I would describe that to someone :/
  - tekromancr 9y ago
    Like it's printed on some form of mathematical hyper-rubber sheet, and scrolling pulls it down until it stretches into invisibility, rendering the next rubber page visible.
    - Danihan 9y ago
      ITS A BAD CASE OF THE STRETCHIES
  - kalleboo 9y ago
    It looks like the scrolling in Firefox is implemented in screen-height tiles, and when he's scrolling it's picking a smaller and smaller portion of the top tile (as the top portion of the tile is scrolling out of the window) but not updating the bottom coordinate of the rectangle it's supposed to render to (so instead of moving up, instead the smaller and smaller portion gets stretched out to fill the window). Then when the top tile is supposed to be completely off-screen, it jumps to the second tile in one go.
- tekromancr 9y ago
  I want to emulate that behavior somehow.
  - deleted 9y ago
whatnotests 9y ago
That's how the DMCA works. Remember the guy who gave a talk about Adobe's PDF creator which purported to produce "secure" documents (required a password) but the feature was easily bypassed. Adobe had him arrested the day after he gave his talk. Link to a Wired article here: https://www.google.com/amp/s/www.wired.com/2001/07/russian-adobe-hacker-busted/amp https://www.google.com/amp/s/www.wired.com/2001/07/russian-a... EDIT: I have a terrible memory-- thanks to the folks who replied to my comment with corrections.
- emodendroket 9y ago
  This story takes place in Hungary.
  - tom_mellior 9y ago
    But inspired by the DMCA, the EU has also adopted anti-circumvention legislation. Though I'm dubious either would apply here, as this would be very difficult to spin as a copyright issue.
    - robin_reala 9y ago
      Has it? Can you link to it?
      - tom_mellior 9y ago
        General info: https://en.wikipedia.org/wiki/Anti-circumvention#European_Union https://en.wikipedia.org/wiki/Anti-circumvention#European_Un... More about the directive: https://en.wikipedia.org/wiki/Copyright_Directive https://en.wikipedia.org/wiki/Copyright_Directive Actual text of the directive: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32001L0029 http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:320... (see Chapter III, containing things like "Member States shall provide adequate legal protection against the circumvention of any effective technological measures" and then going on to define "effective" to mean "not necessarily effective") Some parts have been amended (for example, copyright duration has been expanded from 50 to 70 years after death), but I believe the anti-circumvention parts to be unchanged. I'm not sure how to find up-to-date codified versions of EU laws, though.
goodplay 9y ago
I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guaranteed by law. Until it is, bugs in critical and important infrastructure will go on unreported, and remain available for malicious actors to exploit.
- warrenm 9y ago
  Why didn't you report it? Seems somewhat negligent - at the very least from a Good Samaritan™ point of view
  - Cerium 9y ago
    Reporting these things can get you in trouble. Once burnt twice shy.
  - Antrikshy 9y ago
    Did you not see the top post?
  - JohnGB 9y ago
    If he reported it, he runs the risk of the company turning on him (as was the case in the article above). If he doesn't report it, nothing happens. It's a choice between the certainty of no loss vs the possibility of great loss.
    - kodfodrasz 9y ago
      If he does not report it, and somebody else does, then he runs the risk of being rightfully accused of hacking, as the motivation can be understood as financially motivated.
    - warrenm 9y ago
      Budapest != United States
beters 9y ago
When I was in Budapest a few weeks ago, I heard from multiple locals that the metro system was owned by some sort of mafia. I wonder if that explains the subpar security and overreaction to the bug report. edit: a few weeks ago, not this past summer that is still occurring
- atleta 9y ago
  I'm not aware of any actual mafia. They were almost certainly metaphorical and they must have been just bashing the local government. Because what they do is really a shame. One of the lines is de facto in a life threatening condition. Trains caught fire multiple times. Instead of being replaced, the 40 year old cars are being refurbished/modernized. This has something to do with the EU (they gave money for this, but not that). There was a tender, but miraculously it was the Russians who won it, despite their offer was quite a lot more expensive than that of the Estonians. And of course, as it happens with corruption, they failed to deliver a properly working version, so after a few weeks of testing, the first few trains were sent back. About the security (or rather the extremely low quality) of the eTicket system: that was developed by a 3rd party that belongs to the Deutsche Telekom group, and that company is indeed quite a high profile system integrator working with a lot of large companies, banks, etc. So it's a bit of surprising (even if corruption is involved) that they released it in this form. Actually I'm surprised by these bugs even for a prototype that was forcefully pushed out of the door, because you just never do these things in the first place.
  - inferiorhuman 9y ago
    > Instead of being replaced, the 40 year old cars are being refurbished/modernized. Age seems like a bit of a red herring to me. Here in San Francisco BART cars are about that old, Muni runs 90 year old Italian trams and American ones that are close to 70 years old. And, of course, the cable cars. BART bears about the worst of it because many parts are no longer available.
    - atleta 9y ago
      Interesting point. Don't forget that this is 40-50 year old Soviet technology :). And cars are actually in pretty bad shape, well over their planned lifetime of 30 years (AFAIK). Full of rust, sometimes catch fire. The drive system is also problematic, because it doesn't have regenerative breaking so the cars heat the tunnels quite a lot which is pretty bad during the summer. They are in such a bad shape and/or hard to rebuild that not much remains of the original during the refurbishment.
pmoriarty 9y ago
"if you just typed in the url (shop.bkk.hu), the site just wouldn't appear. At first I thought they've taken it offline, but it turns out that they just didn't set up the http -> https redirection. And it was left like that for days. If you just heard about it, you couldn't use it. You had to click a link (normal users won't figure out to put an https in front of the host name, even I didn't think of it)." I'd really like to know which of these is the better solution. It seems to me that if people go to the http address, they could be redirected to an attacker's address with a simple MITM attack. So there's an argument to be made for not using http at all, even for a legitimate redirect, because it can be so easily MITM'ed. On the other hand, if the http address is left unused, then people who try it anyway and it fails will be confused. For this solution to work, it seems the users have to be educated to always and only use the https address. For these reasons, the whole separate http/https scheme seems broken by design. What's the consensus from the security community as to the right setup here? Am I missing something, or is there a better way?
- cpach 9y ago
  See https://hstspreload.org https://hstspreload.org
  - pmoriarty 9y ago
    Ok, so that works for Chrome, but every other application is still going to be subject to an MITM attack if their users try to connect via http?
    - lukegb 9y ago
