3 ms·

It's good to see that we Danes have exported something to Sweden. The same thing happened after someone "hacked" some school webapp-thingy, I can't remember the

It's good to see that we Danes have exported something to Sweden. The same thing happened after someone "hacked" some school webapp-thingy, I can't remember the exact details, by changing the URL to get access to another students data. He was promptly reported to the police for hacking after he reported it to the company.

tokai 8y ago
I just looked it up again, and he actually did hack them: "Forælderen, Henrik Høyer havde blandt andet opdaget, at den infoskærm, som hver enkelt børnehave havde i systemet, var befængt med et sikkerhedshul, der tillod cross-site scripting. Ganske enkelt blev de beskeder, som man skrev til den fælles infoskærm, ikke renset for tegn, der gør det muligt at indsende Javascript-kode. Det udnyttede Henrik Høyer til at skrive en simpel Javascript alertbox, der poppede frem med beskeden 'Ring til Infoba og sig at jeres nye intranet løsning er blevet hacket', hvorefter brugeren skulle trykke ‘OK’. Det var der flere af pædagogerne, som så, og som undrede sig over, ifølge Infobas produktchef. »Jeg skrev til Infoba og hørte aldrig fra dem. Så lavede jeg den her løsning, som måske var lige på grænsen for, hvad man må,« siger Henrik Høyer og fortsætter: »Jeg lavede et harmløst javascript, men kunne have gjort det meget værre.«"[0] (Sorry for the danish ya'll) [0] https://www.version2.dk/artikel/foraeldre-finder-banale-sikkerhedshuller-i-udbredt-it-system-til-boernehaver-247985 https://www.version2.dk/artikel/foraeldre-finder-banale-sikk...
- bjoli 8y ago
  My porridge-language is limited, but if I understand correctly he used an XSS vulnerability to place an alert box on the page telling the users of the system they should contact the provider and tell them the system had been hacked. It could of course has been much worse. He was later found not guilty: https://www.version2.dk/artikel/derfor-blev-henrik-hoeyer-frifundet-1074649 https://www.version2.dk/artikel/derfor-blev-henrik-hoeyer-fr...
  - tokai 8y ago
    Yeah totally benign, the only ones guilty of anything is that awful contractor. I just wanted to point out that there was more to the story than a police report over emails.
emiliobumachar 8y ago
If I recall correctly, that's very similar to how Weev went to jail. https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach A very objectionable fellow, but I'm sure they'll move on to more sympathetic ones now that the precedent is set.
- i_cant_speel 8y ago
  The ruling was overturned, so was a precedent really set?
  - superkuh 8y ago
    I guess not. But he was still in prison for 2 years. And anyone else can be put in prison for 2 years without actually comitting a crime too. The CFAA is just that vague. And they likely won't have the legal support that weev did. That's the real precedent here. The feds can and will throw you in prison for years for not comitting a crime.
  - emiliobumachar 8y ago
    From Wikipedia: "On April 11, 2014, the Third Circuit issued an opinion vacating Auernheimer's conviction, on the basis that the venue in New Jersey was improper.[48][49] While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained.[50] He was released from prison on April 11, 2014.[51]" My (foreign layman's) take on it is that the lower court precedent still stands, as it was not formally overturned.

tokai 8y ago

I just looked it up again, and he actually did hack them: "Forælderen, Henrik Høyer havde blandt andet opdaget, at den infoskærm, som hver enkelt børnehave havde i systemet, var befængt med et sikkerhedshul, der tillod cross-site scripting. Ganske enkelt blev de beskeder, som man skrev til den fælles infoskærm, ikke renset for tegn, der gør det muligt at indsende Javascript-kode. Det udnyttede Henrik Høyer til at skrive en simpel Javascript alertbox, der poppede frem med beskeden 'Ring til Infoba og sig at jeres nye intranet løsning er blevet hacket', hvorefter brugeren skulle trykke ‘OK’. Det var der flere af pædagogerne, som så, og som undrede sig over, ifølge Infobas produktchef. »Jeg skrev til Infoba og hørte aldrig fra dem. Så lavede jeg den her løsning, som måske var lige på grænsen for, hvad man må,« siger Henrik Høyer og fortsætter: »Jeg lavede et harmløst javascript, men kunne have gjort det meget værre.«"[0] (Sorry for the danish ya'll) [0] https://www.version2.dk/artikel/foraeldre-finder-banale-sikkerhedshuller-i-udbredt-it-system-til-boernehaver-247985 https://www.version2.dk/artikel/foraeldre-finder-banale-sikk...

bjoli 8y ago
My porridge-language is limited, but if I understand correctly he used an XSS vulnerability to place an alert box on the page telling the users of the system they should contact the provider and tell them the system had been hacked. It could of course has been much worse. He was later found not guilty: https://www.version2.dk/artikel/derfor-blev-henrik-hoeyer-frifundet-1074649 https://www.version2.dk/artikel/derfor-blev-henrik-hoeyer-fr...
- tokai 8y ago
  Yeah totally benign, the only ones guilty of anything is that awful contractor. I just wanted to point out that there was more to the story than a police report over emails.

emiliobumachar 8y ago

If I recall correctly, that's very similar to how Weev went to jail. https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach A very objectionable fellow, but I'm sure they'll move on to more sympathetic ones now that the precedent is set.

i_cant_speel 8y ago
The ruling was overturned, so was a precedent really set?
- superkuh 8y ago
  I guess not. But he was still in prison for 2 years. And anyone else can be put in prison for 2 years without actually comitting a crime too. The CFAA is just that vague. And they likely won't have the legal support that weev did. That's the real precedent here. The feds can and will throw you in prison for years for not comitting a crime.
- emiliobumachar 8y ago
  From Wikipedia: "On April 11, 2014, the Third Circuit issued an opinion vacating Auernheimer's conviction, on the basis that the venue in New Jersey was improper.[48][49] While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained.[50] He was released from prison on April 11, 2014.[51]" My (foreign layman's) take on it is that the lower court precedent still stands, as it was not formally overturned.