3 ms·

Actually he exploited the bug and purchased a ticket for the fraction of the price and than reported it to the public transportation company. The company that r

Actually he exploited the bug and purchased a ticket for the fraction of the price and than reported it to the public transportation company. The company that runs the infrastructure (not the public transportation one) followed its internal policy and Hungarian law reported the incident to authorities. Police brought in the guy for questioning.

chx 9y ago
> followed its internal policy and Hungarian law and reported the incident to authorities Ho-humm. Care to point where the Hungarian law mandates this? The old BTK was simpler but even the new is pretty clear in that only a very few serious acts are mandatory to report (meaning not reporting is a felony in itself). 145. and 159 § details how military and civil superiors must report the crimes of those under them, obviously does not apply. 191. § makes reporting attempted or committed kidnapping mandatory. 263. § are crimes against the state, treason, spying and shit. 300. § makes it a crime not to report corruption but only for officials. 317. § makes terrorism mandatory to report. 328. § is about violating international sanctions. Finally 404. § makes reporting of certain financial trickery but only for the actual executor of the bankruptcy. Which one was this one? Or did I miss something? Was he trying to sell stuff to Russia violating the sanctions? Did he make an attempt to overthrow the government? Or what?
- StreamBright 9y ago
  Followed its internal policy -> this is why they did it and Hungarian law -> this is how they did it European law about data protection and breaches, not sure if it is in effect yet and not sure if it applies to this exact case: http://www.lexology.com/library/detail.aspx?g=8185429b-c98d-484a-9fce-890606c42804 http://www.lexology.com/library/detail.aspx?g=8185429b-c98d-...
nithinm 9y ago
By purchasing the ticket, he was confirming the vulnerability. I am sure he knew that they would cancel the ticket when he reported it. I don't find any wrong doing here.
- StreamBright 9y ago
  And you think that this is going to be enough at the court? Have a look at this list, many of them thought they are not doing anything wrong: https://en.wikipedia.org/wiki/List_of_computer_criminals https://en.wikipedia.org/wiki/List_of_computer_criminals The point is that we live by the law, not how you feel about a certain action. I agree that the law is a bit problematic but regardless we cannot cherrypick which law to follow and which not.
  - bigbugbag 9y ago
    The point being that he should not have been sent to court here, yet they chose to do so anyways.
  - kowdermeister 9y ago
    Yes, that should be enough. You won't get into any trouble if you break a window when the house is on fire. This time, the site was on fire.
- underyx 9y ago
  Also, since he doesn't live in Budapest, it should be obvious he wouldn't be doing it for personal gain — he has no way to use the pass anyway, after all.
ruc0la 9y ago
They took him as a criminal, got his fingerprints, took a photo of him. I do not think they proceeded this in the right way. They should have fixed the bugs, protect our personal data and say sorry for this.
- StreamBright 9y ago
  No, they brought him in as a person of interest following Hungarian law. If you do not like the law please vote the next election a party that changes that or move to a country that does not require police to follow the law. Determining if he is going to be charged with a crime is at later stage in the investigation anyways. There is no such a thing as "They took him as a criminal". Moreover, it is not only Hungarian but also European law to report incidents involving personally identifiable information leaks and there are authorities that investigate and fine companies failing to comply with the law. Any person (including you) can report such companies to authorities.
  - ruc0la 9y ago
    Corruption is also a crime, I do not see the police visiting Mészáros or other entities involving corruption skandals. But ofc I got your point.
    - StreamBright 9y ago
      I see so following up on a cyber crime is corruption?
      - ruc0la 9y ago
        You know exactly, what I have been referring to. The system is broken. Honestly, who cares if a young guy purchased a ticket to prove his right regarding a bug? How could he do otherwise? You need to make sure about the backend part of the system, too. Meanwhile, the company that developed this "service" is silent and the financing part is also not public, but we can be sure it was not cheap. The whole BKK e-ticket system is plain simple, a mediocre dev team could create a better one. I understand that you are experienced in law, I understand what you wrote. Although, I do not think that it was the right thing to do. And maybe because of the reactions and the scandal, it will change in the future. Would not have happened anything if we had just ignored this. We did the right thing.
bigbugbag 9y ago
I'd disagree here, how would he know there was a bug to report if he didn't do it once ? Besides this has been used for decades by corps to prosecute vulnerability reporters, see Serge Humpich who discovered a huge vulnerabilty in bank cards back in 1997. He reported to european bank card Economic Interest Group (EIG) with the support of a lawyer who said they would not believe him until he proved it practically. So he went an bought metro tickets that he did not use but sent them with every details of the transaction. The EIG then got him arrested, prosecuted and sentenced for bank fraud and falsifying a bank card. The fun part is that this got publicized and it was not long before bad guys found the vulnerability too and started issuing yescards (bank card that say yes to any withdrawal from an ATM) and it cost them many tens of billions of euros over a few years due to fraud and upgrading their security and hardware in a hurry.
- StreamBright 9y ago
  He could have used the same value in the hacking as the original one or even adding 1 unit to the original price. This does not cause anybody any damages and it is much easier to defend it at the court while still illegal. If there is no bug bounty program and you do not have a contract to perform such activities than it is not a good idea to engage in such activities.
  - dlgtho 9y ago
    He didn't cause any damages. He reported the issue including the pass he purchased as evidence and it was invalidated.