      As long as the other application is Firefox, Safari, IE11/Edge, or Opera, then it probably has a HSTS preload list that is at least in part generated from the Chrome one. Firefox have some scripts which go through and check to make sure everything still on the Chrome list is still announcing the preload headers, and will autoremove if that isn't that case, IIRC. I wouldn't be too shocked if Apple/Microsoft were doing something similar.
anujdeshpande 9y ago
Sounds a lot like what happens here in India [1]. Also, if such behaviour is systemic, how should we bring about the paradigm shift in handling such events? Such incidents will happen more often across the world as e-governance becomes more predominant. 1 - https://thewire.in/119578/aadhaar-sting-uidai-files-fir-journalist/ https://thewire.in/119578/aadhaar-sting-uidai-files-fir-jour...
skinnymuch 9y ago
The list of bullet points of the egregious flaws in the software just get worse and worse. It's crazy how I thought the first one or two would be the worst since, but it just got worse.
- gargravarr 9y ago
  It's 20 freaking 17. How can people release software with these totally elementary mistakes? Just one is bad enough, but... admin/admin?? This is easily worthy of a Daily WTF article to itself. And this software was written by a professional contractor - pretty sure you'd get better quality from a kid fresh out of university, because on my course, it was drilled into me - NEVER TRUST THE CLIENT BROWSER! Companies need to understand, if they want an internet presence, no matter how strong the laws are in their own country, laws don't stop a crime in progress, especially when all they need to do is send a fairly simple message to the website. Computers are dumb, they do what they're told. Giving anyone the loophole to tell them to do something you didn't intend is asking to have it exploited. Going after the messenger will solve nothing. The guy who discovered the payment flaw could easily have kept quiet, letting others discover it, or quietly told his friends, who tell their friends, ad infinitum, and suddenly the whole country is buying valid passes for a penny, costing the company a hideous amount of money. Prosecuting the whistleblower will actually hurt their bottom line.
  - Zekio 9y ago
    "NEVER TRUST THE CLIENT BROWSER!" Isn't it mostly in multiplayer game programming where this gets said over and over "Never trust the game client" even though it should be said in all aspects of programming really
    - deleted 9y ago
      [deleted]
    - gargravarr 9y ago
      I would have ended at 'client' but figured it could extend to the human (although that's true too). But yes, there is still so much naivety in implementing distributed or client-server systems that they should trust input from remote sources.
ikeboy 9y ago
>Didn't any of the engineers on the team tell their managers that something isn't right? I find it hard to believe. Or, the managers knew full well the system was shit and they had no time to fix it, but 80k/month is 80k/month.
- oblio 9y ago
  This is Hungary we're talking about, more likely it was 24k or less.
  - ikeboy 9y ago
    The article says >BKK pays T-Systems 80kEUR/month to operate this system. If you were offered that, would you turn it down because you can't actually deliver a secure system in time?
    - oblio 9y ago
      Oh, I missed that part, I thought you were talking about programmer salaries :)
Negative1 9y ago
The price of a ticket was client-side authenticated!? I can't fathom the level of incompetence required to do something like this...
- netsharc 9y ago
  "Budapest's new e-ticketing system uses state-of-the-art JavaScript to deliver a smooth user experience, combining a great React front-end with a micro-services node.js backend!" - marketing blurb I just made up, needs more buzzwords though.
  - jaclaz 9y ago
    ...stateless cloud interactive real-time connection through highly sophisticated authentication featuring dual way private/public key encryption services with single use time-limited tokens ...
    - krylon 9y ago
      Don't forget the blockchain! It needs more blockchain! ;-)
      - freeflight 9y ago
        Also wouldn't mind some "cyber" in there :D
        jaclaz 9y ago
        ... cyberspace with optional IoT interfacing ... (I had completely forgotten IoT)
      - jaclaz 9y ago
        ... seamlessly integrated via blockchain into ...
- lordnacho 9y ago
chx 9y ago
> We knew that they have been working on an NFC/smart card based system for around 4 years, without any visible result despite having spent over 4 million EURs. The public procurement process for the current system called RIGO was indeed 2013 but the whole process is much, much older than that. A more than 300 page feasibility study was published in 2011 https://www.bkk.hu/apps/docs/megvalosithatosagi_vizsgalat.pdf https://www.bkk.hu/apps/docs/megvalosithatosagi_vizsgalat.pd... And a completely different system, called Elektra was announced in 2004 with a 2006 deadline. This whole clusterfuck with RIGO starting in less than a year was absolutely unnecessary since the 2011 study already suggested supporting contactless credit cards so once RIGO starts the only ones using this online ticket purchasing system will be those who have a credit card but not a contactless one. This is a (very) rapidly shrinking audience.
qualitytime 9y ago
Once there was this website which offered phone number to location service. They had a form you could try the demo where it sent an SMS to verify and only allowed one query. If you looked at the source of the page it had hidden fields to override the SMS verification and allow multiple queries. I freaked out some friends for the day and nearly contacted a journalist but lost interest after some weeks. I could have had my 15 minutes of fame or be on some list, or both. It's alright, had some fun.
StreamBright 9y ago
Actually he exploited the bug and purchased a ticket for the fraction of the price and than reported it to the public transportation company. The company that runs the infrastructure (not the public transportation one) followed its internal policy and Hungarian law reported the incident to authorities. Police brought in the guy for questioning.
- chx 9y ago
  > followed its internal policy and Hungarian law and reported the incident to authorities Ho-humm. Care to point where the Hungarian law mandates this? The old BTK was simpler but even the new is pretty clear in that only a very few serious acts are mandatory to report (meaning not reporting is a felony in itself). 145. and 159 § details how military and civil superiors must report the crimes of those under them, obviously does not apply. 191. § makes reporting attempted or committed kidnapping mandatory. 263. § are crimes against the state, treason, spying and shit. 300. § makes it a crime not to report corruption but only for officials. 317. § makes terrorism mandatory to report. 328. § is about violating international sanctions. Finally 404. § makes reporting of certain financial trickery but only for the actual executor of the bankruptcy. Which one was this one? Or did I miss something? Was he trying to sell stuff to Russia violating the sanctions? Did he make an attempt to overthrow the government? Or what?
  - StreamBright 9y ago
    Followed its internal policy -> this is why they did it and Hungarian law -> this is how they did it European law about data protection and breaches, not sure if it is in effect yet and not sure if it applies to this exact case: http://www.lexology.com/library/detail.aspx?g=8185429b-c98d-484a-9fce-890606c42804 http://www.lexology.com/library/detail.aspx?g=8185429b-c98d-...
- nithinm 9y ago
  By purchasing the ticket, he was confirming the vulnerability. I am sure he knew that they would cancel the ticket when he reported it. I don't find any wrong doing here.
anon4728 9y ago
The master password to a database containing Stanford's sunet identity management system was publicly available. It was reported through channels and fixed quickly. Credit: a friend auditing for fun found it <30 seconds.
