Slashdot Mirror
Company Gets 45,000 Bad Facebook Reviews After Teenaged Hacker's Unjust Arrest (bleepingcomputer.com)
An anonymous reader quotes BleepingComputer:
Over 45,000 users have left one-star reviews on a company's Facebook page after the business reported a security researcher to police and had him arrested in the middle of the night instead of fixing a reported bug. The arrest took place this week in Hungary after an 18-year-old found a flaw in the online ticket-selling system of Budapesti Közlekedési Központ, Budapest's public transportation authority. The young man discovered that he could access BKK's website, press F12 to enter the browser's developer tools mode, and modify the page's source code to alter a ticket's price. Because there was no client or server-side validation put in place, the BKK system accepted the operation and issued a ticket at a smaller price...
The teenager -- who didn't want his name revealed -- reported the issue to BKK, but the organization chose to contact the police and file a complaint, accusing the young man of hacking their systems... BKK management made a fatal mistake when they brazenly boasted in a press conference about catching the hacker and declaring their systems "secure." Since then, other security flaws in BKK's system have surfaced on Twitter. As details of the case emerged, public outrage grew against BKK and its manager Kálmán Dabóczi, especially after it was revealed that BKK was paying around $1 million per year for maintenance of its IT systems, hacked in such a ludicrously simple manner.
The teenager -- who didn't want his name revealed -- reported the issue to BKK, but the organization chose to contact the police and file a complaint, accusing the young man of hacking their systems... BKK management made a fatal mistake when they brazenly boasted in a press conference about catching the hacker and declaring their systems "secure." Since then, other security flaws in BKK's system have surfaced on Twitter. As details of the case emerged, public outrage grew against BKK and its manager Kálmán Dabóczi, especially after it was revealed that BKK was paying around $1 million per year for maintenance of its IT systems, hacked in such a ludicrously simple manner.
Never try to help souless corporation.
it would have to told you the correct grammar is:
"What would be the result of changing the price to a negative number"
and then it would have positively fucked your mother
"would of" How do people still make this mistake? Do you just never read?
That press conference was the equivalent of doing a presentation in front of your class on dressing modestly with your fly open.
The manager(s) who authorized that embarrassment should be fired first thing tomorrow morning because they're clearly clueless bureaucrats that don't even understand their own department's responsibilities.
While I agree with this sentiment, proper journalism presents the facts and lets the reader decide if it's just or not.
This company has no clue how eCommerce works. They actually are double handy capped in that they don't even know what they don't know so they likely had a false sense of thinking they actually did understand things. If you use the website as intended you can't change the price. I have no doubt that Kálmán Dabóczi believed this kid was hacking their system and I also think it is likely that everyone he asked also though the same thing.
Kálmán Dabóczi, BKK, the police and the judge who issued the warrant all owe this kid a big apology. However, not everyone can understand everything and it is reasonable to expect that sometimes you will get unlucky and get a company and a few members of the police who have almost zero understanding of a subject and make a stupid mistake. The police didn't kick in his door, shoot his dogs or throw stun grenades in a crib. Hopefully they were professional about the entire thing. Kálmán Dabóczi has likely learned a very hard lesson so let him apologize and get to work. He now has a pile of free penetration results to deal with and possible the job of selecting a new supplier for the website.
I guess security researchers and hackers now learned a lesson.
Find a bug? Exploit the f**k out of it. Don't bother reporting it.
Surely no e-commerce site should rely on client-side validation? That seems like asking for trouble.
The real "Libtards" are the Libertarians!
I'd be more impressed if the facebook hive mind did something about this.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
...for your own reviewing and commenting enjoyment: https://www.facebook.com/bkkbu...
I am a geek attorney, but not your geek attorney unless you've already retained me. This is not legal advice.
No, a better analogy is: the store forgot a price sticker printer in the shelf, so any client could just get it and print new prices freely. This kid found the printer and took it to the cashier, and rather than getting thanked, he got accused of stealing the printer.
Circumcision is child abuse.
How would he know that the flaw existed at all, if he hadn't tried it and found that it worked? It's not like he cashed in on it; he merely and duly reported it. No, the company's actions were maximally counterproductive.
If this LUDDITE company used modern appy app apps instead of LUDDITE software, then LUDDITE hackers wouldn't be able to hack the app! Only apps can app apps!
Apps!
We don't need a bad analogy or two to understand this. The kid saw an exploitable flaw, let the company know in a responsible manner, and was punished for it. Other companies would thank him, and perhaps even pay him a bug bounty for his trouble, because he just did them a huge favor. This is not anything unprecedented in the modern world. Only the backwards and punitive reaction is.
This reaction represents the mindset of companies from decades ago, where they thought that security through obscurity was a valid methodology. All it does it discourage white hats from disclosing bugs. The black hats will gleefully exploit the flaws they discover.
