Kid found a way to travel for free in Budapest. He filed a bug report. And was promptly arrested The arrest of a Hungarian bloke after he discovered a massive flaw in the website of Budapest's transport authority – and reported it – has sparked a wave of protests. Thousands of users have flooded the Facebook page of the capital city's transport authority Budapesti Közlekedési Központ (BKK) – and its main website was taken …
That Mr Kálmán Dabóczi was rubbing his hands with glee at the thought of being able to report that *HE* had bought to justice an *Evil* haxor and would be showered with cash and prizes.
Whoops; How bad, how sad, never mind.
Next time these idiots screw up; I suspect that the 0-Day will quietly sold on the black market :(
Muppets
No good deed goes unpunished. This has happened before in the past, and it's why I don't help anyone and if I find a flaw in a system I abuse it 'til the cows come home, because I know exactly how bad they would treat me if I kindly reported it instead
I think there's a little step in between that has been skipped over here: you can notify a company of a breach WITHOUT using the weakness. Not that that in any way excuses the way they handled it (I would rip a serious strip off T Mobile for this), but if you find a weakness best let the service owner generate their own evidence or you leave yourself open to exactly this sort of stupidity. You still hold the rights of the notification(and can maybe set a time limit) but at least it makes it much harder to accuse you of hacking because you have not acted on the weakness (it makes it impossible to prove harm in court).
I have been there on a number of occasions, and the only time I ever actively used a vulnerability I ensured I had prior written permission to do so - and even then I stopped before it got dangerous (it would have had a global impact). With ability comes responsibility, just because you can doesn't mean you automatically should.
In the days I did security audits (when they were still "find and fix" instead of "find me some problems so I don't need to give the team a raise but still leave me compliant" tickbox affairs), I once had to evaluate the segregation between some divisions at a bank. It took me just a few minutes to discover that that segregation was at best imaginary, but I was shocked I had to explain to the project leader that I wasn't going to copy any file as evidence because having access to information meant that any leak of that information would create risks for us.
Instead, I got an authorised member of the division who owned that data and let him do the copy and sign off that he could so in the manner I described which could have gotten ugly from a regulatory point of view.
That said, I'm done with the public good work. In my experience, if you find a flaw, especially a dangerous one, and you just disclose it to an organisation, the first thing that happens is that the company tried to hide it. Now I sell them a couple of days of my time which allows me to document the problem for them, find an approach to mitigation and gives them the benefit of a non disclosure agreement. It's not an approach everyone agrees with, but I work in spheres where public disclosure is frowned upon, and this ensures that the issue is at least flagged and processed at the right level.
"you can notify a company of a breach WITHOUT using the weakness."
You honestly think they'll believe such stories and would bother to look into them? I don't.
To me this is no different than playing on a Minecraft server and finding a bug. First you try it again to ensure that it was really a bug or a glitch and not an oversight on your end. Once you got that out of the way you get all you need to report it.
The #1 rule of bug discovery is the reproduction of the glitch. If you can't reproduce a bug then you also can't be 100% sure it actually was a bug.
Precisely. I have quite a collection of certain things I shall not mention. Notification only is the way to go. However there was a time very early in the game when I used one of those certain things to shut down someone on their own territory. I exchanged pleasantries and it worked very well. I wear a white hat but is a bit stained with time.
""you can notify a company of a breach WITHOUT using the weakness.""
Says the IT professional with more than a decade of experience.
This is an 18 year old under discussion, not somebody with years of experience in the IT School Of Hard Knocks to help shape the way they deal with duplicitous bureaucrats.
I didnt read anything about what order anything happened , but i dont think we have the full story
Did he *really* inform the authorities 2 minutes after finding it? Funny behaviour for an 18 year old computer enthusiast.
"and then posted his discovery of the hole online." - ah now i see why the authorities are up in arms . So he went through the motions of informing them on an unmonitored email, , just to tick that box , before shouting about it loudly on the web in order to gain moneyz , famez , girlz, lulz ,credz whatever it is the kiddies want these days....
So you found a bug in a corporate or government system. Expect no gratitude; rather, expect exactly what this young man received: retaliation and punishment for the exposure of an embarrassment to the authorities.