chx 9y ago

> followed its internal policy and Hungarian law and reported the incident to authorities Ho-humm. Care to point where the Hungarian law mandates this? The old BTK was simpler but even the new is pretty clear in that only a very few serious acts are mandatory to report (meaning not reporting is a felony in itself). 145. and 159 § details how military and civil superiors must report the crimes of those under them, obviously does not apply. 191. § makes reporting attempted or committed kidnapping mandatory. 263. § are crimes against the state, treason, spying and shit. 300. § makes it a crime not to report corruption but only for officials. 317. § makes terrorism mandatory to report. 328. § is about violating international sanctions. Finally 404. § makes reporting of certain financial trickery but only for the actual executor of the bankruptcy. Which one was this one? Or did I miss something? Was he trying to sell stuff to Russia violating the sanctions? Did he make an attempt to overthrow the government? Or what?

StreamBright 9y ago
Followed its internal policy -> this is why they did it and Hungarian law -> this is how they did it European law about data protection and breaches, not sure if it is in effect yet and not sure if it applies to this exact case: http://www.lexology.com/library/detail.aspx?g=8185429b-c98d-484a-9fce-890606c42804 http://www.lexology.com/library/detail.aspx?g=8185429b-c98d-...

nithinm 9y ago

By purchasing the ticket, he was confirming the vulnerability. I am sure he knew that they would cancel the ticket when he reported it. I don't find any wrong doing here.

StreamBright 9y ago
And you think that this is going to be enough at the court? Have a look at this list, many of them thought they are not doing anything wrong: https://en.wikipedia.org/wiki/List_of_computer_criminals https://en.wikipedia.org/wiki/List_of_computer_criminals The point is that we live by the law, not how you feel about a certain action. I agree that the law is a bit problematic but regardless we cannot cherrypick which law to follow and which not.
- bigbugbag 9y ago
  The point being that he should not have been sent to court here, yet they chose to do so anyways.
- kowdermeister 9y ago
  Yes, that should be enough. You won't get into any trouble if you break a window when the house is on fire. This time, the site was on fire.
underyx 9y ago
Also, since he doesn't live in Budapest, it should be obvious he wouldn't be doing it for personal gain — he has no way to use the pass anyway, after all.

ruc0la 9y ago

They took him as a criminal, got his fingerprints, took a photo of him. I do not think they proceeded this in the right way. They should have fixed the bugs, protect our personal data and say sorry for this.

StreamBright 9y ago
No, they brought him in as a person of interest following Hungarian law. If you do not like the law please vote the next election a party that changes that or move to a country that does not require police to follow the law. Determining if he is going to be charged with a crime is at later stage in the investigation anyways. There is no such a thing as "They took him as a criminal". Moreover, it is not only Hungarian but also European law to report incidents involving personally identifiable information leaks and there are authorities that investigate and fine companies failing to comply with the law. Any person (including you) can report such companies to authorities.
- ruc0la 9y ago
  Corruption is also a crime, I do not see the police visiting Mészáros or other entities involving corruption skandals. But ofc I got your point.
  - StreamBright 9y ago
    I see so following up on a cyber crime is corruption?
    - ruc0la 9y ago
      You know exactly, what I have been referring to. The system is broken. Honestly, who cares if a young guy purchased a ticket to prove his right regarding a bug? How could he do otherwise? You need to make sure about the backend part of the system, too. Meanwhile, the company that developed this "service" is silent and the financing part is also not public, but we can be sure it was not cheap. The whole BKK e-ticket system is plain simple, a mediocre dev team could create a better one. I understand that you are experienced in law, I understand what you wrote. Although, I do not think that it was the right thing to do. And maybe because of the reactions and the scandal, it will change in the future. Would not have happened anything if we had just ignored this. We did the right thing.

bigbugbag 9y ago

I'd disagree here, how would he know there was a bug to report if he didn't do it once ? Besides this has been used for decades by corps to prosecute vulnerability reporters, see Serge Humpich who discovered a huge vulnerabilty in bank cards back in 1997. He reported to european bank card Economic Interest Group (EIG) with the support of a lawyer who said they would not believe him until he proved it practically. So he went an bought metro tickets that he did not use but sent them with every details of the transaction. The EIG then got him arrested, prosecuted and sentenced for bank fraud and falsifying a bank card. The fun part is that this got publicized and it was not long before bad guys found the vulnerability too and started issuing yescards (bank card that say yes to any withdrawal from an ATM) and it cost them many tens of billions of euros over a few years due to fraud and upgrading their security and hardware in a hurry.

StreamBright 9y ago
He could have used the same value in the hacking as the original one or even adding 1 unit to the original price. This does not cause anybody any damages and it is much easier to defend it at the court while still illegal. If there is no bug bounty program and you do not have a contract to perform such activities than it is not a good idea to engage in such activities.
- dlgtho 9y ago
  He didn't cause any damages. He reported the issue including the pass he purchased as evidence and it was invalidated.