4 ms·

https://news.ycombinator.com/item?id=19191241 https://news.ycombinator.com/item?id=19191241 It was discussed

by HNLurker2 8y ago

bjoli 8y ago
Oh, but it is the gift that keeps on giving. The sheer incompetence behind this is enormous.
- JoachimS 8y ago
  Indeed. The company has now gone to the police to report the newspaper and its journalist for hacking.
  - chopin 8y ago
    This surely will end well for the company.
  - Strom 8y ago
    A classic move. Do you have any sources to link for this? I'm interested in reading more about them reporting the journalist.
    - zyberzero 8y ago
      You can read more here[0], unfortunately it is in Swedish, and not that much. More or less, the editor in chief of the journal denies to comment. The charges are suspected data breaches, suspected instigation of data breaches and unauthorized disclosure of personal data. [0] https://omni.se/medhelp-polisanmaler-tidning-efter-avslojande/a/8wy6GW https://omni.se/medhelp-polisanmaler-tidning-efter-avslojand...
  - ambentzen 8y ago
    It's good to see that we Danes have exported something to Sweden. The same thing happened after someone "hacked" some school webapp-thingy, I can't remember the exact details, by changing the URL to get access to another students data. He was promptly reported to the police for hacking after he reported it to the company.
    - tokai 8y ago
      I just looked it up again, and he actually did hack them: "Forælderen, Henrik Høyer havde blandt andet opdaget, at den infoskærm, som hver enkelt børnehave havde i systemet, var befængt med et sikkerhedshul, der tillod cross-site scripting. Ganske enkelt blev de beskeder, som man skrev til den fælles infoskærm, ikke renset for tegn, der gør det muligt at indsende Javascript-kode. Det udnyttede Henrik Høyer til at skrive en simpel Javascript alertbox, der poppede frem med beskeden 'Ring til Infoba og sig at jeres nye intranet løsning er blevet hacket', hvorefter brugeren skulle trykke ‘OK’. Det var der flere af pædagogerne, som så, og som undrede sig over, ifølge Infobas produktchef. »Jeg skrev til Infoba og hørte aldrig fra dem. Så lavede jeg den her løsning, som måske var lige på grænsen for, hvad man må,« siger Henrik Høyer og fortsætter: »Jeg lavede et harmløst javascript, men kunne have gjort det meget værre.«"[0] (Sorry for the danish ya'll) [0] https://www.version2.dk/artikel/foraeldre-finder-banale-sikkerhedshuller-i-udbredt-it-system-til-boernehaver-247985 https://www.version2.dk/artikel/foraeldre-finder-banale-sikk...
      - bjoli 8y ago
        My porridge-language is limited, but if I understand correctly he used an XSS vulnerability to place an alert box on the page telling the users of the system they should contact the provider and tell them the system had been hacked. It could of course has been much worse. He was later found not guilty: https://www.version2.dk/artikel/derfor-blev-henrik-hoeyer-frifundet-1074649 https://www.version2.dk/artikel/derfor-blev-henrik-hoeyer-fr...
        tokai 8y ago
        Yeah totally benign, the only ones guilty of anything is that awful contractor. I just wanted to point out that there was more to the story than a police report over emails.
    - emiliobumachar 8y ago
      If I recall correctly, that's very similar to how Weev went to jail. https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach A very objectionable fellow, but I'm sure they'll move on to more sympathetic ones now that the precedent is set.

https://news.ycombinator.com/item?id=19191241 https://news.ycombinator.com/item?id=19191241 It was discussed

bjoli 8y ago

Oh, but it is the gift that keeps on giving. The sheer incompetence behind this is enormous.

JoachimS 8y ago
Indeed. The company has now gone to the police to report the newspaper and its journalist for hacking.
- chopin 8y ago
  This surely will end well for the company.
- Strom 8y ago
  A classic move. Do you have any sources to link for this? I'm interested in reading more about them reporting the journalist.
  - zyberzero 8y ago
    You can read more here[0], unfortunately it is in Swedish, and not that much. More or less, the editor in chief of the journal denies to comment. The charges are suspected data breaches, suspected instigation of data breaches and unauthorized disclosure of personal data. [0] https://omni.se/medhelp-polisanmaler-tidning-efter-avslojande/a/8wy6GW https://omni.se/medhelp-polisanmaler-tidning-efter-avslojand...
- ambentzen 8y ago
  It's good to see that we Danes have exported something to Sweden. The same thing happened after someone "hacked" some school webapp-thingy, I can't remember the exact details, by changing the URL to get access to another students data. He was promptly reported to the police for hacking after he reported it to the company.
  - tokai 8y ago
    I just looked it up again, and he actually did hack them: "Forælderen, Henrik Høyer havde blandt andet opdaget, at den infoskærm, som hver enkelt børnehave havde i systemet, var befængt med et sikkerhedshul, der tillod cross-site scripting. Ganske enkelt blev de beskeder, som man skrev til den fælles infoskærm, ikke renset for tegn, der gør det muligt at indsende Javascript-kode. Det udnyttede Henrik Høyer til at skrive en simpel Javascript alertbox, der poppede frem med beskeden 'Ring til Infoba og sig at jeres nye intranet løsning er blevet hacket', hvorefter brugeren skulle trykke ‘OK’. Det var der flere af pædagogerne, som så, og som undrede sig over, ifølge Infobas produktchef. »Jeg skrev til Infoba og hørte aldrig fra dem. Så lavede jeg den her løsning, som måske var lige på grænsen for, hvad man må,« siger Henrik Høyer og fortsætter: »Jeg lavede et harmløst javascript, men kunne have gjort det meget værre.«"[0] (Sorry for the danish ya'll) [0] https://www.version2.dk/artikel/foraeldre-finder-banale-sikkerhedshuller-i-udbredt-it-system-til-boernehaver-247985 https://www.version2.dk/artikel/foraeldre-finder-banale-sikk...
    - bjoli 8y ago
      My porridge-language is limited, but if I understand correctly he used an XSS vulnerability to place an alert box on the page telling the users of the system they should contact the provider and tell them the system had been hacked. It could of course has been much worse. He was later found not guilty: https://www.version2.dk/artikel/derfor-blev-henrik-hoeyer-frifundet-1074649 https://www.version2.dk/artikel/derfor-blev-henrik-hoeyer-fr...
      - tokai 8y ago
        Yeah totally benign, the only ones guilty of anything is that awful contractor. I just wanted to point out that there was more to the story than a police report over emails.
  - emiliobumachar 8y ago
    If I recall correctly, that's very similar to how Weev went to jail. https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach A very objectionable fellow, but I'm sure they'll move on to more sympathetic ones now that the precedent is set.