Slashdot Mirror
Company Gets 45,000 Bad Facebook Reviews After Teenaged Hacker's Unjust Arrest (bleepingcomputer.com)
An anonymous reader quotes BleepingComputer:
Over 45,000 users have left one-star reviews on a company's Facebook page after the business reported a security researcher to police and had him arrested in the middle of the night instead of fixing a reported bug. The arrest took place this week in Hungary after an 18-year-old found a flaw in the online ticket-selling system of Budapesti Közlekedési Központ, Budapest's public transportation authority. The young man discovered that he could access BKK's website, press F12 to enter the browser's developer tools mode, and modify the page's source code to alter a ticket's price. Because there was no client or server-side validation put in place, the BKK system accepted the operation and issued a ticket at a smaller price...
The teenager -- who didn't want his name revealed -- reported the issue to BKK, but the organization chose to contact the police and file a complaint, accusing the young man of hacking their systems... BKK management made a fatal mistake when they brazenly boasted in a press conference about catching the hacker and declaring their systems "secure." Since then, other security flaws in BKK's system have surfaced on Twitter. As details of the case emerged, public outrage grew against BKK and its manager Kálmán Dabóczi, especially after it was revealed that BKK was paying around $1 million per year for maintenance of its IT systems, hacked in such a ludicrously simple manner.
The teenager -- who didn't want his name revealed -- reported the issue to BKK, but the organization chose to contact the police and file a complaint, accusing the young man of hacking their systems... BKK management made a fatal mistake when they brazenly boasted in a press conference about catching the hacker and declaring their systems "secure." Since then, other security flaws in BKK's system have surfaced on Twitter. As details of the case emerged, public outrage grew against BKK and its manager Kálmán Dabóczi, especially after it was revealed that BKK was paying around $1 million per year for maintenance of its IT systems, hacked in such a ludicrously simple manner.
Never try to help souless corporation.
it would have to told you the correct grammar is:
"What would be the result of changing the price to a negative number"
and then it would have positively fucked your mother
"would of" How do people still make this mistake? Do you just never read?
New topic at business schools: Shut the fuck up and talk to IT before opening your mouth. This course should be mandatory; no graduate should be without it, much less reach management levels.
now that's a long stride for that little company lol..
When being a grammar Nazi, first learn the purpose of shift keys and periods.
That press conference was the equivalent of doing a presentation in front of your class on dressing modestly with your fly open.
The manager(s) who authorized that embarrassment should be fired first thing tomorrow morning because they're clearly clueless bureaucrats that don't even understand their own department's responsibilities.
While I agree with this sentiment, proper journalism presents the facts and lets the reader decide if it's just or not.
I was informative to the nice man
This company has no clue how eCommerce works. They actually are double handy capped in that they don't even know what they don't know so they likely had a false sense of thinking they actually did understand things. If you use the website as intended you can't change the price. I have no doubt that Kálmán Dabóczi believed this kid was hacking their system and I also think it is likely that everyone he asked also though the same thing.
Kálmán Dabóczi, BKK, the police and the judge who issued the warrant all owe this kid a big apology. However, not everyone can understand everything and it is reasonable to expect that sometimes you will get unlucky and get a company and a few members of the police who have almost zero understanding of a subject and make a stupid mistake. The police didn't kick in his door, shoot his dogs or throw stun grenades in a crib. Hopefully they were professional about the entire thing. Kálmán Dabóczi has likely learned a very hard lesson so let him apologize and get to work. He now has a pile of free penetration results to deal with and possible the job of selecting a new supplier for the website.
I guess security researchers and hackers now learned a lesson.
Find a bug? Exploit the f**k out of it. Don't bother reporting it.
Surely no e-commerce site should rely on client-side validation? That seems like asking for trouble.
The real "Libtards" are the Libertarians!
I'd be more impressed if the facebook hive mind did something about this.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I know already this will be a very unpopular opinion on Slashdot, and I know this analogy has been made before, but just because someone leaves their front door unlocked, it doesn't mean you get to go in, root around the house, and leave a note saying the owner really needs to lock their door.
A better analogy here might actually be walking into a store, swapping price stickers on two products so you can buy one at a lower price than it was actually selling for. Now that most stores use barcode scanners and the register displays the product name, that isn't so easily done anymore, but it used to be possible and it was illegal. I don't see how what this kid did was any different. He may have had good intentions, and he did point out the flaw, but that doesn't give him the right to do this in the first place.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
...for your own reviewing and commenting enjoyment: https://www.facebook.com/bkkbu...
