Australian Teen Reports SQL Injection Vulnerability, Company Calls Police

FuzzNugget writes with an excerpt from Wired, which brings us the latest in security researcher witch hunts: "Joshua Rogers, a 16-year-old in the state of Victoria, found a basic security hole that allowed him to access a database containing sensitive information for about 600,000 public transport users who made purchases through the Metlink web site run by the Transport Department. It was the primary site for information about train, tram and bus timetables. The database contained the full names, addresses, home and mobile phone numbers, email addresses, dates of birth, and a nine-digit extract of credit card numbers used at the site, according to The Age newspaper in Melbourne. Rogers says he contacted the site after Christmas to report the vulnerability but never got a response. After waiting two weeks, he contacted the newspaper to report the problem. When The Age called the Transportation Department for comment, it reported Rogers to the police.'"

Comments

Was not arrested

[F'Nok]

The article says he was reported to police, but not arrested or even contacted by the police.

He only even knows he was reported to the police because the journalist told him.

Seriously, can we at least read the article before making up wrong headlines?

Re:Was not arrested

[F'Nok]

Perhaps you missed the point, so I'll make it more clear.
While it would be really messed up to arrest someone for pointing out a problem, the key factor here is that HE WAS NOT ARRESTED.

See how that kinda changes the overall theme?

Sure, direct some anger at the idiot company that reported him for this, they are morons and the police should tell them to stop being morons.
But it sounds like they actually might have done just that, because the police did not arrest him.

They did not arrest. The overall theme should be about the idiot company, not the police.

Re:Was not arrested

[Anonymous Coward]

Yeah, but regardless, this kid went out of his way to help out this company, and they repay him by having the cops toss him in the clink. The overall theme SHOULD be the idiot company, but in the meantime lets not forget about the cops who arrested him.

Re:Was not arrested

[jones_supa]

I cancel that comment. If you read the line "He says the police have not contacted him and that he only learned he’d been reported to the police from the journalist who wrote the story for The Age." carefully, you can see that he only heard from the reporter that the kid had been reported to the police (by TD). D'oh!

Re:Was not arrested

[Anonymous Coward]

And when the kid grows up, he'll know not to help people, because in the real world, people do not deserve it.

Re: Was not arrested

[dwarfsoft]

What clink? He wasn't arrested. He hasn't even been approached by the police.

Re:Was not arrested

[H0p313ss]

in the meantime lets not forget about the cops who arrested him.

The non-existent ones? This is getting very meta-physical, I may have to make some coffee.

Re: Was not arrested

[Anonymous Coward]

Then how did he wind up in prison? He certainly didn't place himself under arrest. I guess we'll just have to hear the rest of the story once he's out on parole, the cops certainly aren't talking.

Re: Was not arrested

[Darinbob]

He's not in prison...

Although the article does make a mention about someone else who was arrested in the past, an old story that was already here in slashdot. Maybe readers of the article aren't reading for comprehension?

Re: Was not arrested

[Anonymous Coward]

Hopefully he'll be available to clear all of this up one the police release him from custody.

Re: Was not arrested

[Anonymous Coward]

You know, I really admire your patience with the GP. I can't believe how stupid the GP is, misreading the article like that. If I were you, I'd have thrown the GP in the same jail the hacker kid is.

Re: Was not arrested

[Anonymous Coward]

I don't see what's so funny about a kid getting arrested.

Re: Was not arrested

[Rational]

You know what's even more messed up? To throw someone in a vat of acid for reporting a problem. Like the arrest, that did not happen either, but since facts don't matter it would have made a better headline, right?

Re:Was not arrested

[bloodhawk]

Actually the lesson should be never run a pen test against a web site you don't have permission to do against, it really is that simple, especially a government body.

Re:Was not arrested

[umghhh]

this is OT but for a change I had a portion of a good lough this morning while reading this part of the thread. Luckily I do not have to read this from the prison like this kid.

Re: Was not arrested

[Anonymous Coward]

Please, stop with the self-righteous posturing. Where were you when this kid was spending his best years in jail ? Where where you when his mother committed suicide ?

