U-Bahnfreund
Member
The Budapesti Közlekedési Központ (BKK) recently introduced a new e-ticketing system, but unfortunately it is full of bugs. Passwords are stored as blank text, you can easily hack into other users accounts (complete with personal data etc.) by manipulating the url, the admin password for the system is adminadmin, tickets can be copied and used by multiple persons, but most alarmlingy, it is possible to change the price of a ticket through the browers developer tools.
A 18-year-old has found this by changing the price for a monthtly pass for BKKs system from 9500 Ft (~ £27) to 50 Ft (~ £0.15). He didnt use the ticket, but quickly reported the bug to BKK, but a few days later, he was arrested by the police for hacking into the system (he was released the same day).
Protest arose in Budapest, BKKs and T-Systems (the software partner of BKK) Facebook pages have been flooded with negative ratings...
More details:
https://blog.marai.me/2017/07/24/18-year-old-arrested-bkk-tsystems-e-ticket/ (Detailed blog post)
https://www.theregister.co.uk/2017/07/25/hungarian_teenager_arrest_sparks_protests/ (one of many news reports)
A 18-year-old has found this by changing the price for a monthtly pass for BKKs system from 9500 Ft (~ £27) to 50 Ft (~ £0.15). He didnt use the ticket, but quickly reported the bug to BKK, but a few days later, he was arrested by the police for hacking into the system (he was released the same day).
Protest arose in Budapest, BKKs and T-Systems (the software partner of BKK) Facebook pages have been flooded with negative ratings...
More details:
https://blog.marai.me/2017/07/24/18-year-old-arrested-bkk-tsystems-e-ticket/ (Detailed blog post)
https://www.theregister.co.uk/2017/07/25/hungarian_teenager_arrest_sparks_protests/ (one of many news reports)