I am a geek attorney, but not your geek attorney unless you've already retained me. This is not legal advice.
He should of known that already.
"would of"
How do people still make this mistake? Do you just never read?
Yep, that's what happens, and WA LA! Stupid mistakes, eck cetra.
No, a better analogy is: the store forgot a price sticker printer in the shelf, so any client could just get it and print new prices freely. This kid found the printer and took it to the cashier, and rather than getting thanked, he got accused of stealing the printer.
Circumcision is child abuse.
No, the equivalent here is going into a store, noticing that you can easily get things for free by saying âoethatâ(TM)s free, rightâ to one of the cashiers, and then telling the manager âoehey, that seems weird, you might want to look at thatâ.
That seems like exactly the kind of responsible behaviour a customer should have.
How would he know that the flaw existed at all, if he hadn't tried it and found that it worked? It's not like he cashed in on it; he merely and duly reported it. No, the company's actions were maximally counterproductive.
Stores know about swapping price stickers -- that's why they have those stickers that come off in pieces. But if a store didn't know about it, and still used price stickers, and didn't have the kind that come off in pieces, it might be helpful to mention the vulnerability to them, without exploiting it.
That's what this kid did. Having him arrested was outrageous.
It's a train page. If people want to get from A to B and the train is the best option they're still going to buy a ticket. Who the hell cares about likes and dislikes on some stupid FB page. Talk about a useless endeavor.
> Now that most stores use barcode scanners and the register displays the product name, that isn't so easily done anymore
This exactly: with server-side checking of product pricing, it would not be so easily done either.
If this LUDDITE company used modern appy app apps instead of LUDDITE software, then LUDDITE hackers wouldn't be able to hack the app! Only apps can app apps!
Apps!
The company published the web page source code when they put the web page.
If they didn't want to do this, they could have used a different method of making a web page.
The kid read it and could not believe that they had made such an elementary error.
Certainly, not something a professional should do.
So he tested it just to make sure, then notified the clueless what they had done.
The test involved buying a ticket at a reduced price and then not using it.
Not sure how the company was harmed, except that those running it were exposed as not doing their job.
So , instead of thanking him and fixing the bug, they filed a complaint which got him arrested.
The police followed up on this even thought the intent was clearly not to cause a problem.
Seems like there is room for becoming less clueless for both the company and the cops.
Either one could review the situation and change the outcome.
I think I found someone who writes worse than creimer. Seriously dude, could you make a bigger mess ??? I couldn't make heads or tails of that subject.
I will be informative again
unlike slashdot poster chewbacon, slashdot poster chewbacon's mom has gotten laid at least once
it's true, I have perfected version 2.0 of my hosts file security tool. It is a local DNS recursor that CNAMEs everything to imabiggaybaby.com.
I then use v1 of my hosts tool to resolve slashdot properly so I can post. This is excellent security and enables me to visit imabiggaybaby.com with almost every single get request. Truly the wave of the future.
APK - AKA a big gay baby
We don't need a bad analogy or two to understand this. The kid saw an exploitable flaw, let the company know in a responsible manner, and was punished for it. Other companies would thank him, and perhaps even pay him a bug bounty for his trouble, because he just did them a huge favor. This is not anything unprecedented in the modern world. Only the backwards and punitive reaction is.
This reaction represents the mindset of companies from decades ago, where they thought that security through obscurity was a valid methodology. All it does it discourage white hats from disclosing bugs. The black hats will gleefully exploit the flaws they discover.
Irony: Agile development has too much intertia to be abandoned now.
I didn't vote for anyone because all the candidates were insane or trash or both.
That's what we're supposed to conclude. Right?
America's education system is spiraling down the toilet bowl, look no further than who they elected to be their president.
The IT company was embarrassed; some kid pull their pants down, and showed to the world that $1 million contractor is incompetent and also has very small dicks.
I didn't vote for anyone because all the candidates were insane or trash or both.
That makes you the biggest pussy of all. If you had any balls you'd have decided which one you thought would be the most fun to watch fuck things up, and voted for them.
But you didn't vote, because you are a worthless useless pussy who should be converted to feed stock for your betters.
Ah the old sticker swap. The good old days. Used to buy model airplanes this way.