Re:Was not arrested

[cffrost]

The article says he was reported to police, but not arrested or even contacted by the police.

He only even knows he was reported to the police because the journalist told him.

Seriously, can we at least read the article before making up wrong headlines?

Please, you've been here longer than I have. Surely you know that the "news" items here aren't meant to be an expression of reality, but a hypothetical interpretation of reality meant to foster vigorous discussion of various subjects and hypothetical constructs. ;o)

Re:Was not arrested

[Bing Tsher E]

Well kids, now you know what the smart thing is to do: don't run pen tests against websites without permission.

Similarly, don't walk down the hall in apartment buildings you don't live in wiggling the door handles. Sure, it's just innocent fun, and you were just doing it so you could write letters to the addresses of doors you found unlocked warning them, but it looks bad.

Re:Was not arrested

[mark-t]

Perhaps you are missing a key factor in that the article specifically says that the source "doesnâ(TM)t say whether the police took any action against Rogers", and that there is certainly precedent for people who have done something similar ending up getting arrested, some of who are still in prison.

Re:Was not arrested

[wolrahnaes]

Except that many important security holes affecting the general population have been found this way. "Grey hat" pentesting (which I'm defining as unapproved but without malicious intent) is of critical importance for pretty much any public-facing system. The "black hat" crowd will be hitting it anyways, and who would you rather have find the problem? The one who'll report it or the one who'll exploit it?

Sure it's a risky thing to do and I sure wouldn't intentionally associate any such behavior with my real identity, but its something we should be encouraging because the other option is worse.

Re:Was not arrested

[bill_mcgonigle]

a hypothetical interpretation of reality meant to foster vigorous discussion of various subjects and hypothetical constructs

I'm nominating this to replace "News for Nerds. Stuff that Matters."

Re: Was not arrested

[Billlagr]

Well that would make her, what, 11 when she had sex? Maybe they should be investigating the father for possible jail time?

The law does not care ...

[perpenso]

The law does not care if you are white hat or black hat. Well at least with respect to guilt, it can be considered at sentencing.

If its not your computer and if you don't have the owner's permission you can't do penetration testing without putting yourself at risk.

Re:The law does not care ...

[SuricouRaven]

That the good Samaritan gets away with it has little to do with the law as written - according to the law, it's still vandalism. What actually happens is the prosecution service decides that, in this instance, the law is best left unenforced. This discretion is important, as it's the only way to manage the very complicated system of laws - everyone commits crimes, every day. If every crime was prosecuted, most countries would need to imprison their entire population.

It goes out the window if you manage to upset someone in a position of wealth or power though. Do that, and they will easily find something to prosecute you for.

Re:The law does not care ...

[gnasher719]

That the good Samaritan gets away with it has little to do with the law as written - according to the law, it's still vandalism.

Breaking into a car to get a baby out that is suffering from heat (especially in Australia, where this could be quite severe in some places) is not vandalism, it is self defense. Self defense covers protecting others as well, and allows use of an appropriate amount of violence. Breaking into a car to safe a baby from a heat stroke seems appropriate.

Incorrect.

[jamesn]

From the article:
"Update 1.9.14: Rogers confirmed to WIRED that the vulnerability he found was a SQL-injection vulnerability. He says the police have not contacted him and that he only learned he’d been reported to the police from the journalist who wrote the story for The Age."

He hasn't been arrested.

Idiots

[Mistakill]

If you smiled at a safe, and it burst open... its not your fault the safe was faulty...

did he learn his lesson?

[Anonymous Coward]

Do not give what is holy to the dogs; nor cast your pearls before swine, lest they trample them under their feet, and turn and tear you in pieces.

This is BS

[Anonymous Coward]

Whoever posted this should be deleted from /. No where does it say dude was arrested. Learn to read or go back to reddit.

Re:This is BS

[Darinbob]

We've known for many years now that Timothy can't actually read.

Re:This is BS

[crossmr]

I'm not shocked at all that this came from Timothy, I can only guess he must have been on the phone with kdawson at the time he posted it.