Irony: Agile development has too much intertia to be abandoned now.
"should of"
Subtle. I like it.
"So long and thanks for all the fish."
That way, no accusation of getting financial gain from the "hack" would have been possible.
As to the site, these people are the worst of the worst of incompetents. Even an ElCheapo pen-test would have found that problem. Likely the hugely inflated price for system maintenance goes to some equally incompetent and thoroughly corrupt friend or relative of the CEO and that would also explain the brain-dead reaction.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
At least twice, because I know I'm not his father.
I couldn't resist.
"So long and thanks for all the fish."
I found a similar flaw in a supermarket's self-service tills. Didn't report it for this very reason. I don't purposefully look for bugs/exploits, but if I did spot any more in future then I wouldn't report those either. My heart tells me to report them, but my head tells me no.
Can confirm that APK predates the Android packages.
"So long and thanks for all the fish."
But never got asked out on a second date.
I'm not one for advocating laws but looking at this and seeing the obvious effect it's going to have on white hat security vigilantes (saying nothing or being turned grey/black hat by corporate, egotistical, twats covering their own arse) the only solution seems to be to create laws to protect the white hats.
Laws like those which protect freedom of press and speech.
If you haven't benefited from your discovery and research then you can't be prosecuted.
Instead of reporting to the corporation report to a government watch dog who covers for you.
Better still fine the corporations to fund the watch dog and pay out a bug bounty.
I don't report bugs to the company. I may report it to their ISP, but usually I don't bother in the sense I don't go looking for bugs.
I don't know, but isn't there a bug reporting system that will allow anonymous communication? If not, maybe that's something CERT could look into sponsoring.
Sort of like the old abuse.net system, where you could register "Hey, this is where we take spam reports seriously." That way the clued in sites will let the whitehats know their reports are taken seriously, and the white hats know they at least have a simi-clued in contact and won't let slip the dogs of war because there's something wrong.
Again, all I'm interested in are my own sites, and I'll hardly dox myself.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
Wait...did you just link to a post where I proved you wrong? Why? DNS amplification attacks use DNS servers to attack YOU - whether you use DNS resolution or not.
With my vote.
I haven't been on Slashdot much lately, but is that the new euphemism for hacking?
The simple rule is don't poke around someone else's defenses and then get mad when they treat you as a threat. How would you feel if someone told you "Hey, I've been trying to break into your house lately and just realized your bedroom window is unlocked!" ?
I swear to God...I swear to God! That is NOT how you treat your human!
Since they are so insistent on their system being secure when it clearly isn't, wouldn't it be funny if someone sold themselves a ticket with a negative value attached, thereby crediting themselves a large sum of money?
the subway token system can get EASILY hacked -i.e. you pay for 5 rides and they never "expire". This is all documented in a public website by a programmer dude who discovered it. Nobody did anything it has been like that for years, apparently. I suspect people could be even selling fake prepaid tickets etc. It's just Bulgaria in general country is so corrupt on all levels, that a scam of such magnitude is not threaded as something serious lmao Millions of EU funded money get laundered and stolen into corrupt politicians's own pockets. In Bulgaria the average salary is 400 euro, but you see Brabus and AMG Mercedes S 600 and Bentleys and Panameras everywhere all day...
It's only natural, when finding a bug, to test it and confirm that it is a bug. If a front door is unlocked, you might reasonably push on it, poke your head in and shout "is anyone home?". And then leave a note on the doormat.
I'd say he did the minimal possible to confirm there was a problem.
The online ticket selling system in question was developed by the hungarian branch of Germany-based global giant T-Systems group. Although "developed" seems a bit of an exaggeration, since it looks like about half of the system was merely "painted on the wall" in very rough draft code and at an early stage of perparadness, but the whole infrastructure was duressed into live operation prematurely.
The reason for such a hurry was the ongoing FINA 2017 would championship for aquatic sports, which Budapest and Hungary adopted only 2 years ago when the originally chosen host country (Mexico I think?) suddenly balked out. Pool swimming, water polo, sprint kayak are really big in Hungary, so the country was eager to take over, despite the little time left.
Ever since, a huge amount of money was wasted on hurried preparations (including widespread and extremely costly corruption between politicians-bureucrats and construction company owners) and the event's budget skyrocketed to 4x times of the planned, tehreby taking away a lot of money earmarked for public education and the country's single-payer health system.
While Budapest has a dense and well-developed surface mass transport system called BKK (formely BKV), the international airport at Ferihegy (BUD) is not yet served by an underground railway or a light rail link, there is only a stop-at-every-bush articulated bus line for it, which doesn't even reach the city centre.