"what would of a"?????
How the fuck does that even make any sense to you?
Is there even a legitimate way to use "should of" or "would of" in a sentence?
"should of"
Subtle. I like it.
"So long and thanks for all the fish."
That way, no accusation of getting financial gain from the "hack" would have been possible.
As to the site, these people are the worst of the worst of incompetents. Even an ElCheapo pen-test would have found that problem. Likely the hugely inflated price for system maintenance goes to some equally incompetent and thoroughly corrupt friend or relative of the CEO and that would also explain the brain-dead reaction.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
At least twice, because I know I'm not his father.
I couldn't resist.
"So long and thanks for all the fish."
I found a similar flaw in a supermarket's self-service tills. Didn't report it for this very reason. I don't purposefully look for bugs/exploits, but if I did spot any more in future then I wouldn't report those either. My heart tells me to report them, but my head tells me no.
Can confirm that APK predates the Android packages.
"So long and thanks for all the fish."
It's unfortunate that you derive your own self-worth from the displeasure of others. Some of us aspire to bring everyone up a level or two in life. You and your ilk aspire to drag everyone else down into your cesspool, instead of finding a way to crawl out. That's your problem and not mine.
Don't get too comfortable on your high horse, though. You'll be pitching a fit soon enough when you have no health insurance, your ISP is charging $50/month extra to access 4chan, and your mobbed up Dear Leader is dragged out of office kicking and screaming while his entire extended family's assets are seized by the state of New York.
Have fun watching - I sure will.
That if he had raised the price, they just would have said "Oh, so what? We get more money! That's good!"
I wonder if they handle NaN or Inf.
The profit for the day was NaN. The profit for the year was NaN.
But never got asked out on a second date.
I'm not one for advocating laws but looking at this and seeing the obvious effect it's going to have on white hat security vigilantes (saying nothing or being turned grey/black hat by corporate, egotistical, twats covering their own arse) the only solution seems to be to create laws to protect the white hats.
Laws like those which protect freedom of press and speech.
If you haven't benefited from your discovery and research then you can't be prosecuted.
Instead of reporting to the corporation report to a government watch dog who covers for you.
Better still fine the corporations to fund the watch dog and pay out a bug bounty.
I don't report bugs to the company. I may report it to their ISP, but usually I don't bother in the sense I don't go looking for bugs.
I don't know, but isn't there a bug reporting system that will allow anonymous communication? If not, maybe that's something CERT could look into sponsoring.
Sort of like the old abuse.net system, where you could register "Hey, this is where we take spam reports seriously." That way the clued in sites will let the whitehats know their reports are taken seriously, and the white hats know they at least have a simi-clued in contact and won't let slip the dogs of war because there's something wrong.
Again, all I'm interested in are my own sites, and I'll hardly dox myself.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
at least in the past, was regenerating CRC on TCP packets instead of dropping packets with bad CRC. People were reportedly unable to transfer more than about 120MB without corruption. You shouldn't assume anything sent on the internet unencrypted has perfect integrity.
It's all in the technique. Peel slowly at a sharp enough angle and it does not matter that the sticker is perforated. Did it many times when I was a kid.
But nobody uses price stickers anymore.
See subject: Yes, obviously https://science.slashdot.org/comments.pl?sid=6881923&cid=48958885/ & projecting your issues on me? Please: IS YOUR FAVORITE COLOR "TRANSPARENT"?
* Must be since I see RIGHT thru you...
APK
P.S.=> Omnichad, grow up! I've probably had more women between 1984 & 2000 than you will in your ENTIRE LIFE... apk
10,000,000 tickets at $0 each please.
Better yet, 10,000,000 tickets each for $-1.
With my vote.
I haven't been on Slashdot much lately, but is that the new euphemism for hacking?
The simple rule is don't poke around someone else's defenses and then get mad when they treat you as a threat. How would you feel if someone told you "Hey, I've been trying to break into your house lately and just realized your bedroom window is unlocked!" ?
I swear to God...I swear to God! That is NOT how you treat your human!
Were you born with the `tism too or did it develop along the way?
Since they are so insistent on their system being secure when it clearly isn't, wouldn't it be funny if someone sold themselves a ticket with a negative value attached, thereby crediting themselves a large sum of money?