SubiculumCode 9y ago
All I want to say is something off topic,but the only vacation I've had away fro m the kids and with my wife was a week in Budapest, and I miss it. Such a beautiful city, so romantic...and I rode the metro everywhere. ahh Budapest. :-)
- SubiculumCode 9y ago
  not to mention the US dollar spends well there. I felt rich and I am just a potdoc
minademian 9y ago
this reminds me of a dark joke. a rabbit was detained by the secret police. the interrogator asks him, "what are you?" the rabbit says, "rabbit" They torture, beat, and electrocute him for days. Then, the interrogator asks him, "who told you you're a rabbit?"
odabaxok 9y ago
All I can think about, what a shame can this be for the developers releasing this software. There must have been a bunch of people working on this and wasn't there no one to say this is wrong?
daef 9y ago
is HN hugging shop.bkk.hu to death?
- daef 9y ago
  visiting https://bkk.hu/ https://bkk.hu/ (and watching the dev console) shows that they obviously develop their page http-first (various resources won't load in firefox due mixed http(s))
  - daef 9y ago
    and after switching to english the search on the top of the page is broken
    - daef 9y ago
      check robots.txt -> wordpress... seriously?
amingilani 9y ago
In my country, the laws are draconian and totally against this kind of responsible disclosure. But being a good guy, whenever I find something I write a strongly worded email explaining why the company's IT department messed up, how to test said mess-up, and how they can hire my company to ensure these kinds of stupid things don't happen again. I've reported several of these issues, sometimes all I get is single reply months later saying: "fixed".. mostly, nothing. Once I found a SQL injection in a courier service's (very broken) web portal. This was very serious because any idiot could drop all the tables, so I sent an email to the most important worded member of their tiny, yet already bureaucratically structured team. I followed up several times because I knew someone saw my email (I embed beacons in my emails) but gave up after the sixth time. Three months later someone else replied saying "thanks Amin, we've fixed it" On a separate occasion, a large government agency's emails routinely ended up in my spam folder. It was a huge problem, and they acknowledged it and said they couldn't figure out what was wrong. I took five minutes and found the problem to be a misconfigured server on the domain. The server sending the email thought it was `server-a.governmentdomain.com` but there were no DNS entries pointing the subdomain to the server. I reported this problem with clear instructions to test and fix the issue, but I was called despite the instructions, multiple times, to explain the issue with my words over the phone. This was 2 years ago, last I checked, the issue was still present.
- ascorbic 9y ago
  Offering your company's services could be risky. Whatever your good intentions, it could be portrayed as extortion.
  - TechnicalVault 9y ago
    That's why you speak to a lawyer first, the law is an ass, and they're the right tool for telling you how to avoid these nasty little traps.
    - ComodoHacker 9y ago
      ...provided the law in your country really works.
SeanDav 9y ago
Although deeply unfair, this is not unusual, there have been many reported cases of companies shooting the messenger. Unless the company concerned has a well documented and trusted bug bounty procedure, it can be very risky to report a bug in a system, if it involves any kind of hacking. What happens is once the "bug" is reported, someone inside the company asks "How did this happen?". Now the person responsible has 2 options, admit it was their fault and the vulnerability exists and risk being accused of incompetence, or say that the system was hacked. Human nature being what it is, one tends to complain of being hacked, thus snow-balling effects, which lead to the arrest of an 18 year old just trying to help. My advice: Don't report these types of bugs at all, or if you really feel you must, report anonymously.
- deleted 9y ago
  [deleted]
- lerpa 9y ago
  One thing that solves this is stating the obvious, something getting hacked means someone was incompetent.
  - andai 9y ago
    Indeed, I fail to see the distinction. Perhaps "hackers" have some kind of mythical superpowers in the eyes of the common folk. "There was nothing I could do boss! He's a hacker!"
fredsir 9y ago
We've seen two[1] cases[2] of this in Denmark in the last couple of years surrounding systems that kindergartens are using. The second one is currently (still) being investigated, but the first one was rightfully concluded earlier this year with the "hacker" being acquitted. In both cases, it was dads of children in the institution that noticed the bugs when they were rightfully using the system and were ignored when notifying the responsible party about it until they "shouted it so loudly" that they couldn't be ignored anymore, in which case they were reported to the police for hacking. Links below are in danish, but they can probably be translated if needed. 1: https://www.version2.dk/artikel/boernehavehackeren-frifundet-landsretten-1074257 https://www.version2.dk/artikel/boernehavehackeren-frifundet... 2: https://www.version2.dk/artikel/interview-hacker-tiltalt-jeg-totalt-uskyldig-1077581 https://www.version2.dk/artikel/interview-hacker-tiltalt-jeg...
- andai 9y ago
  Translated to English: 1: https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=https%3A%2F%2Fwww.version2.dk%2Fartikel%2Fboernehavehackeren-frifundet-landsretten-1074257&edit-text=&act=url https://translate.google.com/translate?sl=auto&tl=en&js=y&pr... 2: https://translate.google.com/translate?hl=en&sl=da&tl=en&u=https%3A%2F%2Fwww.version2.dk%2Fartikel%2Finterview-hacker-tiltalt-jeg-totalt-uskyldig-1077581 https://translate.google.com/translate?hl=en&sl=da&tl=en&u=h...
dogmata 9y ago
I wonder if the outcome would have been the same if instead of marking the price down from 9500HUF to 50HUF it was 9499HUF, the test would have still proved the issue.
Aissen 9y ago
I thought some CERTs were now doing the reporting as way to shield security researchers from this kind of things ? Or did I hear wrong ?
nthcolumn 9y ago
Someone pointed out to me the other day that just connecting to a poorly configured system is illegal in some places (Finland in his case). A form of trespass he said. This was a ship in international waters registered in Russia Federation so not sure whose law applies lol. Perhaps if there were more cases where full advantage was taken of such incompetence with spectacular newsworthy results then people would be more appreciative of the work we do and the laws changed to protect whistle-blowers and activists generally.
wooptoo 9y ago
Just don't bother with companies who don't have a bug bounty system in place.
willhackett 9y ago
A sure-fire way to let vulnerabilities go unnoticed and unfixed.
lebowen 9y ago
A few years ago I also found a serious bug in a debt collection agencies web software. I ordered a phone and neglected to pay import tax and was chased by the agency. I found their website and saw that they developed their management software in-house and made it available for purchase for other agencies. They offered a demo which I used to navigate around, in the demo was a reporting tool which essentially allowed you to send raw SQL queries to an AJAX endpoint. Something along the lines of: http://demosoftware.com/reports/ajax.php?sql=SELECT http://demosoftware.com/reports/ajax.php?sql=SELECT * FROM debts I switched out the demo software domain name for the live version and it worked, not only could I query the database there was no authentication preventing me hitting this end point. At this point I was left with a dilemma, do I "erase" my debt, do I disclose the bug and pay the debt, or simply pay the debt and move on. I chose to pay the debt and move on due to fear of any recriminations. However it has left me uneasy ever since knowing that this company have such bad security and any debtors they are chasing for payments potentially will have all of their personal data leaked.