Considering the FINA 2017 event, another direct-to-city-center bus line was hastily introduced and politics wanted an online tickets / passes selling system for that, so the airport kiosks wouldn't be overwhelmed and look bad on TV news. (The leadership un-realistically expected hundreds of thousands, if not millions of foreign sports fans to visit Budapest for just the event.) Thus the "bright" idea of pressing into service a quarter-to-half ready online merchant system was born...
BTW, the hacker who discovered the price fixing trick lived 300km (190mi) from Budapest and hasn't been to the capital for months, thus his pennys purchase of a name-assinged pass wasn't made maliciously. In fact it was the T-Systems branch, not BKK, which received his bug report and counter-reported him to police, climing their corporate legal policies require such step. Hungarian netizens have been smear-comment flooding the global T-group Facebook page ever since.
Since I'm a local, let me also add this for the human resources aspect of the story:
Another reason for the hurried introduction of the inscure, unfinished BKK online ticket sales system was that the Mr. Kalman Daboczy, whom the referenced article mentioned by name, is not the original leader of BKK.
Before him there was David Vitezy, an admittedly weird, but very bright, internationally educated jewish boy, who got to form and lead the BKK at a young age, solely due to his family's high political connections yet turned out to be highly motivated. In a few years Vitezy introduced a computerized schedule-control system called FUTAR for over 1500 buses which revolutionized on-timeliness in circulation, a quantum leap from the paper-based BKV era and welcomed by all pax.
He also introduced private sub-contracting for bus line operations with run-time based financing, which brought in hundreds of brand new low floor, low pollution Merc and Volvo vehicles to Budapest, where previously only Cold War era (!) left-over smoking wreckages circulated. He managed to extend the lenght of the city's most important tram line and furnish it with modern rolling stock by successfully claiming EU funds for development, which was considered impossible to get by all parties. He created a public bicycle-sharing system called BUBI from zero and integrated it with BKK. Genius, I'd say.
Eventually Vitezy was sacked from BKK as he tried to reform traffic light patterns and lane use rights to prioritize bus and tram circulation versus private cars, which limousine-riding politicians vetoed. Mr. Daboczy, who replaced him is a "mameluk" i.e. a person whose only skill is loyalty to political superiors in executing orders without questions, including hurtful or stupid ones, and he is without creative talent. Ever since BKK has been stagnating and the city's population eventually questioned why no public transit development happens since Vitezy left? Thus the online ticket selling system was kind of an attempt to show off the new leadership's competence but it backfired spectacularly. The opposition is now demanding Daboczy's removal from BKK due to the scandal.
BTW, when David Vitezy was sacked from BKK, the Port Authority of New York reportedly tried to woo him over to advise on future plans for public transport development in the skyscraper city. He declined to emigrate, probably the mistake of his life, as ever since he has been given mere "desk by the window" roles in Hungary. I'd say if he'd left for USA, maybe in 15 years he could have been properly groomed in America and come back as a potential future PM of Hungary. That, provided the russians don't conquer our country again in the meanwhile...
How fucking corrupt (or clueless) must one have been to have cast a vote for Hillary Clinton?
We had a similar situation in Poland recently. A party of ass clowns was voted in, in place of one of very competent *thieves* that kept robbing the country blind with impunity over previous 8 years. And while the ass clowns aren't a good government, they certainly cause far less harm than the thieves did.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Go full blackhat or get fucked. I bet their server where customer information resides has gaping security loopholes too. Instead of punishing the company the try to kill the messenger.
sudo rm -r -f --no-preserve-root /
Studies show that grammar nazis are dicks.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Nobody here says "WA LA". It's spelled "voilà" for a reason.
#DeleteFacebook
You say "ludicrously simple" but in today's 8-week-bootcamp to "Javascript ninja rockstar" culture, I've all but given up on trying to explain to front-end developers why client-side validation alone isn't sufficiently secure. I explain it to them once, shrug off their uncomprehending stares and wait for them to implement what I just told them not to, demonstrate the "hack" in front of them, wait for them to protest that "well, anybody who is competent enough to think of THAT is surely unstoppable anyway!" and then hunker down for a month of explaining again, and again, and again to management that yes, deadlines are super-duper important and yes, we have client deliverables to meet but this is a real security problem and yes, it really needs to be fixed. That the cumulative time we spend arguing about something that never should have even come up in the first place is an order of magnitude greater than the time that would have been spent just fixing the damned thing in the first place never seems to make much impression on anybody, either.
Proud neuron in the Slashdot hivemind since 2002.
It's colloquial. Some people view their forum responses as literal "speech", rather than a formal written argument.
Get over it.
Then they shouldn't be writing and also stop assuming that everyone else knows it. Speaking language is often time ambiguous. If you want to write, do it properly.
how can a DNS amplification affect me?
