<commit_before>---
layout: post
title: "18-year-old ethical hacker got arrested in Hungary"
date: 2017-07-23 20:00:00
categories: security
tags: social-justice
image: /assets/image/2017-07-23-18-year-old-ethical-hacker-got-arrested-in-hungary/cover.jpg
---

I am writing this blog post because I haven't found any news in the international media about the recent technology-related
scandal in Hungary, and I want to draw attention to the topic while raising awareness of the importance of information
security and proper crisis management as well as praising the power of social networks. So let's see first what kind
of craziness has just happened in Hungary!

## Security gone wrong

[T-Systems Hungary][t-systems-hu-website] (which is owned by [Magyar Telekom Nyrt.][telekom-website] which is owned by
[Deutsche Telekom AG][deutsche-telekom-website]) developed an online shop for tickets and monthly passes for the public
transportation company of Budapest ([BKK Zrt.][bkk-website]) that was made available for the masses on 14th July.

![BKK Online shop][bkk-app]

The digital tickets you buy from the webshop can be presented on your smart phone to the ticket controller personnel
until the fully electronic ticket system ([RIGO][rigo-website]) is deployed in the capital (it is expected at the end of
2018). This is great news and I feel that we are finally reaching the technology level of the 21st century!

Unfortunately the devil is in the details, so during the first week of operation many-many severe security vulnerabilities
and usability problems have been discovered. Here they are without the need for completeness:

- The SSL connection of the site got the worst, "F" rate on [SSL Labs][bkk-ssl-report]
!["F" rate on SSL Labs][bkk-ssl] (the report might not be available now because SSL Labs has been apparently blocked from
accessing the website since it hit the news)
- The CAPTCHA on the registration form is [ridiculous][bkk-captcha-twitter]
![So called "CAPTCHA" protection][bkk-captcha]
- Email addresses weren't verified which allowed potential abuse
- Your password used to be sent out directly in unencrypted mail when you requested a password reminder
- Password fields used to be filled out when editing your personal details
- One used to be able to get access to personal details (including the password) of other registered users with limited
IT knowledge by using an older web browser
- As there is currently no possibility to delete your account on the website itself, you can ask the IT Support to do so,
and they were willing to perform the action without any verification, even though you wrote them from a different email
address from the one you had registered with
- You could modify the price of the ticket by changing the value of an input field on the checkout page which clearly
indicates that the price wasn't validated properly on the server-side. That's why the following monthly Budapest-pass
could be bought for 50 HUF (~ 0.15 EUR) instead of 9 500 HUF (roughly 30 EUR):
![A monthly Budapest-pass bought for 50 HUF instead of 9 500 HUF (roughly 30 EUR)][bkk-ticket]
- Icing on the cake is that only a very few of the ticket controllers have QR code readers so they can be bypassed
easily using fake tickets

All in all, this website is a complete parody of information security, a real counterexample of responsible data handling.
This level of negligence just isn't acceptable in 2017 when half of our life is online. Moreover, tens of thousands
of people could possibly use the application so the impact of its security is rather big.

But this isn't the worst part of the story. The real horror will just come!

## Crisis management gone wrong

BKK Zrt. denied that any security vulnerability has been exploited:

> There's no evidence that anybody's password or personal data would have been compromised

said Mr. <NAME>, CEO of the company (the above text is a paraphrase). However, he admitted that there were several
(cyber)attacks and trolling attempts against the website. Mr. <NAME>, vice mayor of Budapest announced that
T-System Hungary Zrt. has already reported an attacker to the police.

Then it came out that the aforementioned "attacker" is a 18-year-old kid almost without any computer education. He was
the one who discovered that tickets can be bought [for any price you want](#security-gone-wrong) and who **immediately**
reported the bug to the public transportation company. The next day, the young "hacker" was **arrested by the police early in
the morning**.

Later that day, BKK Zrt. and T-Systems Zrt. made a common announcement in which they stated that

> The event "which reached a certain level" had to be reported to the police because of a strict internal
policy of the developer company.