Like 45000 bad reviews will mean anything for a STATE company. They don't care.
the subway token system can get EASILY hacked -i.e. you pay for 5 rides and they never "expire". This is all documented in a public website by a programmer dude who discovered it. Nobody did anything it has been like that for years, apparently. I suspect people could be even selling fake prepaid tickets etc. It's just Bulgaria in general country is so corrupt on all levels, that a scam of such magnitude is not threaded as something serious lmao Millions of EU funded money get laundered and stolen into corrupt politicians's own pockets. In Bulgaria the average salary is 400 euro, but you see Brabus and AMG Mercedes S 600 and Bentleys and Panameras everywhere all day...
People like you are why anonymous speech is a good thing.
"that's what happens, and WA LA! Stupid mistakes, eck cetra." .. must be a Quebec accent. Someone who knew French would use "Voila".
See subject: You were hatched, lol.... & why do I say that? You're an UNIDENTIFIABLE trolling CLUCK, RoTfLmAo...
APK
P.S.=> Hahahahahahahaha... apk
It's only natural, when finding a bug, to test it and confirm that it is a bug. If a front door is unlocked, you might reasonably push on it, poke your head in and shout "is anyone home?". And then leave a note on the doormat.
I'd say he did the minimal possible to confirm there was a problem.
as if this is what the EU does.. this was just the case of one most likely corrupt head of a local transportation branch. This pro-American outlet looks for any chance to make something seem like an incompetent EU police state's evil doings.
The online ticket selling system in question was developed by the hungarian branch of Germany-based global giant T-Systems group. Although "developed" seems a bit of an exaggeration, since it looks like about half of the system was merely "painted on the wall" in very rough draft code and at an early stage of perparadness, but the whole infrastructure was duressed into live operation prematurely.
The reason for such a hurry was the ongoing FINA 2017 would championship for aquatic sports, which Budapest and Hungary adopted only 2 years ago when the originally chosen host country (Mexico I think?) suddenly balked out. Pool swimming, water polo, sprint kayak are really big in Hungary, so the country was eager to take over, despite the little time left.
Ever since, a huge amount of money was wasted on hurried preparations (including widespread and extremely costly corruption between politicians-bureucrats and construction company owners) and the event's budget skyrocketed to 4x times of the planned, tehreby taking away a lot of money earmarked for public education and the country's single-payer health system.
While Budapest has a dense and well-developed surface mass transport system called BKK (formely BKV), the international airport at Ferihegy (BUD) is not yet served by an underground railway or a light rail link, there is only a stop-at-every-bush articulated bus line for it, which doesn't even reach the city centre.
Considering the FINA 2017 event, another direct-to-city-center bus line was hastily introduced and politics wanted an online tickets / passes selling system for that, so the airport kiosks wouldn't be overwhelmed and look bad on TV news. (The leadership un-realistically expected hundreds of thousands, if not millions of foreign sports fans to visit Budapest for just the event.) Thus the "bright" idea of pressing into service a quarter-to-half ready online merchant system was born...
BTW, the hacker who discovered the price fixing trick lived 300km (190mi) from Budapest and hasn't been to the capital for months, thus his pennys purchase of a name-assinged pass wasn't made maliciously. In fact it was the T-Systems branch, not BKK, which received his bug report and counter-reported him to police, climing their corporate legal policies require such step. Hungarian netizens have been smear-comment flooding the global T-group Facebook page ever since.
Yes: He thought "should of" was correct grammar, but he was just a fucking idiot.
Celloooo, I know right? And viola! Just like that he suddenly turned violint.
Since I'm a local, let me also add this for the human resources aspect of the story:
Another reason for the hurried introduction of the inscure, unfinished BKK online ticket sales system was that the Mr. Kalman Daboczy, whom the referenced article mentioned by name, is not the original leader of BKK.
Before him there was David Vitezy, an admittedly weird, but very bright, internationally educated jewish boy, who got to form and lead the BKK at a young age, solely due to his family's high political connections yet turned out to be highly motivated. In a few years Vitezy introduced a computerized schedule-control system called FUTAR for over 1500 buses which revolutionized on-timeliness in circulation, a quantum leap from the paper-based BKV era and welcomed by all pax.
He also introduced private sub-contracting for bus line operations with run-time based financing, which brought in hundreds of brand new low floor, low pollution Merc and Volvo vehicles to Budapest, where previously only Cold War era (!) left-over smoking wreckages circulated. He managed to extend the lenght of the city's most important tram line and furnish it with modern rolling stock by successfully claiming EU funds for development, which was considered impossible to get by all parties. He created a public bicycle-sharing system called BUBI from zero and integrated it with BKK. Genius, I'd say.