From TFA

[AlanS2002]

"Update 1.9.14: Rogers confirmed to WIRED that the vulnerability he found was a SQL-injection vulnerability. He says the police have not contacted him and that he only learned he’d been reported to the police from the journalist who wrote the story for The Age."

HE DID NOT GET ARRESTED. Clearly who ever posted this story can't read.

The correct way to "inform the authority"

[Taco Cowboy]

I've been in this field for decades, and there have been far too many similar cases, like the one that TFA is reporting, happened to too many innocent people.

All of them committed one very sinful mistake - they report the flaws to the authority, the WRONG way.

If you ever discover any vulnerability of any official website / db / whatever, don't tell them, and don't tell the media either.

Most of the reporters are spineless creeps who suck up to the power-that-be.

Instead, you have two options -

1. Keep quite.

2. "leak" the info to some hacking circle and let others do the job for you.

If you ever take the 2nd option, you do need to know how to wipe off all your online traces (mag address, ip address, and so on) so nobody, not even the hackers, can trace you.

Re:The correct way to "inform the authority"

[maxwell demon]

1. Keep quite.

This sentence is quite incomplete.

Re:The correct way to "inform the authority"

[VortexCortex]

If leak the info, then when they go looking into the later breech and ding your name linked to the IP address of a prior breech you'll be every bit as much a suspect as the crackers doing harm.

The problem is that the computer fraud and abuse act is too harsh -- It needs an exemption / amnesty for folks who use responsible disclosure after stumbling on a flaw. The real problem is that folks in charge, like the NSA, FBI, etc. would rather you just didn't do any hacking at all. They'd like to have a monopoly on that, so the laws won't change.

If you're not browsing by proxy in this day and age, you're screwed.

Re:The correct way to "inform the authority"

[MrNaz]

So this is the way that Snowden should have done it? I guess now we know that those who say "well, some good came from what he did, but he should have gone about it the right way".

We now know that there is no "right way" to deal with government, other than kick them in the ass.

Re:The correct way to "inform the authority"

[Anonymous Coward]

If you're not browsing by proxy in this day and age, you're screwed.

But baby, proxies don't feel natural! I'll pull out before I post my comment, I promise.

Re:The correct way to "inform the authority"

[chromas]

[Premature enunciation]

Re:The correct way to "inform the authority"

[SuricouRaven]

What about sending the information anonymously?

Though this will likely result in a low-level communications clerk dismissing your message as some paranoid crank before it even gets to the technical staff.

Re:The correct way to "inform the authority"

[umghhh]

How true. Sometimes you have to break the law either because there is no other way or because the law is corrupted already. You have to watch your steps while you do it. Sometimes you only pay, sometimes you achieve something and pay anyway and sometimes you get lucky as you achieve your goal and get a reward. The later option is the rarest of course.

This may be OT but still. It seems to me we in the West are facing something bigger than usual incompetence and corruption which society can fix itself by standard means (voting opposition into office for instance). It seems to me that we raised over that level and are now at the level where government and big commercial organizations always know better than citizens, have means to be always right and if not then they can make you a criminal by interpreting the existing laws 'properly'. Coming from a country where I could see now fallen communist regime in action I find it really troubling that western countries use methods I know from there. I could maybe understand if they at least try to catch the web criminals and terrorists but sadly this hardly ever happen and all the losses of privacy and our rights and costs of the whole surveillance apparatus seems to be just supporting a move towards police state and not towards more security. It is a strange world.

Re:The correct way to "inform the authority"

[Zamphatta]

Sounds like the underlying issue is that some people (who should know better) still believe security through obscurity is a viable way of business.

This also reminds me of the case of Julian Harris. A man in Brisbane who was recently fined $44 for leaving his car window down while he was away from the car. The reason, is because it makes it easier for a thief to steal things from the car or steal the car itself. So clearly, Australian authorities understand that leaving oneself vulnerable (aka. "security negligence") should be punished even if you're not taken advantage of.