They added that it is very sad to hear that the suspect is such a young student who seemed to have good intentions
based on his interviews in the media.
<commit_msg>Fixed title and added more insights about the disclosure<commit_after>---
layout: post
title: "A 18-year-old ethical hacker got arrested in Hungary"
date: 2017-07-23 20:00:00
categories: security
tags: social-justice
image: /assets/image/2017-07-23-18-year-old-ethical-hacker-got-arrested-in-hungary/cover.jpg
---

I am writing this blog post because I haven't found any news in the international media about the recent technology-related
scandal in Hungary, and I want to draw attention to the topic while raising awareness of the importance of information
security and proper crisis management as well as praising the power of social networks. So let's see first what kind
of craziness has just happened in Hungary!

## Security gone wrong

[T-Systems Hungary][t-systems-hu-website] (which is owned by [Magyar Telekom Nyrt.][telekom-website] which is owned by
[Deutsche Telekom AG][deutsche-telekom-website]) developed an online shop for tickets and monthly passes for the public
transportation company of Budapest ([BKK Zrt.][bkk-website]) that was made available for the masses on 14th July.

![BKK Online shop][bkk-app]

The digital tickets you buy from the webshop can be presented on your smart phone to the ticket controller personnel
until the fully electronic ticket system ([RIGO][rigo-website]) is deployed in the capital (it is expected at the end of
2018). This is great news and I feel that we are finally reaching the technology level of the 21st century!

Unfortunately the devil is in the details, so during the first week of operation many-many severe security vulnerabilities
and usability problems have been discovered. Here they are without the need for completeness:

- The SSL connection of the site got the worst, "F" rate on [SSL Labs][bkk-ssl-report]
!["F" rate on SSL Labs][bkk-ssl] (the report might not be available now because SSL Labs has been apparently blocked from
accessing the website since it hit the news)
- The CAPTCHA on the registration form is [ridiculous][bkk-captcha-twitter]
![So called "CAPTCHA" protection][bkk-captcha]
- Email addresses weren't verified which allowed potential abuse
- Your password used to be sent out directly in unencrypted mail when you requested a password reminder
- Password fields used to be filled out when editing your personal details
- One used to be able to get access to personal details (including the password) of other registered users with limited
IT knowledge by using an older web browser
- As there is currently no possibility to delete your account on the website itself, you can ask the IT Support to do so,
and they were willing to perform the action without any verification, even though you wrote them from a different email
address from the one you had registered with
- You could modify the price of the ticket by changing the value of an input field on the checkout page which clearly
indicates that the price wasn't validated properly on the server-side. That's why the following monthly Budapest-pass
could be bought for 50 HUF (~ 0.15 EUR) instead of 9 500 HUF (roughly 30 EUR):
![A monthly Budapest-pass bought for 50 HUF instead of 9 500 HUF (roughly 30 EUR)][bkk-ticket]
- Icing on the cake is that only a very few of the ticket controllers have QR code readers so they can be bypassed
easily using fake tickets

All in all, this website is a complete parody of information security, a real counterexample of responsible data handling.
This level of negligence just isn't acceptable in 2017 when half of our life is online. Moreover, tens of thousands
of people could possibly use the application so the impact of its security is rather big.

But this isn't the worst part of the story. The real horror will just come!

## Crisis management gone wrong

BKK Zrt. denied that any security vulnerability has been exploited:

> There's no evidence that anybody's password or personal data would have been compromised

said Mr. <NAME>, CEO of the company (the above text is a paraphrase). However, he admitted that there were several
(cyber)attacks and trolling attempts against the website. Mr. <NAME>, vice mayor of Budapest announced that
T-System Hungary Zrt. has already reported an attacker to the police.

Then it came out that the aforementioned "attacker" is a 18-year-old kid almost without any computer education. He was
the one who discovered that tickets can be bought [for any price you want](#security-gone-wrong) and who **immediately**
reported the bug to the public transportation company, and four hours later to the most popular online news site,
[index.hu][index-bkk-tag]. The next day, the young "hacker" was **arrested by the police early in the morning**.

Later that day, BKK Zrt. and T-Systems Zrt. made a common announcement in which they stated that

> The event "which reached a certain level" had to be reported to the police because of a strict internal
policy of the developer company.

They added that it is very sad to hear that the suspect is such a young student who seemed to have good intentions
based on his interviews in the media.

{'fraction_non_alphanumeric': 0.04847576211894053, 'fraction_numerical': 0.011794102948525738, 'mean_word_length': 4.549639489739324, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2371636', 'n_tokens_mistral': 2646, 'n_tokens_neox': 2411, 'n_words': 1555}