Eventually Vitezy was sacked from BKK as he tried to reform traffic light patterns and lane use rights to prioritize bus and tram circulation versus private cars, which limousine-riding politicians vetoed. Mr. Daboczy, who replaced him is a "mameluk" i.e. a person whose only skill is loyalty to political superiors in executing orders without questions, including hurtful or stupid ones, and he is without creative talent. Ever since BKK has been stagnating and the city's population eventually questioned why no public transit development happens since Vitezy left? Thus the online ticket selling system was kind of an attempt to show off the new leadership's competence but it backfired spectacularly. The opposition is now demanding Daboczy's removal from BKK due to the scandal.
BTW, when David Vitezy was sacked from BKK, the Port Authority of New York reportedly tried to woo him over to advise on future plans for public transport development in the skyscraper city. He declined to emigrate, probably the mistake of his life, as ever since he has been given mere "desk by the window" roles in Hungary. I'd say if he'd left for USA, maybe in 15 years he could have been properly groomed in America and come back as a potential future PM of Hungary. That, provided the russians don't conquer our country again in the meanwhile...
Enjoy it while it lasts.
Taking into account how much fucked up is the political system, the guy is lucky to not have "disappeared"
How fucking corrupt (or clueless) must one have been to have cast a vote for Hillary Clinton?
We had a similar situation in Poland recently. A party of ass clowns was voted in, in place of one of very competent *thieves* that kept robbing the country blind with impunity over previous 8 years. And while the ass clowns aren't a good government, they certainly cause far less harm than the thieves did.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
very bad analogy. There are literally millions of bad faith actors on the net, both human and automated, trying to break in to every public web site. To assume everybody should/will "behave" when accessing a website is delusional.
It is a statistical certainty that that people out of the legal jurisdiction of a public web site will attempt to break into it and anybody who creates a high profile web site like that in the story is being criminally negligent if they assume otherwise. Particularly a web site with serious money involved.
A better analogy would be if the driver of an armored car left the back door open when they went of to lunch and a passerby noticed it and reported it to the armored car company. Quite rightly they'd fire the driver for negligence. And probably sue them for any lost property.
Coming from a place quite similar to Hungary (ex Soviet bloc, now EU country with young and unstable democracy), I have a pretty good idea how such public IT systems are made. Whenever there are EU modernization funds to steal^Wgrab, you see, a public tender is written with criteria formulated in such a way so that only one, specific company would meet them. This company then wins with a mind-fucking-blowing price (two orders of magnitude more than what you'd expect similar system to cost in a private sector is not unheard of) and spends two years delivering a steaming pile of utter fucking shit that's not only buggy as hell, but has the functionality and feel of something from 15 years ago. The reason it's shit is because:
1) Nobody really cares about the actual system or the problem it's supposed to solve; it's the sweet, sweet Euros that can be stolen^Wused that matter,
2) The company pays peanuts so only inexperienced and/or really bad devs work there ("Every specialist is replaceable with a finite number of interns" is the actual motto of the CEO of one such company in Poland).
Go full blackhat or get fucked. I bet their server where customer information resides has gaping security loopholes too. Instead of punishing the company the try to kill the messenger.
sudo rm -r -f --no-preserve-root /
You just did.
If you wanted more people to reply, you should of course have logged in before leaving a comment.
Studies show that grammar nazis are dicks.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
It's colloquial. Some people view their forum responses as literal "speech", rather than a formal written argument.
Get over it.
That makes so much more sense. I though he misspellt our.
Nobody here says "WA LA". It's spelled "voilà" for a reason.
#DeleteFacebook
I know this is fake because you didn't bold anything, include links to his software or ramble semi-coherently.
A negative number would of done failed Engrish.
You say "ludicrously simple" but in today's 8-week-bootcamp to "Javascript ninja rockstar" culture, I've all but given up on trying to explain to front-end developers why client-side validation alone isn't sufficiently secure. I explain it to them once, shrug off their uncomprehending stares and wait for them to implement what I just told them not to, demonstrate the "hack" in front of them, wait for them to protest that "well, anybody who is competent enough to think of THAT is surely unstoppable anyway!" and then hunker down for a month of explaining again, and again, and again to management that yes, deadlines are super-duper important and yes, we have client deliverables to meet but this is a real security problem and yes, it really needs to be fixed. That the cumulative time we spend arguing about something that never should have even come up in the first place is an order of magnitude greater than the time that would have been spent just fixing the damned thing in the first place never seems to make much impression on anybody, either.