Re:The correct way to "inform the authority"

[amorsen]

No. You only have option 1. It is unlikely that you are able to hide your traces well enough that no one can find you. If you discovered an SQL vulnerability, you can be reasonably certain that the request was logged. If no one else exploits it around the same time, that log entry will likely never be found -- if they were diligent, they would not have an SQL injection problem in the first place.

If the vulnerability gets widely known, there will be people looking for the first instance it was exploited. There is a good chance that no one smart enough to find you will be assigned to the case, but you are taking a risk with zero gain.

So keep quiet and let the corporation or government ruin the privacy of everyone. It is the only responsible path.

Re:The correct way to "inform the authority"

[jd2112]

Sounds like the underlying issue is that some people (who should know better) still believe security through obscurity is a viable way of business.

This also reminds me of the case of Julian Harris. A man in Brisbane who was recently fined $44 for leaving his car window down while he was away from the car. The reason, is because it makes it easier for a thief to steal things from the car or steal the car itself. So clearly, Australian authorities understand that leaving oneself vulnerable (aka. "security negligence") should be punished even if you're not taken advantage of.

Keeping your car secure isn't always in your best interest.
I once had a $1000 convertible top cut in order to steal a (broken) $150 radio.
Since then I made it a practice to never lock the doors on a convertible. (and never leave anything of value inside)

Re:The correct way to "inform the authority"

[cffrost]

Actually things would have been a lot more pleasant for him had he moved to his place of choice first before doing the leaking.

The long arm of the US does mean there are very few suitable places so maybe Russia really is the best spot (but there was a fair bit of fuss getting there). Maybe he might have preferred Ecuador? Climate seems better there.

I think Snowden's only realistic choices have always been either Russia or China, as they're the only two countries that both a) have the ability to defend their airspace, and have the military strength to stay standing after taking down a US intruder, removing the possibility of a flown-in death squad (e.g., Osama bin Laden) and b) have the political will and economic fortitude to withstand pressure from the US, removing the possibility of a straight-up sell-out, (e.g., Kim Dotcom).

I don't think Assange's idea would have worked for Snowden; Ecuador would have likely caved to extreme pressure from the US, and the US has proven many times it has no qualms about toppling popular democracies, engaging in international terrorism, or intentionally causing widespread human suffering in pursuit of its economic and political interests, particularly in Central/South America, (I think because it's perceived as "belonging to" the US). (Fortunately, those days seem to be behind us, as the US populace wises-up to the atrocities it pays for (cf. the backing down of US war of aggression against Syria, opting for strange, new "diplomacy"-thing with Putin, as if by accident).

Assange's situation is far from ideal, what with his lack of autonomy and ability to go out for a walk, but his decision was made in a sense of immediacy and duress; he didn't have the opportunity for foresight Snowden had. I am glad that he successfully traveled between Hong Kong autonomous region and Russia, though — I cannot imagine the horrors he'd have been subject to at US hands had he failed. My country is a dangerous rogue state, not to be trifled with without extreme precautions for one's own well-being.

As for reporting security vulnerabilities, I think the market has indicated that the release of a zero-day exploit is preferred. As here, "responsible disclosure" results in harm to a good-faith actor, while zero-day exploits are quickly patched, and users quickly learn of the danger so that they may take whatever precautions each user deems appropriate until the danger has passed. Unlike many other good-faith actors, most releasers of zero-day exploits seem to know how to exceed the grasp of their targeted beneficiaries.

Re:The correct way to "inform the authority"

[amiga3D]

Maybe he just didn't want the thief to break his window. If you leave it rolled down they can take what they want without damaging your car.

Re:The correct way to "inform the authority"

[GoChickenFat]

I don't get it. None of your options speak of integrity. People can complain about the downfall of society all they want but if we promote ideas that contain little integrity then we add to the problem. You shouldn't expect others to respond with integrity if you don't use it yourself.

Re:The correct way to "inform the authority"

[Doomsought]

I've got a better response, skip the company and call the police. Use five words: Criminal Negligence with Confidential Data

Oringial article on The Age

[AlanS2002]

http://www.theage.com.au/technology/technology-news/schoolboy-hacks-public-transport-victoria-website-20140107-30fkg.html

For anyone who is interested

Re:Oringial article on The Age

[Anonymous Coward]

For anyone who is interested

No thanks, we like being uninformed here.