Maybe you should look up what a DNS amplification attack does. Hint - it doesn't matter if you use HOSTS for all of your lookups.
A DNS amplification attack does not stop you from looking up web sites. It's a DDoS that overloads your router. HOSTS will not help you with that whatsoever. Not DOS, DoS.
P.S. It's not a "big blunder" to not remember which order to put HOSTS in. The Windows default hosts file has examples in it. You never have to learn or remember the syntax, because it's right there in the file.
how can you overload my router? You don't know my IP address!
It doesn't have to be a targeted attack - you still have an IP address and you're still not any more protected. Besides, you claimed that the HOSTS file engine protects against a DNS amplification attack. Still not true.
Since EXAMPLES ARE THERE, your BLUNDER SHOWS YOU DIDN'T CHECK 1st & STUPIDLY PUT THEM OUT IN THE WRONG ORDER
Or, it's pseudocode and exact syntax doesn't matter in the slightest. You're the only person on Slashdot who would care. The meaning of my post didn't change based on the order of my syntax, because the intent was unambiguous.
From my CS days in college, unit test for the following conditions. Value = N, value = N -1, value = N + 1, value = -N, wash, rinse, repeat until time is up or bugs are fixed.
Fat, drunk, and stupid is no way to go through life, son.
Do you change your actual ISP IP or your endpoint/VPN IP? Only the former prevents being affected by a DDoS. You're assuming someone found your IP from forum/server logs rather than just attacking a random IP.
It's WHY I change IP address every time I post in ANY forums
No, you do that because otherwise you can't post as AC every couple minutes all day.
Either way, HOSTS does not protect against a DNS amplification attack. Why not concede that point already?
They'd like their client-side shopping cart software back.
How does even the most novice developer not know that you can't trust anything from the client?
Freedom to fear. Freedom from thought. Freedom to kill.
I guess the War on Terror really is about freedom!
Oh, the irony.
"So long and thanks for all the fish."
"The King Has No Clothes on!"
I think in the original version the person that made that proclamation was promptly beheaded.
If not, it should at least be mentioned.
First rule of holes; When in one, stop digging.
And your HOSTS tool still does nothing to protect against DNS amplification attacks. Seems that you can't just address the main point of my post.
I don't care if the DNS amplification attack affects you - that wasn't the issue. You claimed that your HOSTS file engine itself protects against that. That's not true.
Because you're advertising your software as something that can stop DNS amplification attacks. https://science.slashdot.org/c...
And when someone calls you out on it, you stick out your tongue and say that you can change your IP address. Only a politician would think that's an answer.
Powerful people don't like to be embarrassed nor have the world discover their incompetence. If you expose a powerful moron his position is at risk, and he'll take it as an attack. It's irrelevant for him that you were only trying to help.
“Common sense is not so common.” — Voltaire
I'm not attacking you with DNS amplification attacks. I'm talking about the end-users you advertise to. Stop conflating these two things.
Hosts file engine does nothing against DNS amplification attacks.
Idly browsing one night, I discovered that all access controlled had been switched off our corporate network. Yes I could even open the CEO's home folder. It didn't take much brain power to realise that if I looked any further there would be time stamps on files that matched my shift time, so I didn't go any further (despite being curious).
I waited until the morning and phoned a relatively junior IT team member and explained the security lapse to him (on the basis of anonymity), who then escalated the problem.
The result: The problem got fixed. He got a pat on the back for discovering the oversight, and we became good friends.
Is there even a legitimate way to use "should of" or "would of" in a sentence?
Any in which "of" is followed by "course".
a) "He should of course he should!", she exclaimed breathlessly.
b) "If we did X, we would of course get..."
c) "It could of course be a fly."
Conservatism: (n.) love of the existing evils. Liberalism: (n.) desire to substitute new evils for the existing ones.
Because there was no client or server-side validation put in place
What on earth would client side validation do? In fact it does have client side checking it puts the price in the client. The problem is that the hacker changed the client. No amount client side checking can fix this problem when the user controls the client.
You're missing commas in all of those examples.
They're actually optional, specially if you're trying to convey spoken language. I agree that with them the sentences read better though.
Conservatism: (n.) love of the existing evils. Liberalism: (n.) desire to substitute new evils for the existing ones.
May be a day late and a dollar short on this response but that is not a good analogy. Client side validation is not swapping stickers, it is handing the customer the label maker and letting them choose their own price. Sure it has a suggested price as the default, but without checking the accuracy on the server side you are letting the customer pick which ever price they want and you accept it because that is how your system is set up. It is like the credit card company that did not verify their own contract when it was sent back by a customer. If your system is set up to auto accept what the customer said you are going to have a bad time.
Of all tyrannies, a tyranny sincerely exercised for the (supposed) good of its victims may be the most oppressive