Proud neuron in the Slashdot hivemind since 2002.
It's colloquial. Some people view their forum responses as literal "speech", rather than a formal written argument.
Get over it.
Then they shouldn't be writing and also stop assuming that everyone else knows it. Speaking language is often time ambiguous. If you want to write, do it properly.
If the young man actually was "issued a ticket," that means he bought it. That also means that he took advantage of a software vulnerability to obtain something at a lower price than it was intended for him to pay.
This is theft, and theft is a crime.
He should not have actually bought a ticket (going on the summary's language that says he was "issued a ticket").
how can a DNS amplification affect me?
Maybe you should look up what a DNS amplification attack does. Hint - it doesn't matter if you use HOSTS for all of your lookups.
A DNS amplification attack does not stop you from looking up web sites. It's a DDoS that overloads your router. HOSTS will not help you with that whatsoever. Not DOS, DoS.
P.S. It's not a "big blunder" to not remember which order to put HOSTS in. The Windows default hosts file has examples in it. You never have to learn or remember the syntax, because it's right there in the file.
See subject: You put hosts entries out in reverse order & how can you overload my router? You don't know my IP address!|
* Clue: YOU CAN'T!
As I said, my IP is ALWAYS rotating to something different (especially on site forums - good luck guessing which of 100's I use my true IP address is, lol)
LASTLY:
Since EXAMPLES ARE THERE, your BLUNDER SHOWS YOU DIDN'T CHECK 1st & STUPIDLY PUT THEM OUT IN THE WRONG ORDER shooting your mouth off writing checks your ass can't cash, lol!
APK
P.S.=> Your other blunder on DOS was inexcuable also - I've others where you RAN from proving me wrong on hosts OR CONCEDED SPEED & SECURITY GAINS via hosts (which you said you did not deny my methods there work - shall I quote that too? Ask & "ye shall receive")... apk
From my CS days in college, unit test for the following conditions. Value = N, value = N -1, value = N + 1, value = -N, wash, rinse, repeat until time is up or bugs are fixed.
Fat, drunk, and stupid is no way to go through life, son.
See subject: It's WHY I change IP address every time I post in ANY forums + every few minutes anyhow for "cloaking" defense.
I.E./E.G. - No target possible for ANY attack. Nothing to 'zero-in' on & 'hit'... moving target here, constantly. Impossible to hit. If not 'targetted' you STILL can't hit me (constantly) if/when I change IP - period. I am "not @ that location" anymore!
* LOL, I call it something from an old Williams arcade game called "DEFENDER" - it's "inviso-power" online for the most part...
(Ahem/Lastly: Beg to differ - You care & your "objections" PROJECT IT! LOL, YOU PUT HOSTS ENTRIES OUT IN REVERSE ORDER, lol... that much is certain! Hahaha, not even a "nice try" w/ the 'pseudocode out' - it'd "pseudo-work" = why (wouldn't work in other words)).
APK
P.S.=> There is also, of course, what I noted earlier too - that YOU CONCEDED MY METHODS USING HOSTS WORK for added speed, security, reliability & even more added anonymity... apk
They'd like their client-side shopping cart software back.
How does even the most novice developer not know that you can't trust anything from the client?
Freedom to fear. Freedom from thought. Freedom to kill.
I guess the War on Terror really is about freedom!
Oh, the irony.
"So long and thanks for all the fish."
"The King Has No Clothes on!"
I think in the original version the person that made that proclamation was promptly beheaded.
If not, it should at least be mentioned.
First rule of holes; When in one, stop digging.
See subject: VERY easy to do (especially depending on connection type). DSL/dialup make this extremely easy (reset router either via direct to router/dsl/modem OR use proxies on "semi-static" longterm IP lease...).
"No Scenario? I see EVERY SCENARIO! That's what it DOES Karl - it puts me 50 MOVES AHEAD OF YOU!" lol.... see film below on that note!