- robtaylor 9y ago
  This is where anonymous notification / bug reports are useful, and then follow ups in public if no action after a period of time.
- snakeanus 9y ago
  Such companies are usually extremely shady and unethical, I would not consider it evil at all to delete all of their recorded debts via tor or something.
  - otterley 9y ago
    Would you gladly go to prison for it?
    - snakeanus 9y ago
      No, which is why I mentioned tor.
kutkloon7 9y ago
Not really related to the technological side of the story, but I had a horrible experience with the international trains from Budapest. So they don't need a broken electronic system to provide a horrible service ;) My parents went to buy a ticket at the counter. The lady behind the counter didn't speak English (which is totally OK). Her only communication was a 'go away' movement with her hand, after which she ignore us and signaled for the next customer in line to come to her. Luckily a colleague of her helped us and gave us careful instruction on the time and platform of the train. After we took the train and sat for a few hours, the conductor of the train came and notified that our tickets were invalid. We argued for some time since the lady behind the counter told us this was the right train. The conductor became mad and told us that we had to pay him 50 euros in cash for some unknown reason (presumably to buy a ticket for the train we were on, but his English was very limited). Note that this was a normal train and there was no shortage of seats. In the end, we chose to get out at the next stop, and take the next train, which was about 3 hours later.
minusSeven 9y ago
> someone found out that the admin password was adminadmin and managed to log in using that. Wtf ,I thought I was bad at my job.
- andai 9y ago
  Conversely, the person who set it to adminadmin probably thought they were doing a great job.
TimJYoung 9y ago
The software industry better start investing more in educating the general public/government officials about how web applications work, or this is only going to get worse with technologies like WebAssembly in the hands of similar companies. If anything, people need to understand that these endpoints can be accessed without a browser, and we can't be arresting people/hauling them in for questioning for sending bad data to such an endpoint. After all, what does "bad data" even mean in such a context ? Also, a question: does the EU have the legal concept of "fair use" ? I would have thought that messing around with a web application would fall under fair use, given that the web application can, and probably will, be stored on a person's computer. A computer that they (also probably) personally own, I might add...
secult 9y ago
We had a similar case - National security authority(NBU SR) of a neighboring country got their public web infrastructure hacked after guessing credentials (nbusr:nbusr123). In the end, guys got free after trial because police were unable to unambiguously identify them.
ohthehugemanate 9y ago
As a Deutsche Telekom client, I can say that this quality level is par for the course for T-Systems. Not surprised at all.
shanky1323 9y ago
THIS --> "someone found out that the admin password was adminadmin and managed to log in using that."
lightedman 9y ago
Not just reporting it, but having actually exploited it to confirm before reporting it, even if just to test. That was the wrong move. What should have been done was the second he had the thought that such a vulnerability could exist, he should have notified them that he believes that there is a possibility for one to alter the site code locally to gain unfair pricing, and to ask them if either he could check for them or if they could check using his proposed method. The second you actually test without permission, you've committed a crime. Jury/court might look at intent later on, but for now, you've committed a crime and are thus subject to arrest.
- krallja 9y ago
  How do you know if the server validates the price or not, without testing it? Do you report every site that uses HTML forms for being insecure?
aries1980 9y ago
Open-source implementation of the password cryptographic method. https://github.com/moszinet/BKKCrypt https://github.com/moszinet/BKKCrypt
jccooper 9y ago
This sort of thing teaches people to exploit or ignore rather than report. Anyone who reports should be commended, even if they did real hacking (which using dev tools on a web browser is not.) Someone's going to probe your system; you should be glad to hear about it in email rather than in the news or your accountants or from angry customers.
abecedarius 9y ago
> the poor 18 year old 'hacker' who was stupid enough to email them s/stupid/trusting/. There's no reason to think this guy isn't bright, and he's faced enough trouble without piling on.
- infinisil 9y ago
  I believe the author meant it to sound sarcastic
  - abecedarius 9y ago
    It's definitely a jab at the company, but seems to cast a little shade too on the bug-finder. Cf the lede "The amount of stupidity in this story warrants that this is going to be somewhat long". That might not be the author's intent! I hope they'll see this as helpful.
fencepost 9y ago
Two takeaways, one from this and one from my other past experience. First, when testing whether you can change a price and have a transaction go through successfully, RAISE THE PRICE. If you lower the price the affected entity may come back and say "See??? He's STEALING from us! Lock him up!" If you've overpaid for something through their web interface that complaint and issue goes completely away. Second, if you're going to suggest that they contact you for assistance in fixing it also suggest other options. My typical handling for this is with hacked websites, so I'll basically say "Your website has problems X, Y and Z. You should work with whoever you have working on your site to resolve these. If you don't have anyone I may be able to assist you, or I recommend talking with a firm like Sucuri.net which has dealing with and preventing issues like this as their primary business. (My only link with Sucuri is having seen some of their folks do presentations at trade shows.)"
- taurath 9y ago
  3rd takeaway - don't do this in turkey unless you want to end up in a literal Turkish prison.
  - detritus 9y ago
    4th takeaway - the Budapest metro system doesn't quite go that far...
- tom_mellior 9y ago
  > If you've overpaid for something through their web interface that complaint and issue goes completely away. Or it doesn't, because you have still "hacked them". Doing it in a seemingly bizarre way may only raise more suspicions; obviously you must have maliciously cheated them, since who would give them money? Please don't put people at risk by giving such "advice".
  - fencepost 9y ago
    What I was talking about was the question of being accused of theft (by having completed an order/purchase after lowering the price). This was also in the context of someone already intending to push a transaction with an attempted price change. At that point nothing you do with the price is going to prevent a "hacking" charge if there's going to be one, but you may be able to prevent a corresponding "stole from us" charge.
triacus 9y ago
The Hungarian Government Incident Response Center (GOVCERT_Hungary) provides the opportunity to report security vulnerabilities for everyone in an anonymous manner: http://www.cert-hungary.hu/node/397 http://www.cert-hungary.hu/node/397 Better late than never...

