4 ms·

A kid in Hungary was arrested for exactly this (and it was a cheap bus ticket): https://www.bitdefender.com/en-us/blog/hotforsecurity/budapest-police-arrest-hac

A kid in Hungary was arrested for exactly this (and it was a cheap bus ticket): https://www.bitdefender.com/en-us/blog/hotforsecurity/budapest-police-arrest-hacker-for-revealing-bug-in-e-ticket-system https://www.bitdefender.com/en-us/blog/hotforsecurity/budape...

School-Cotton 1y ago
It doesn’t seem crazy to me that someone should be arrested for that! It’s stealing. If someone came in my house and stole my property I’d expect them to be arrested, even if I had stupidly left the door wide open.
- Nextgrid 1y ago
  According to the article the system was developed by a regional subsidiary of a German mobile telco, which already tells you everything you need to know about its quality, but on top of that it was rushed to launch in time for some sporting event and thus even less testing was done that would normally happen. Here's a better article: https://techcrunch.com/2017/07/25/hungarian-hacker-arrested-for-pressing-f12/ https://techcrunch.com/2017/07/25/hungarian-hacker-arrested-... - it seems like this was good faith security research (he disclosed the issue after testing it) and he couldn't use the transport pass he "stole" because he didn't even live in their service area anyway. This arrest had nothing to do with stealing and all to do with putting well-connected, incompetent people in a very uncomfortable position.
- jacquesm 1y ago
  Why are you on HN? A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper even if - hah, as if that happens - they made an arrest. The only reason you are hearing about this is because someone at 'bigcorp' didn't want to accept responsibility for their fuckups, and so they used the law to come down on some kid which effectively did them a service, which costs society a large pile of money, further externalizing the cost of their fuckup.
  - motorest 1y ago
    > A kid showed up a bunch of big names. The kid purposely changed the price of a service to lower it to an insignificant fraction (reportedly from ~27£ to ~0.15£). If that same kid went around a supermarket replacing price tags to lower the selling price, would you call it "showing up a bunch of big names"? Say what you may about how broken and buggy the system was. Purposely misusing it for financial advantage is still a no-no.
    - jacquesm 1y ago
      How do you propose he would have been able to establish that this was indeed a vulnerability?
      - motorest 1y ago
        > How do you propose he would have been able to establish that this was indeed a vulnerability? I could comment extensively on the issue, as it is not as cut and dry as you imply. Instead, I'm going to link to the HM discussion from 2017 , as I think it is insightful and covers nuances. https://news.ycombinator.com/item?id=14835515 https://news.ycombinator.com/item?id=14835515
    - detaro 1y ago
      Did the kid go around changing price tags, or did they just show that it was possible?
    - achairapart 1y ago
      Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above: > Did you try adjusting price? And he was punished for "hacking", not for stealing, and for indirectly putting to shame who was responsible for the epic fail.
      - motorest 1y ago
        > Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above You're failing to address the point. It is also trivial to switch price tags in supermarkets. If a kid rips off the tag of an expensive product, tacks on another price tag for pennies, and proceeds to pay the reported price at the checkout counter, is this something deemed acceptable or even classified as vulnerability research? Make no mistake: the system was a shit show and all companies involved pulled some "sociopath mid-level manager saving his ass" moves. But the issue is nuanced.
- detaro 1y ago
  It's more that they walked by, saw your door open, popped their head in and then called for you to make sure you knew the door was open.
- wqaatwt 1y ago
  No. It’s if you were selling something in your house for $10. Somebody came in, crossed out the number on the tag, wrote down $1 and handed you a bill. Then you took their money and gave them the item without saying anything. Would seem like a weird situation but I don’t see how its theft.
  - LudwigNagasena 1y ago
    I bet that would be most likely classified as shoplifting and/or fraud depending on jurisdiction.
    - wqaatwt 1y ago
      Or a form of negotiation if done in plain sight.

School-Cotton 1y ago

It doesn’t seem crazy to me that someone should be arrested for that! It’s stealing. If someone came in my house and stole my property I’d expect them to be arrested, even if I had stupidly left the door wide open.

Nextgrid 1y ago
According to the article the system was developed by a regional subsidiary of a German mobile telco, which already tells you everything you need to know about its quality, but on top of that it was rushed to launch in time for some sporting event and thus even less testing was done that would normally happen. Here's a better article: https://techcrunch.com/2017/07/25/hungarian-hacker-arrested-for-pressing-f12/ https://techcrunch.com/2017/07/25/hungarian-hacker-arrested-... - it seems like this was good faith security research (he disclosed the issue after testing it) and he couldn't use the transport pass he "stole" because he didn't even live in their service area anyway. This arrest had nothing to do with stealing and all to do with putting well-connected, incompetent people in a very uncomfortable position.
jacquesm 1y ago
Why are you on HN? A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper even if - hah, as if that happens - they made an arrest. The only reason you are hearing about this is because someone at 'bigcorp' didn't want to accept responsibility for their fuckups, and so they used the law to come down on some kid which effectively did them a service, which costs society a large pile of money, further externalizing the cost of their fuckup.
- motorest 1y ago
  > A kid showed up a bunch of big names. The kid purposely changed the price of a service to lower it to an insignificant fraction (reportedly from ~27£ to ~0.15£). If that same kid went around a supermarket replacing price tags to lower the selling price, would you call it "showing up a bunch of big names"? Say what you may about how broken and buggy the system was. Purposely misusing it for financial advantage is still a no-no.
  - jacquesm 1y ago
    How do you propose he would have been able to establish that this was indeed a vulnerability?
    - motorest 1y ago
      > How do you propose he would have been able to establish that this was indeed a vulnerability? I could comment extensively on the issue, as it is not as cut and dry as you imply. Instead, I'm going to link to the HM discussion from 2017 , as I think it is insightful and covers nuances. https://news.ycombinator.com/item?id=14835515 https://news.ycombinator.com/item?id=14835515
  - detaro 1y ago
    Did the kid go around changing price tags, or did they just show that it was possible?
  - achairapart 1y ago
    Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above: > Did you try adjusting price? And he was punished for "hacking", not for stealing, and for indirectly putting to shame who was responsible for the epic fail.
    - motorest 1y ago
      > Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above You're failing to address the point. It is also trivial to switch price tags in supermarkets. If a kid rips off the tag of an expensive product, tacks on another price tag for pennies, and proceeds to pay the reported price at the checkout counter, is this something deemed acceptable or even classified as vulnerability research? Make no mistake: the system was a shit show and all companies involved pulled some "sociopath mid-level manager saving his ass" moves. But the issue is nuanced.
detaro 1y ago
It's more that they walked by, saw your door open, popped their head in and then called for you to make sure you knew the door was open.
wqaatwt 1y ago
No. It’s if you were selling something in your house for $10. Somebody came in, crossed out the number on the tag, wrote down $1 and handed you a bill. Then you took their money and gave them the item without saying anything. Would seem like a weird situation but I don’t see how its theft.
- LudwigNagasena 1y ago
  I bet that would be most likely classified as shoplifting and/or fraud depending on jurisdiction.
  - wqaatwt 1y ago
    Or a form of negotiation if done in plain sight.