("You know how they say you only access 10% of your brain? I LET YOU ACCESS ALL OF IT!" & "YOU WERE BLIND, and NOW? YOU SEE...:")
APK
P.S.=> Yes, there IS the benefit of UNLIMITED AC POSTING also, a nice ancillary benefit (baffling DOLTS who TRY limit me) as well doing this protective method (Bradley Cooper in the FILM "Limitless" https://www.youtube.com/watch?v=4TLppsfzQH8/ = me, lol) - "HOW MANY OF US GET TO KNOW OUR PERFECT SELVES?"... apk
As details of the case emerged, public outrage grew against BKK and its manager Kálmán Dabóczi, especially after it was revealed that BKK was paying around $1 million per year for maintenance of its IT systems, hacked in such a ludicrously simple manner.
Yep, things like this are why it's hard to take anything anybody in the industry says seriously. Particularly places like this full of "experts".
See subject & that's truly that: No scenario? I see every scenario, I see 50 scenarios - that's what it does Karl. It puts me 50 MOVES AHEAD OF YOU..."
* Yes, I am, TRULY... "LIMITLESS" https://www.youtube.com/watch?v=4TLppsfzQH8/
APK
P.S.=> You also DO concede my methods work for more speed, security, reliability & anonymity online (had to post it, you won't lie down & die, lol, so I have to let you KILL YOURSELF MORE) https://tech.slashdot.org/comments.pl?sid=4072127&cid=44544679/ & after all - YOU SAID IT right there in black & white (hosts do DO more for less than any other "so-called 'security solution', natively w/ less resource use, in faster kernelmode, & speed you up (most slow you down) - less IS more = GOOD engineering working w/ what you already have))... apk
I think a/c was referring to WTF but IDK.
See subject: It's not. It can't determine WHERE I REALLY AM & sure hosts help - no tracking in adscripts, server-side or router logs & page snippets too!
I block ads + tracking scripts too via hosts (many times in both firewalls in software OR routers too).
I.E./E.G. - BOTH from /. & ANY OTHER SERVERS I do not need (/. is LOADED w/ them) via hosts too!
* Between that & IP rotations, I am truly a "moving impossible to 'hit' target", no questions asked (nice side effect IS unlimited AC posting here too)... again "LIMITLESS"!
(,,, & YOU DID ADMIT MY METHODS WORK QUOTED IN MY LAST POST'S LAST LINK...)
APK
P.S.=> If/when you can't even TRACK ME (rather 'zero-in' on me) via scripting or even server-side/router logs, I am for all intestwintents & purposes the UNSTOPPABLE + INVULNERABLE object online... apk
See subject: You admit due to IP change DNS AMP attacks can't find me & hosts also block tracker scripts to determine IP also (again, blocking the ability to FIND me).
* Between the 2 of them in combination? THERE IS NO WAY TO "ZERO-IN" ON ME/WHERE I AM REALLY COMING FROM - period!
APK
P.S.=> I explained that QUITE WELL & you had to ADMIT your DNS AMP attacks = USELESS against me right here https://tech.slashdot.org/comments.pl?sid=10899017&cid=54867549/ (so is attempts by 'certain people' to LIMIT my posting - ineffectual vs. LIMITLESS Eddie Morra ME, lol!)... apk
Powerful people don't like to be embarrassed nor have the world discover their incompetence. If you expose a powerful moron his position is at risk, and he'll take it as an attack. It's irrelevant for him that you were only trying to help.
“Common sense is not so common.” — Voltaire
If the story were told during the 14th century, I doubt they would even have to mention what happens if a commoner insulted a king's pride. These days you would have to be explicit about that as we're historically and culturally a very ignorant people.
See subject: U can't. So not only do I change my IP constantly vs. DNS Amp but I also cut off tracking via hosts (+ firewalls (software & router)).
* The technique of moving IP addresses constantly is also COMPLIMENTED BY HOSTS stalling tracking too!
APK
P.S.=> As you've already conceded? My methods work... apk
Idly browsing one night, I discovered that all access controlled had been switched off our corporate network. Yes I could even open the CEO's home folder. It didn't take much brain power to realise that if I looked any further there would be time stamps on files that matched my shift time, so I didn't go any further (despite being curious).
I waited until the morning and phoned a relatively junior IT team member and explained the security lapse to him (on the basis of anonymity), who then escalated the problem.
The result: The problem got fixed. He got a pat on the back for discovering the oversight, and we became good friends.