It's a common knee-jerk reaction here in the U.S. KILL Destroy the Messenger, cover up the mess, and... deny, deny, deny.
Sounds like the guy found the bug, emailed the company, after some indeterminate time made the bug public. Perhaps at that time some clever people were able to ride for free for a short time, due to the company's failure to promptly respond to a bug report. Such a tragedy.
One can see how they might be miffed at the short notice, but it's way better than being blind-sided. They have no moral leg to stand on.
Sounds to me like T-Systems fucked up and this guy contacted BKK about it (entirely reasonably). Effectively reporting a problem to T-System's employer. Probably the first thing that happened was BKK called up T-Systems and the latter went "Not Us! Evil Hackers!"
But who knows? What was the notice period he gave them before disclosing it publically?
It's almost like they're on this holy crusade against the rest of humanity who are all eeeeeevil scum trying to ride for free (some of which certainly are, granted) - but it's an irreconcilable "us vs. them" thing. And a large dose of "you made me lose face in public therefore I will eat you soul" corporate vindictiveness, with some "l'etat c'est moi" knee-jerk Stasi reflexes (very much alive and well, make no mistake). Nobody in any position of power is there to serve, they're there to cover their own precious asses at all times and crush troublemakers (defined as anyone potentially interfering with the flow of money into their own pockets) in their little fiefdoms. When you look at it that way, the hapless bloke causing embarrassment is obviously a major threat.
Hungary suffers a lot from crony capitalism/statism. Lots of EU money comes to Hungary for things like building roads; these contracts are allocated on the basis "Who do you know, and how much are you prepared to pay in kickbacks". Cigarettes can only be sold in special single purpose shops, funnily the licenses to operate them seem to only go to relatives of local politicians.
Did somebody say cat video? Where???
Damn. There was no cat video. :(
I'll just have to provide one myself.
El Reg needs a cat video icon. :)
What he did to earn that kind of love was (mostly) raise them from cubs after they'd been abandoned by other sanctuaries/breeders.
Then there's his Tough Love video.
I'm not (quite) insane enough to try it myself. I know you need to bond with them from an early age for that to happen safely. Well, sort of safely. He's had a few nips and scratches. Serious ones. He says they don't know their own strength. Actually, they do, it's that they don't know how weak he is and play as hard with him as they do with each other.
Even so, knowing how utterly insane it would be for me to try it, I keep wishing I could give it a go.
Offtopic but there's a good video on Youtube about a Lion called Christian, bought at Harrods, kept in a London apartment, released back into the wild. Several years later in Kenya still remembers his former owners and comes up and greets them and his pride of completely wild lions are all totally chilled out around them.
It seems pretty fitting these days (at least in the UK).
95% of the 'young adults' I meet these days are pretty child-like in their emotional range. It's almost like they've been wrapped in cotton wool all their lives and not taken any risks (therefore not suffered any failures from which to learn).
"You seem to have fallen into the trap of assuming that all 18 year olds are mature, responsible, level-headed-adults..."
Not at all, but by all reasonable definitions you cease being a kid at the age of 18 - he is over this age so is legally no longer a kid. Maturity does not come into it.
My point of course being that the more we pander to these immature *adults* by referring to them as kids the worse the problem gets, we are reinforcing the attitude that they dont need to accept responsibility for their own actions because they are 'not all growed up yet'.
I read an article the other week that some people don't consider themselves to be "grown up" until they hit 30... Jesus, what kind of messed up generation are we raising?
None of the above rant has any bearing on the subject of the article who I dont believe has referred to himself as a kid at all, its just the way that its being reported that I object to!
Having said all of that I now feel very old.
Damn kids, get off my lawn.
"Not at all, but by all reasonable definitions you cease being a kid at the age of 18 - he is over this age so is legally no longer a kid. Maturity does not come into it."
Childhood is being ever extended. See the Challenge 21 scheme and now the Challenge 26 scheme for sale of age restricted items in the UK. Or the US, must be 21 to buy alcohol in so many places and even aged 90, you still have to show ID to prove you are old enough to buy alcohol in most places.