Re:Oringial article on The Age

[camperdave]

No thanks, we like being uninformed here.

What did you say that for? I was perfectly happy not knowing.

We need a Kickstarter campaign for Timothy

[JohnA]

We could raise money to teach him how to read. And then, maybe, we could send him to a school that will teach him how to read a full article, and apply basic cognitive skills before spewing all over slashdot.

Anyone with me?

Re:We need a Kickstarter campaign for Timothy

[Anonymous Coward]

No. Education is too expensive. Just replace him with a monkey.

Re:We need a Kickstarter campaign for Timothy

[Anonymous Coward]

We could raise money to teach him how to read. And then, maybe, we could send him to a school that will teach him how to read a full article, and apply basic cognitive skills before spewing all over slashdot.

Anyone with me?

Nope... 't's a lost cause, timothy's cognitive skills are in the atto- range

Slashdot reader points out error in headline ...

[Grismar]

... and gets arrested.

Brilliant, make them coconspirators

[Anonymous Coward]

2. "leak" the info to some hacking circle and let others do the job for you.

Brilliant, help the kids remove any hope they had for a slap on the wrist by making them a coconspirators in a criminal enterprise.

If you want to learn to be a security researcher then find some like minded folks and practice on each other's systems. Create Windows, Linux and *BSD honeypots that are misconfigured, not currently patched, etc. Watch your friends try to get in. It will be an educational experience from both the offensive and the defensive perspectives.

Re:Brilliant, make them coconspirators

[cffrost]

2. "leak" the info to some hacking circle and let others do the job for you.

Brilliant, help the kids remove any hope they had for a slap on the wrist by making them a coconspirators in a criminal enterprise.

I agree that involving potential minors presents a moral conundrum, but I think this is mostly a problem with how harshly minors are treated nowadays. Perhaps it's best to include an advisory with any vulnerability details that outline the potential penalties and risks involved with using the information provided. I believe it is the case that "the kids" have shown themselves to be very adept at this work, but I'm dismayed by what happens to them when they're caught (i.e., as though having done something terribly wrong, instead of having helpfully contributed to the security process).

In the meantime, maybe some kind of anonymous WikiLeaks-style clearinghouse for zero-day exploits would be ideal, until the harsh penalties are removed, or the market chooses something other than "zero-day exploit" as the most effective form of security vulnerability disclosure (what with "responsible disclosure" resulting in inaction and/or harsh penalties applied to actors in good faith). (I'm unaware of the current release platform, but I suppose it's an unorganized mixture of web sites and P2P platforms with varying and unknown degrees of risk — a centralized point would make it easier for users and vendors to check if systems important to them have been compromised. News media could also extend its reach.)

If you want to learn to be a security researcher then find some like minded folks and practice on each other's systems. Create Windows, Linux and *BSD honeypots that are misconfigured, not currently patched, etc. Watch your friends try to get in. It will be an educational experience from both the offensive and the defensive perspectives.

That sounds like a fun learning activity for people who have the time and interest, but sometimes security vulnerabilities are discovered by those who may be regarded as lay-people. Increasingly so, I would guess, as more people are exposed to more technology. I wish they were always aware of the harsh penalties that are often involved in helping to repair security vulnerabilities, — until ideally — harsh penalties are removed as a likely possibility.

Re:Metlink IRP

[waynemcdougall]

He has not yet been arrested and Metlink were simply following their IRP for a security breach which doesn't discriminate based on intent.

No. This is simply wrong. If "Metlink were simply following their IRP" then they would have started investigating and taking action last month when their gaping security violation was first reported.

Instead they did nothing until exposure of their incompetence was threatened by mainstream media.

Alias in hiding

[Tablizer]

To hide from the law, he changed his name to Drop Table All.