874 points by atleta 9y ago

"this outrageous move from the police brought about fierce reaction resulting in tens of thousands of 1-star reviews on the facebook pages of the companies involved" In the old days, protesters used to physically go and picket in front of company offices. These days, protesters leave one-star reviews. I wonder which is more effective.

emodendroket 9y ago
People can, and do, do both things.
atleta 9y ago
Yep, a few people were frowning, especially since the democracy is in pretty bad shape in Hungary right know. However, in this case it works: it will be seen and remembered longer this way. Also, there were quite heated discussions on facebook, the case received a lot of attention even from non-tech people, the guy will be represented by the lawyers of a human rights association, etc. And actually there will be a protest in front of the office of the Public Transport Authority tomorrow. But I think in this case, the online petitioning worked pretty well.
- ahoka 9y ago
  "democracy is in pretty bad shape in Hungary right know" I thought that Hungary has a democratically elected government. Did I miss something?
  - PeterisP 9y ago
    There's a saying that democracy is not when a government gets installed by fair elections, democracy is when a government gets removed by fair elections. Hitler was democratically elected as well, that is not sufficient to label his regime as democracy.
    - praptak 9y ago
      > Hitler was democratically elected as well No he wasn't, it is not that simple. His party at that time had no majority despite being the largest one. He got appointed chancellor not by democratic vote but by backroom negotiations - mostly because he was expected to be easy to control. From this state he went for the dictatorship but again not by democratic election but rather by scaring the other parties into voting him the Enabling Act in 1933 after the supposedly communist-inspired Reichstag Fire.
  - praptak 9y ago
    "Democratically elected government" does not imply "democracy is not in bad shape".
    - jacquesm 9y ago
      We have several examples of such situations right now.
    - bigbugbag 9y ago
      "Democratically elected government" implies that it is not a democracy but anything from aristocraty to plutocracy with q few things inbetween such as kleptocracy, oligarchy, etc. The very definition of election means aristocracy. To have a democracy it requires sortition instead.
  - SmellyGeekBoy 9y ago
    So does Russia. And many African countries.
  - tom_mellior 9y ago
    Here's Human Rights Watch on Hungary: https://www.hrw.org/europe/central-asia/hungary https://www.hrw.org/europe/central-asia/hungary Much of it focuses on the treatment of refugees, but you'll also find information about the suppression of free speech and the like. A "democratically elected government" in a country where the opposition is suppressed is not that democratically elected after all.
    - ahoka 9y ago
      Only the sentence about refugees is true, but that has nothing to do with democracy. <tinfoil>Financier and philanthropist George Soros of the Open Society Foundation announced in 2010 his intention to grant US $100 million to HRW over a period of ten years to help it expand its efforts internationally.</tinfoil>
      - tom_mellior 9y ago
        > <tinfoil> Ah, I see. Presumably he also finances... Freedom House: https://freedomhouse.org/report/freedom-press/2015/hungary https://freedomhouse.org/report/freedom-press/2015/hungary The International Press Institute: https://ipi.media/civil-defamation-and-media-freedom-in-hungary/ https://ipi.media/civil-defamation-and-media-freedom-in-hung... The New York Times: https://www.nytimes.com/2014/09/09/opinion/hungarys-crackdown-on-the-press.html https://www.nytimes.com/2014/09/09/opinion/hungarys-crackdow... The US government: https://hu.usembassy.gov/hungary-media-freedom-press-statement-u-s-department-state/ https://hu.usembassy.gov/hungary-media-freedom-press-stateme... The LA Times: http://www.latimes.com/world/europe/la-fg-hungary-media-freedom-20201010-story.html http://www.latimes.com/world/europe/la-fg-hungary-media-free...
  - atleta 9y ago
    Yes, you probably missed a few lessons in high school. When I went there, I was taught that separation of powers is an important element, amongst others. This clearly does not apply to Hungary anymore, as the highest juridical power is an inner circle person (Tunde Hando), other important positions have also been filled with Fidesz's (the ruling party) people without any consensus with the opposition. This includes the constitutional court, the president of the republic (wait, what? Hungary is not even a republic anymore :) ). The police got and executed on direct commands from the PM. But if you don't like that, here's a short excerpt from Wikipedia: "No consensus exists on how to define democracy, but legal equality, political freedom and rule of law have been identified as important characteristics."[1] We don't have any of these. Or, to put it in an easier to digest way: all of these have been regularly (and increasingly) violated by the govt. As probably a fellow Hungarian who likes (is emotionally attached to) this government, I understand you are OK with it, but it doesn't make the current system any more democratic. Fun fact: the Kadar system called itself democratic too. But it's judged from the outside, for obvious reasons. [1]: https://en.wikipedia.org/wiki/Democracy#Characteristics https://en.wikipedia.org/wiki/Democracy#Characteristics
- bigbugbag 9y ago
  As every other country on earth right now, Hungary is not a democracy at all. So there's that. At some point we need to understand the novlang used here, by squatting the word democracy to label the political system based on elections, people in power manage to prevent to emergence of an actual democracy. Please stop misusing this word so we have a better chance of actually having a democracy somwhere at some point in the future.
  - willbw 9y ago
    A practical democracy must be an abstraction of a pure, idealistic democracy. You cannot have millions of people deciding on every issue. Democratically elected representatives are one way we can do this. There may be better ways of doing things but it doesn't make democracies not democracies.
    - bb611 9y ago
      > You cannot have millions of people deciding on every issue. From a technical perspective, this is clearly untrue.
      - dragonwriter 9y ago
        > From a technical perspective, this is clearly untrue. It's impossible if you take “every issue” literally, as you are multiplying the number of pdecisions that must be made by each participant per unit of time so much that the time to consider them is non-existent. It's less impossible if you reduce it to the kind of decisions typically made by a legislature, which mainly just sets rules for executive and judicial officials to apply in deciding more specific issues. But even then it's of dubious practicality; obviously not every citizen can have a full-time legislative staff, and most of other things besides legislation to devote their time to.
  - mindcrime 9y ago
    Please stop misusing this word so we have a better chance of actually having a democracy somwhere at some point in the future. Please stop promoting democracy as the be-all end-all of systems for organizing human society. As the old saw goes "Democracy is two wolves and a lamb voting on what to have for dinner. Liberty is a well armed sheep contesting the outcome".
skinnymuch 9y ago
I'm as much of a curmudgeon when it comes to slacktivism as you can get. But damaging a companies online presence with negative reviews, ratings, posts on social media, blogs, and more, will live on. It will hurt the company quite a bit. In this case I think the online element is quite effective. Also there seems to be some irl protesting going on as well, at least in this case.
tikhonj 9y ago
Honestly, I wouldn't be surprised if the reviews are effective—I bet reviews are a metric that's tied a lot more directly to executive compensation/promotions than "number of people protesting outside HQ"! Both attack the company's reputation, and, unless a protest gets on a major news network, I suspect acting out on Facebook has greater reach.
- kowdermeister 9y ago
  Furthermore the 4500 1* review is there to stay and a single protest fades away :)
underyx 9y ago
There are still protests at their offices as well. Source: I went to one a little while ago.
aries1980 9y ago
Having 1.1 avg review on the T-Systems International's official FB and Google page can affect the sentiment of their investors.
ddebernardy 9y ago
https://www.facebook.com/bkkbudapest https://www.facebook.com/bkkbudapest When the story made it to Slashdot's front page, it had ~46k 1-start reviews and a few hundred ratings in the 2-5 stars range. Methinks whoever is in charge of company reviews at BKK is despairing right now. Unless they somehow convince FB to drop the recent cohort of 1-star ratings (which will almost certainly yield a Streisand effect) and keep a low profile for a very long time before allowing star ratings again, there's simply no way the BKK will rescue the rating. It's unfortunate for the BKK and its staff. The quality of their service and vehicles is good overall and the staff is friendly. It's admittedly not 5-star grade, but it's certainly not 1-star material either. Yet this sequence of event might haunt them for years.

deleted 9y ago

[deleted]

angus-g 9y ago

Side note: this page gives me the weirdest Firefox behaviour I've ever seen: https://gfycat.com/HandyRapidJabiru https://gfycat.com/HandyRapidJabiru

deleted 9y ago
[deleted]
synicalx 9y ago
That's probably the weirdest browser behaviour I've seen on any browser! I don't even know how I would describe that to someone :/
- tekromancr 9y ago
  Like it's printed on some form of mathematical hyper-rubber sheet, and scrolling pulls it down until it stretches into invisibility, rendering the next rubber page visible.
  - Danihan 9y ago
    ITS A BAD CASE OF THE STRETCHIES
- kalleboo 9y ago
  It looks like the scrolling in Firefox is implemented in screen-height tiles, and when he's scrolling it's picking a smaller and smaller portion of the top tile (as the top portion of the tile is scrolling out of the window) but not updating the bottom coordinate of the rectangle it's supposed to render to (so instead of moving up, instead the smaller and smaller portion gets stretched out to fill the window). Then when the top tile is supposed to be completely off-screen, it jumps to the second tile in one go.
tekromancr 9y ago
I want to emulate that behavior somehow.
- deleted 9y ago

whatnotests 9y ago

That's how the DMCA works. Remember the guy who gave a talk about Adobe's PDF creator which purported to produce "secure" documents (required a password) but the feature was easily bypassed. Adobe had him arrested the day after he gave his talk. Link to a Wired article here: https://www.google.com/amp/s/www.wired.com/2001/07/russian-adobe-hacker-busted/amp https://www.google.com/amp/s/www.wired.com/2001/07/russian-a... EDIT: I have a terrible memory-- thanks to the folks who replied to my comment with corrections.

emodendroket 9y ago
This story takes place in Hungary.
- tom_mellior 9y ago
  But inspired by the DMCA, the EU has also adopted anti-circumvention legislation. Though I'm dubious either would apply here, as this would be very difficult to spin as a copyright issue.
  - robin_reala 9y ago
    Has it? Can you link to it?
    - tom_mellior 9y ago
      General info: https://en.wikipedia.org/wiki/Anti-circumvention#European_Union https://en.wikipedia.org/wiki/Anti-circumvention#European_Un... More about the directive: https://en.wikipedia.org/wiki/Copyright_Directive https://en.wikipedia.org/wiki/Copyright_Directive Actual text of the directive: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32001L0029 http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:320... (see Chapter III, containing things like "Member States shall provide adequate legal protection against the circumvention of any effective technological measures" and then going on to define "effective" to mean "not necessarily effective") Some parts have been amended (for example, copyright duration has been expanded from 50 to 70 years after death), but I believe the anti-circumvention parts to be unchanged. I'm not sure how to find up-to-date codified versions of EU laws, though.

goodplay 9y ago

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guaranteed by law. Until it is, bugs in critical and important infrastructure will go on unreported, and remain available for malicious actors to exploit.