Not everyone here speaks native english. How about trying to give people a break when they make relatively minor and simple mistakes. As long as the various issues with grammar and spelling doesn't get in the way of the meaning why not let it go and instead respond to the intent of the comment. I mean we're internet junkies not award winning novelists. A little bad grammar won't kill us.
Why don't you login and post Creimer? You scared shitless fuck.
See subject: YOU long ago admit my methods work (my earler posts show where in links) & YES, I know it's you posting by UNIDENTIFIABLE ac now too, lol "defending yoruself"!
ALL I HAD TO PROVE WAS YOUR DNS AMP ATTACK CAN'T GET ME & THAT HOSTS HELP vs. TRACKING TOO along w/ IP changes I do THAT UTTERLY NULLIFY YOUR FEEBLE "POINT"...
Man face facts - you failed https://tech.slashdot.org/comments.pl?sid=10899017&cid=54868415/
APK
P.S.=> Between BOTH changing IP addresses constantly here & stopping tracking to DETECT MY IP ADDRESS you can't attack me (or limit me posting)... apk
Is there even a legitimate way to use "should of" or "would of" in a sentence?
Any in which "of" is followed by "course".
a) "He should of course he should!", she exclaimed breathlessly.
b) "If we did X, we would of course get..."
c) "It could of course be a fly."
Conservatism: (n.) love of the existing evils. Liberalism: (n.) desire to substitute new evils for the existing ones.
Because there was no client or server-side validation put in place
What on earth would client side validation do? In fact it does have client side checking it puts the price in the client. The problem is that the hacker changed the client. No amount client side checking can fix this problem when the user controls the client.
The system in question had a bug that it won't let you change the age through UI. I was trying to register for something which was based on first come first serve basis and would not let me change my kids age. Since tech support was not available, I just tried dev tools, changed the date and updated profile and it worked. The issue only happened for about 10% people falling in certain date ranges. Although the site fixed the issue next day, many of them who got affected by this issue could not enroll as it got full by then.
Oh, please the fuck up. You're not from Hungary. Go fuck yourself, troll.
And here I thought it was a southern California thing.
If you only visit sites in your hosts file 98% of the time, then you're only 98% covered from DNS attacks, dipshit. Besides, your use case is not applicable to the vast majority of internet users. Most of us visit fast more sites than Slashdot and Rule34 everyday.
See subject: WRONG - OpenDNS, unlike others, filters vs. threats & IS patched vs. the Kaminsky redirect poisoning flaw security issue (99.999% of ISP dns aren't).
* Guess what I combine w/ custom hosts files?
OPENDNS! ... & I never said I ONLY visit my fav. sites hardcoded for fastest possible LOCAL from SYSTEM RAM cached hosts (which also secures you vs. DNS fails in security etc. or being downed) !
(Lastly - Nicest part of MY hosts program, unlike others? Is that I allow YOU to set your fav. sites you spend MOST TIME @ ONLINE - as many as you like, properly reverse DNS resolved!)
HECK, CHINA IMITATED THIS TECHNIQUE OF MINE http://www.theregister.co.uk/2017/04/26/boffins_supercharge_the_hosts_file_to_save_users_plagued_by_dns_outages/
APK
P.S.=> Like I said to OmniChad earlier? "No scenario? I see EVERY scenario. I see 50 scenarios... that's what it DOES, Karl - It puts me 50 MOVES AHEAD OF YOU" & yours (LIMITLESS Eddie Morra, lol = me)... apk
You're missing commas in all of those examples.
a) "He should, of course he should!", she exclaimed breathlessly.
b) "If we did X, we would, of course, get..."
c) "It could, of course, be a fly."
You're missing commas in all of those examples.
They're actually optional, specially if you're trying to convey spoken language. I agree that with them the sentences read better though.
Conservatism: (n.) love of the existing evils. Liberalism: (n.) desire to substitute new evils for the existing ones.
May be a day late and a dollar short on this response but that is not a good analogy. Client side validation is not swapping stickers, it is handing the customer the label maker and letting them choose their own price. Sure it has a suggested price as the default, but without checking the accuracy on the server side you are letting the customer pick which ever price they want and you accept it because that is how your system is set up. It is like the credit card company that did not verify their own contract when it was sent back by a customer. If your system is set up to auto accept what the customer said you are going to have a bad time.
Of all tyrannies, a tyranny sincerely exercised for the (supposed) good of its victims may be the most oppressive
Shoulda, woulda, coulda