Re:Alias in hiding

[laejoh]

It's pronounced Drop Table All, but it's written as:

'); DROP TABLE All;--

Re:Never put your name to it

[YttriumOxide]

Wow, I hope you never have a complaint to report to the Complaint Department! Word to the wise: the Complaint Department doesn't exist. You will be arrested.

I'm pretty sure most western countries have a complaints department for law enforcement.

Many years ago in my teenage years in New Zealand, I was chatting to random people on IRC (a pretty new protocol at the time) and there was a guy bragging about bombing a plane - specifically, putting explosives on the landing gear of the plane.

Being young and paranoid, but not yet particularly clever in the ways of the computer security world, I 'anonymously' emailed the police with information about it. My attempts at anonymity were however not good enough and a few days later the police came and took all my computer equipment. The search warrant read "Attempted murder and breach of the telecommunications act" (I still have it, along with the write up I got in the newspaper as a reminder of absurdity). Of course, I was never arrested as I had done nothing illegal.

While that all annoyed me greatly, it didn't annoy me nearly as much as them keeping my stuff for over 3 months before I got it back. When I did finally get it back, the power switch on my main system was physically broken and the HDD was formatted.

I made a complaint to the Police Complaints Authority (a government body) and they ended up writing a letter of apology. So, while complaining certainly didn't do anything useful for me, the point is that there WAS a body for me to complain to.

I'm sure it's a little more complex in countries like the US and Australia since there may be differences by state as well as the federal level to think about, but a quick Google search seems to confirm that complaints departments and/or processes do exist there also.

Slashdot reader points out error in headline ... (

[rickyslashdot]

mod UP - and load rifles for /. 'editor' FIRING line -grin-

Not Arrested, Not Questioned, Not Contacted.

[MegaManSec]

Joshua Rogers here. The kid that this article is about.

I want to clear something up..

I have _not_ been arrested(yet).
I have _not_ been questioned(yet).
I have _not_ been officially told that I've been reported to the police(yet).

I'm completly in the blank, as much as the rest of you.
What I'm expecting to happen:
They show up at my doorstep asking questions. .. .... ........
That's it.

They might ask me to sign something that says I have deleted all the data that I saw.

If you have any questions, I can be contacted @megamansec..

Re:Not Arrested, Not Questioned, Not Contacted.

[MegaManSec]

I saw an MySQL error on the page I was viewing. That's it, lol.

Re:Not Arrested, Not Questioned, Not Contacted.

[bill_mcgonigle]

I saw an MySQL error on the page I was viewing. That's it, lol.

If the database driver errors are making it out to the public then it's the systems' developers who should be questioned.

It's a shame you were trying to be helpful and these dorks don't know how to be gracious.

Re:Not Arrested, Not Questioned, Not Contacted.

[MegaManSec]

I just saw a MySQL error on the page, and knew what had happened. My guess is that they don't have staff that can review apache logs to see what I actually viewed.. So, they want to know I don't have 600,000 records on my computer, basically.

way to cover your arses

[ihtoit]

1. pass contract to build "secured" site to lowest bidder
2. blame some spotty kid for vulnerabilities that he himself reported to you, get him arrested and settle out of court for some seven digit sum which he'll be paying off the rest of his life
3. use some of that money to fix that single problem ...

n. PROFIT! Reputation intact but when this hits the wires don't expect to hear of any more vulnerabilities until the next audit.

The law does care

[almclean]

IANAL, but I my understanding is that, at least in English law, the law actually does protect the Good Samaritan who engages in minor property damage to save a baby. The prosecution would almost certainly not prosocute, but if they did, the defendent would be able to exercise the Defence of Necessity. http://en.wikipedia.org/wiki/Necessity_in_English_law

Re:Responsible disclosure, anyone?

[silas_moeckel]

Seems very responsible he contact one third party with a good track record. Or do you expect people to wait months/years? SQL injection is pretty low end who is the PCI auditor who missed this?

Lucky that it wasn't Intel

[Strange Attractor]

When Randal Schwartz probed security at Intel, they made him a convicted felon. See http://www.lightlink.com/spacenka/fors/

Morals:

1. Finding security holes is dangerous

2. You should buy AMD CPUs