warrenm 9y ago
Why didn't you report it? Seems somewhat negligent - at the very least from a Good Samaritan™ point of view
- Cerium 9y ago
  Reporting these things can get you in trouble. Once burnt twice shy.
- Antrikshy 9y ago
  Did you not see the top post?
- JohnGB 9y ago
  If he reported it, he runs the risk of the company turning on him (as was the case in the article above). If he doesn't report it, nothing happens. It's a choice between the certainty of no loss vs the possibility of great loss.
  - kodfodrasz 9y ago
    If he does not report it, and somebody else does, then he runs the risk of being rightfully accused of hacking, as the motivation can be understood as financially motivated.
  - warrenm 9y ago
    Budapest != United States

beters 9y ago

When I was in Budapest a few weeks ago, I heard from multiple locals that the metro system was owned by some sort of mafia. I wonder if that explains the subpar security and overreaction to the bug report. edit: a few weeks ago, not this past summer that is still occurring

atleta 9y ago
I'm not aware of any actual mafia. They were almost certainly metaphorical and they must have been just bashing the local government. Because what they do is really a shame. One of the lines is de facto in a life threatening condition. Trains caught fire multiple times. Instead of being replaced, the 40 year old cars are being refurbished/modernized. This has something to do with the EU (they gave money for this, but not that). There was a tender, but miraculously it was the Russians who won it, despite their offer was quite a lot more expensive than that of the Estonians. And of course, as it happens with corruption, they failed to deliver a properly working version, so after a few weeks of testing, the first few trains were sent back. About the security (or rather the extremely low quality) of the eTicket system: that was developed by a 3rd party that belongs to the Deutsche Telekom group, and that company is indeed quite a high profile system integrator working with a lot of large companies, banks, etc. So it's a bit of surprising (even if corruption is involved) that they released it in this form. Actually I'm surprised by these bugs even for a prototype that was forcefully pushed out of the door, because you just never do these things in the first place.
- inferiorhuman 9y ago
  > Instead of being replaced, the 40 year old cars are being refurbished/modernized. Age seems like a bit of a red herring to me. Here in San Francisco BART cars are about that old, Muni runs 90 year old Italian trams and American ones that are close to 70 years old. And, of course, the cable cars. BART bears about the worst of it because many parts are no longer available.
  - atleta 9y ago
    Interesting point. Don't forget that this is 40-50 year old Soviet technology :). And cars are actually in pretty bad shape, well over their planned lifetime of 30 years (AFAIK). Full of rust, sometimes catch fire. The drive system is also problematic, because it doesn't have regenerative breaking so the cars heat the tunnels quite a lot which is pretty bad during the summer. They are in such a bad shape and/or hard to rebuild that not much remains of the original during the refurbishment.

pmoriarty 9y ago

"if you just typed in the url (shop.bkk.hu), the site just wouldn't appear. At first I thought they've taken it offline, but it turns out that they just didn't set up the http -> https redirection. And it was left like that for days. If you just heard about it, you couldn't use it. You had to click a link (normal users won't figure out to put an https in front of the host name, even I didn't think of it)." I'd really like to know which of these is the better solution. It seems to me that if people go to the http address, they could be redirected to an attacker's address with a simple MITM attack. So there's an argument to be made for not using http at all, even for a legitimate redirect, because it can be so easily MITM'ed. On the other hand, if the http address is left unused, then people who try it anyway and it fails will be confused. For this solution to work, it seems the users have to be educated to always and only use the https address. For these reasons, the whole separate http/https scheme seems broken by design. What's the consensus from the security community as to the right setup here? Am I missing something, or is there a better way?

cpach 9y ago
See https://hstspreload.org https://hstspreload.org
- pmoriarty 9y ago
  Ok, so that works for Chrome, but every other application is still going to be subject to an MITM attack if their users try to connect via http?
  - lukegb 9y ago
    As long as the other application is Firefox, Safari, IE11/Edge, or Opera, then it probably has a HSTS preload list that is at least in part generated from the Chrome one. Firefox have some scripts which go through and check to make sure everything still on the Chrome list is still announcing the preload headers, and will autoremove if that isn't that case, IIRC. I wouldn't be too shocked if Apple/Microsoft were doing something similar.

anujdeshpande 9y ago

Sounds a lot like what happens here in India [1]. Also, if such behaviour is systemic, how should we bring about the paradigm shift in handling such events? Such incidents will happen more often across the world as e-governance becomes more predominant. 1 - https://thewire.in/119578/aadhaar-sting-uidai-files-fir-journalist/ https://thewire.in/119578/aadhaar-sting-uidai-files-fir-jour...

skinnymuch 9y ago

The list of bullet points of the egregious flaws in the software just get worse and worse. It's crazy how I thought the first one or two would be the worst since, but it just got worse.

gargravarr 9y ago
It's 20 freaking 17. How can people release software with these totally elementary mistakes? Just one is bad enough, but... admin/admin?? This is easily worthy of a Daily WTF article to itself. And this software was written by a professional contractor - pretty sure you'd get better quality from a kid fresh out of university, because on my course, it was drilled into me - NEVER TRUST THE CLIENT BROWSER! Companies need to understand, if they want an internet presence, no matter how strong the laws are in their own country, laws don't stop a crime in progress, especially when all they need to do is send a fairly simple message to the website. Computers are dumb, they do what they're told. Giving anyone the loophole to tell them to do something you didn't intend is asking to have it exploited. Going after the messenger will solve nothing. The guy who discovered the payment flaw could easily have kept quiet, letting others discover it, or quietly told his friends, who tell their friends, ad infinitum, and suddenly the whole country is buying valid passes for a penny, costing the company a hideous amount of money. Prosecuting the whistleblower will actually hurt their bottom line.
- Zekio 9y ago
  "NEVER TRUST THE CLIENT BROWSER!" Isn't it mostly in multiplayer game programming where this gets said over and over "Never trust the game client" even though it should be said in all aspects of programming really
  - deleted 9y ago
    [deleted]
  - gargravarr 9y ago
    I would have ended at 'client' but figured it could extend to the human (although that's true too). But yes, there is still so much naivety in implementing distributed or client-server systems that they should trust input from remote sources.

ikeboy 9y ago

>Didn't any of the engineers on the team tell their managers that something isn't right? I find it hard to believe. Or, the managers knew full well the system was shit and they had no time to fix it, but 80k/month is 80k/month.

oblio 9y ago
This is Hungary we're talking about, more likely it was 24k or less.
- ikeboy 9y ago
  The article says >BKK pays T-Systems 80kEUR/month to operate this system. If you were offered that, would you turn it down because you can't actually deliver a secure system in time?
  - oblio 9y ago
    Oh, I missed that part, I thought you were talking about programmer salaries :)

Negative1 9y ago

The price of a ticket was client-side authenticated!? I can't fathom the level of incompetence required to do something like this...

netsharc 9y ago
"Budapest's new e-ticketing system uses state-of-the-art JavaScript to deliver a smooth user experience, combining a great React front-end with a micro-services node.js backend!" - marketing blurb I just made up, needs more buzzwords though.
- jaclaz 9y ago
  ...stateless cloud interactive real-time connection through highly sophisticated authentication featuring dual way private/public key encryption services with single use time-limited tokens ...
  - krylon 9y ago
    Don't forget the blockchain! It needs more blockchain! ;-)
    - freeflight 9y ago
      Also wouldn't mind some "cyber" in there :D
      - jaclaz 9y ago
        ... cyberspace with optional IoT interfacing ... (I had completely forgotten IoT)
    - jaclaz 9y ago
      ... seamlessly integrated via blockchain into ...
lordnacho 9y ago

chx 9y ago

> We knew that they have been working on an NFC/smart card based system for around 4 years, without any visible result despite having spent over 4 million EURs. The public procurement process for the current system called RIGO was indeed 2013 but the whole process is much, much older than that. A more than 300 page feasibility study was published in 2011 https://www.bkk.hu/apps/docs/megvalosithatosagi_vizsgalat.pdf https://www.bkk.hu/apps/docs/megvalosithatosagi_vizsgalat.pd... And a completely different system, called Elektra was announced in 2004 with a 2006 deadline. This whole clusterfuck with RIGO starting in less than a year was absolutely unnecessary since the 2011 study already suggested supporting contactless credit cards so once RIGO starts the only ones using this online ticket purchasing system will be those who have a credit card but not a contactless one. This is a (very) rapidly shrinking audience.

qualitytime 9y ago

Once there was this website which offered phone number to location service. They had a form you could try the demo where it sent an SMS to verify and only allowed one query. If you looked at the source of the page it had hidden fields to override the SMS verification and allow multiple queries. I freaked out some friends for the day and nearly contacted a journalist but lost interest after some weeks. I could have had my 15 minutes of fame or be on some list, or both. It's alright, had some fun.