"You were oh so wise and mature as soon as you turned 18?"
Probably not.. though maybe (at 18 I was in stead full time employment and looking to buy my first house with my partner) , but that's not the point, I don't care if your 18 or a 50 year old man child you are legally an adult with all of the responsibilities of such at 18.
@d3vy
Not at all, but by all reasonable definitions you cease being a kid at the age of 18 - he is over this age so is legally no longer a kid.
Your definition of reasonable is not reasonable.
If the author had of said minor, then you might have had a leg to stand on.
Kid != legal minor.
Kid does not have a legal definition (since you are referring to 'legally no longer a kid') that sets a specific age.
Kid just means someone who is younger than the speaker, 90 year old's call 40 year old's kids.
When I was a youngin. the adults (and police, teachers, and so on) had a term for those in the ~14-~25 year old range, which seems to have fallen out of vogue in these "wrap em in cotton wool so no harm ever comes to them" times. It wasn't "minor" if you were under 18, or 'adult' if you were over 18, it was 'youth'. As in the YMCA, Y=youth. It was an acknowledgement that at say 15, no matter that you are a minor, you aren't (mentally) a child, and likewise if you are 20 doesn't mean you are (mentally) an adult.
You don't magically stop being immature and childish the moment you turn 18, and likewise just because you are 15 doesn't mean you are immature and childish.
Words like kid, child. adult, youth, 'tween, are often used as an indicator of maturity, or as an indicator of relative age, or the level of (dis)respect the speaker has of the subject, not necessarily as a legal statement of calendar age.
When 18 year old Children begin to act like Adults, I may give it a go. Until then, everyone I know that is under 30 is a "Kid". Get over it.
As evidence, I submit his Starry Eyed Nievete' that The Process actually Functions, Correctly. Any reasonable adult knows this is bullshit of the first order.
The CEO fella claims it was posted online
>
As the outcry against the company's actions grew, Dabóczi was forced to defend himself Monday morning on the radio. He doubled-down, claiming that the boy has sent his emails to accounts that he knew the company would not read – one of which was bkk@bkk.hu – and then posted his discovery of the hole online.
...that great Richard Feynman safe-cracking story at Los Alamos. When he informed the General (I think it was) that classified military documents were at risk because he could easily open the safe door, Feynman was instead excluded from accessing the area where the 'safe' was. He was seen as the risk, not the fact that the expensive new safe was not fit for purpose.
"The Ravenous Bugblatter Beast of Traal is a vicious wild animal from the planet of Traal, known for its never-ending hunger and its mind-boggling stupidity. The Guide calls the bugblatter the stupidest creature in the entire universe - so profoundly unintelligent that, if you can't see it, it assumes it can't see you."
Seems about right.
This is much the same thing. Guy discovers gaping hole in computers, is held to blame and arrested - this is an attempt by the site owners (in this case USA military) from having to admit that their own staff are incompetent. It is called saving face that just ends up showing the site owner to be arrogant & stupid.
Working in my first job for the Benefits Agency I showed the sysadmin how a simple tool, built into Windows 3.1 could act as a keylogger and defeated the PID(keycard) system completely using a decoy card.
Next day I was pulled into an office with my line manager and was told off for "meddling".
Whenever I see obvious tech or non-tech door wide open staring you in the face hilariously stupid mistakes in massive companies, I walk on by and "forget" I ever saw it.
If you are a small company/business I may mention it, politely, but not even expect you to notice me beyond "that strange person who pointed at that window in the shop". I barely even bother with those, as most companies have been going for 10+ years, so why would me spotting something like a door left open, make any difference, they are probably just on a cig break out the back anyhow.
Non anon, because even the Reg will get hacked one day and loose the credentials anyhow, and who would be interested in me? :P
> The tale started last week when an unnamed 18-year-old found that he was able to,
> when purchasing a ticket online, poke the BKK website in a particular way to modify
> the ticket's price and buy it at that new price.
and then
> "I did not use the ticket, I do not even live near Budapest, I never traveled on a
> BKK route. My goal was just to signal the error to the BKK in order to solve it, and not to use it."
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