StreamBright 9y ago

Actually he exploited the bug and purchased a ticket for the fraction of the price and than reported it to the public transportation company. The company that runs the infrastructure (not the public transportation one) followed its internal policy and Hungarian law reported the incident to authorities. Police brought in the guy for questioning.

chx 9y ago
> followed its internal policy and Hungarian law and reported the incident to authorities Ho-humm. Care to point where the Hungarian law mandates this? The old BTK was simpler but even the new is pretty clear in that only a very few serious acts are mandatory to report (meaning not reporting is a felony in itself). 145. and 159 § details how military and civil superiors must report the crimes of those under them, obviously does not apply. 191. § makes reporting attempted or committed kidnapping mandatory. 263. § are crimes against the state, treason, spying and shit. 300. § makes it a crime not to report corruption but only for officials. 317. § makes terrorism mandatory to report. 328. § is about violating international sanctions. Finally 404. § makes reporting of certain financial trickery but only for the actual executor of the bankruptcy. Which one was this one? Or did I miss something? Was he trying to sell stuff to Russia violating the sanctions? Did he make an attempt to overthrow the government? Or what?
- StreamBright 9y ago
  Followed its internal policy -> this is why they did it and Hungarian law -> this is how they did it European law about data protection and breaches, not sure if it is in effect yet and not sure if it applies to this exact case: http://www.lexology.com/library/detail.aspx?g=8185429b-c98d-484a-9fce-890606c42804 http://www.lexology.com/library/detail.aspx?g=8185429b-c98d-...
nithinm 9y ago
By purchasing the ticket, he was confirming the vulnerability. I am sure he knew that they would cancel the ticket when he reported it. I don't find any wrong doing here.

anon4728 9y ago

The master password to a database containing Stanford's sunet identity management system was publicly available. It was reported through channels and fixed quickly. Credit: a friend auditing for fun found it <30 seconds.

SubiculumCode 9y ago

All I want to say is something off topic,but the only vacation I've had away fro m the kids and with my wife was a week in Budapest, and I miss it. Such a beautiful city, so romantic...and I rode the metro everywhere. ahh Budapest. :-)

SubiculumCode 9y ago
not to mention the US dollar spends well there. I felt rich and I am just a potdoc

minademian 9y ago

this reminds me of a dark joke. a rabbit was detained by the secret police. the interrogator asks him, "what are you?" the rabbit says, "rabbit" They torture, beat, and electrocute him for days. Then, the interrogator asks him, "who told you you're a rabbit?"

odabaxok 9y ago

All I can think about, what a shame can this be for the developers releasing this software. There must have been a bunch of people working on this and wasn't there no one to say this is wrong?

daef 9y ago

is HN hugging shop.bkk.hu to death?

daef 9y ago
visiting https://bkk.hu/ https://bkk.hu/ (and watching the dev console) shows that they obviously develop their page http-first (various resources won't load in firefox due mixed http(s))
- daef 9y ago
  and after switching to english the search on the top of the page is broken
  - daef 9y ago
    check robots.txt -> wordpress... seriously?

amingilani 9y ago

In my country, the laws are draconian and totally against this kind of responsible disclosure. But being a good guy, whenever I find something I write a strongly worded email explaining why the company's IT department messed up, how to test said mess-up, and how they can hire my company to ensure these kinds of stupid things don't happen again. I've reported several of these issues, sometimes all I get is single reply months later saying: "fixed".. mostly, nothing. Once I found a SQL injection in a courier service's (very broken) web portal. This was very serious because any idiot could drop all the tables, so I sent an email to the most important worded member of their tiny, yet already bureaucratically structured team. I followed up several times because I knew someone saw my email (I embed beacons in my emails) but gave up after the sixth time. Three months later someone else replied saying "thanks Amin, we've fixed it" On a separate occasion, a large government agency's emails routinely ended up in my spam folder. It was a huge problem, and they acknowledged it and said they couldn't figure out what was wrong. I took five minutes and found the problem to be a misconfigured server on the domain. The server sending the email thought it was `server-a.governmentdomain.com` but there were no DNS entries pointing the subdomain to the server. I reported this problem with clear instructions to test and fix the issue, but I was called despite the instructions, multiple times, to explain the issue with my words over the phone. This was 2 years ago, last I checked, the issue was still present.

ascorbic 9y ago
Offering your company's services could be risky. Whatever your good intentions, it could be portrayed as extortion.
- TechnicalVault 9y ago
  That's why you speak to a lawyer first, the law is an ass, and they're the right tool for telling you how to avoid these nasty little traps.
  - ComodoHacker 9y ago
    ...provided the law in your country really works.

SeanDav 9y ago

Although deeply unfair, this is not unusual, there have been many reported cases of companies shooting the messenger. Unless the company concerned has a well documented and trusted bug bounty procedure, it can be very risky to report a bug in a system, if it involves any kind of hacking. What happens is once the "bug" is reported, someone inside the company asks "How did this happen?". Now the person responsible has 2 options, admit it was their fault and the vulnerability exists and risk being accused of incompetence, or say that the system was hacked. Human nature being what it is, one tends to complain of being hacked, thus snow-balling effects, which lead to the arrest of an 18 year old just trying to help. My advice: Don't report these types of bugs at all, or if you really feel you must, report anonymously.

deleted 9y ago
[deleted]
lerpa 9y ago
One thing that solves this is stating the obvious, something getting hacked means someone was incompetent.
- andai 9y ago
  Indeed, I fail to see the distinction. Perhaps "hackers" have some kind of mythical superpowers in the eyes of the common folk. "There was nothing I could do boss! He's a hacker!"

fredsir 9y ago

We've seen two[1] cases[2] of this in Denmark in the last couple of years surrounding systems that kindergartens are using. The second one is currently (still) being investigated, but the first one was rightfully concluded earlier this year with the "hacker" being acquitted. In both cases, it was dads of children in the institution that noticed the bugs when they were rightfully using the system and were ignored when notifying the responsible party about it until they "shouted it so loudly" that they couldn't be ignored anymore, in which case they were reported to the police for hacking. Links below are in danish, but they can probably be translated if needed. 1: https://www.version2.dk/artikel/boernehavehackeren-frifundet-landsretten-1074257 https://www.version2.dk/artikel/boernehavehackeren-frifundet... 2: https://www.version2.dk/artikel/interview-hacker-tiltalt-jeg-totalt-uskyldig-1077581 https://www.version2.dk/artikel/interview-hacker-tiltalt-jeg...

andai 9y ago
Translated to English: 1: https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=https%3A%2F%2Fwww.version2.dk%2Fartikel%2Fboernehavehackeren-frifundet-landsretten-1074257&edit-text=&act=url https://translate.google.com/translate?sl=auto&tl=en&js=y&pr... 2: https://translate.google.com/translate?hl=en&sl=da&tl=en&u=https%3A%2F%2Fwww.version2.dk%2Fartikel%2Finterview-hacker-tiltalt-jeg-totalt-uskyldig-1077581 https://translate.google.com/translate?hl=en&sl=da&tl=en&u=h...

dogmata 9y ago

I wonder if the outcome would have been the same if instead of marking the price down from 9500HUF to 50HUF it was 9499HUF, the test would have still proved the issue.

Aissen 9y ago

I thought some CERTs were now doing the reporting as way to shield security researchers from this kind of things ? Or did I hear wrong ?

nthcolumn 9y ago

Someone pointed out to me the other day that just connecting to a poorly configured system is illegal in some places (Finland in his case). A form of trespass he said. This was a ship in international waters registered in Russia Federation so not sure whose law applies lol. Perhaps if there were more cases where full advantage was taken of such incompetence with spectacular newsworthy results then people would be more appreciative of the work we do and the laws changed to protect whistle-blowers and activists generally.

wooptoo 9y ago

Just don't bother with companies who don't have a bug bounty system in place.

willhackett 9y ago

A sure-fire way to let vulnerabilities go unnoticed and unfixed.

lebowen 9y ago

A few years ago I also found a serious bug in a debt collection agencies web software. I ordered a phone and neglected to pay import tax and was chased by the agency. I found their website and saw that they developed their management software in-house and made it available for purchase for other agencies. They offered a demo which I used to navigate around, in the demo was a reporting tool which essentially allowed you to send raw SQL queries to an AJAX endpoint. Something along the lines of: http://demosoftware.com/reports/ajax.php?sql=SELECT http://demosoftware.com/reports/ajax.php?sql=SELECT * FROM debts I switched out the demo software domain name for the live version and it worked, not only could I query the database there was no authentication preventing me hitting this end point. At this point I was left with a dilemma, do I "erase" my debt, do I disclose the bug and pay the debt, or simply pay the debt and move on. I chose to pay the debt and move on due to fear of any recriminations. However it has left me uneasy ever since knowing that this company have such bad security and any debtors they are chasing for payments potentially will have all of their personal data leaked.

robtaylor 9y ago
This is where anonymous notification / bug reports are useful, and then follow ups in public if no action after a period of time.
snakeanus 9y ago
Such companies are usually extremely shady and unethical, I would not consider it evil at all to delete all of their recorded debts via tor or something.
- otterley 9y ago
  Would you gladly go to prison for it?
  - snakeanus 9y ago
    No, which is why I mentioned tor.

kutkloon7 9y ago

Not really related to the technological side of the story, but I had a horrible experience with the international trains from Budapest. So they don't need a broken electronic system to provide a horrible service ;) My parents went to buy a ticket at the counter. The lady behind the counter didn't speak English (which is totally OK). Her only communication was a 'go away' movement with her hand, after which she ignore us and signaled for the next customer in line to come to her. Luckily a colleague of her helped us and gave us careful instruction on the time and platform of the train. After we took the train and sat for a few hours, the conductor of the train came and notified that our tickets were invalid. We argued for some time since the lady behind the counter told us this was the right train. The conductor became mad and told us that we had to pay him 50 euros in cash for some unknown reason (presumably to buy a ticket for the train we were on, but his English was very limited). Note that this was a normal train and there was no shortage of seats. In the end, we chose to get out at the next stop, and take the next train, which was about 3 hours later.

minusSeven 9y ago

> someone found out that the admin password was adminadmin and managed to log in using that. Wtf ,I thought I was bad at my job.

andai 9y ago
Conversely, the person who set it to adminadmin probably thought they were doing a great job.

TimJYoung 9y ago

The software industry better start investing more in educating the general public/government officials about how web applications work, or this is only going to get worse with technologies like WebAssembly in the hands of similar companies. If anything, people need to understand that these endpoints can be accessed without a browser, and we can't be arresting people/hauling them in for questioning for sending bad data to such an endpoint. After all, what does "bad data" even mean in such a context ? Also, a question: does the EU have the legal concept of "fair use" ? I would have thought that messing around with a web application would fall under fair use, given that the web application can, and probably will, be stored on a person's computer. A computer that they (also probably) personally own, I might add...

secult 9y ago

We had a similar case - National security authority(NBU SR) of a neighboring country got their public web infrastructure hacked after guessing credentials (nbusr:nbusr123). In the end, guys got free after trial because police were unable to unambiguously identify them.

ohthehugemanate 9y ago

As a Deutsche Telekom client, I can say that this quality level is par for the course for T-Systems. Not surprised at all.

shanky1323 9y ago

THIS --> "someone found out that the admin password was adminadmin and managed to log in using that."

lightedman 9y ago

Not just reporting it, but having actually exploited it to confirm before reporting it, even if just to test. That was the wrong move. What should have been done was the second he had the thought that such a vulnerability could exist, he should have notified them that he believes that there is a possibility for one to alter the site code locally to gain unfair pricing, and to ask them if either he could check for them or if they could check using his proposed method. The second you actually test without permission, you've committed a crime. Jury/court might look at intent later on, but for now, you've committed a crime and are thus subject to arrest.

krallja 9y ago
How do you know if the server validates the price or not, without testing it? Do you report every site that uses HTML forms for being insecure?

aries1980 9y ago

Open-source implementation of the password cryptographic method. https://github.com/moszinet/BKKCrypt https://github.com/moszinet/BKKCrypt

jccooper 9y ago

This sort of thing teaches people to exploit or ignore rather than report. Anyone who reports should be commended, even if they did real hacking (which using dev tools on a web browser is not.) Someone's going to probe your system; you should be glad to hear about it in email rather than in the news or your accountants or from angry customers.

abecedarius 9y ago

> the poor 18 year old 'hacker' who was stupid enough to email them s/stupid/trusting/. There's no reason to think this guy isn't bright, and he's faced enough trouble without piling on.

infinisil 9y ago
I believe the author meant it to sound sarcastic
- abecedarius 9y ago
  It's definitely a jab at the company, but seems to cast a little shade too on the bug-finder. Cf the lede "The amount of stupidity in this story warrants that this is going to be somewhat long". That might not be the author's intent! I hope they'll see this as helpful.

fencepost 9y ago

Two takeaways, one from this and one from my other past experience. First, when testing whether you can change a price and have a transaction go through successfully, RAISE THE PRICE. If you lower the price the affected entity may come back and say "See??? He's STEALING from us! Lock him up!" If you've overpaid for something through their web interface that complaint and issue goes completely away. Second, if you're going to suggest that they contact you for assistance in fixing it also suggest other options. My typical handling for this is with hacked websites, so I'll basically say "Your website has problems X, Y and Z. You should work with whoever you have working on your site to resolve these. If you don't have anyone I may be able to assist you, or I recommend talking with a firm like Sucuri.net which has dealing with and preventing issues like this as their primary business. (My only link with Sucuri is having seen some of their folks do presentations at trade shows.)"

taurath 9y ago
3rd takeaway - don't do this in turkey unless you want to end up in a literal Turkish prison.
- detritus 9y ago
  4th takeaway - the Budapest metro system doesn't quite go that far...
tom_mellior 9y ago
> If you've overpaid for something through their web interface that complaint and issue goes completely away. Or it doesn't, because you have still "hacked them". Doing it in a seemingly bizarre way may only raise more suspicions; obviously you must have maliciously cheated them, since who would give them money? Please don't put people at risk by giving such "advice".
- fencepost 9y ago
  What I was talking about was the question of being accused of theft (by having completed an order/purchase after lowering the price). This was also in the context of someone already intending to push a transaction with an attempted price change. At that point nothing you do with the price is going to prevent a "hacking" charge if there's going to be one, but you may be able to prevent a corresponding "stole from us" charge.

triacus 9y ago

The Hungarian Government Incident Response Center (GOVCERT_Hungary) provides the opportunity to report security vulnerabilities for everyone in an anonymous manner: http://www.cert-hungary.hu/node/397 http://www.cert-hungary.hu/node/397 Better late than never...