A kid in Hungary was arrested for exactly this (and it was a cheap bus ticket): https://www.bitdefender.com/en-us/blog/hotforsecurity/budape...
Here's a better article: https://techcrunch.com/2017/07/25/hungarian-hacker-arrested-... - it seems like this was good faith security research (he disclosed the issue after testing it) and he couldn't use the transport pass he "stole" because he didn't even live in their service area anyway.
This arrest had nothing to do with stealing and all to do with putting well-connected, incompetent people in a very uncomfortable position.
A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper even if - hah, as if that happens - they made an arrest.
The only reason you are hearing about this is because someone at 'bigcorp' didn't want to accept responsibility for their fuckups, and so they used the law to come down on some kid which effectively did them a service, which costs society a large pile of money, further externalizing the cost of their fuckup.
The kid purposely changed the price of a service to lower it to an insignificant fraction (reportedly from ~27£ to ~0.15£).
If that same kid went around a supermarket replacing price tags to lower the selling price, would you call it "showing up a bunch of big names"?
Say what you may about how broken and buggy the system was. Purposely misusing it for financial advantage is still a no-no.
I could comment extensively on the issue, as it is not as cut and dry as you imply. Instead, I'm going to link to the HM discussion from 2017 , as I think it is insightful and covers nuances.
> Did you try adjusting price?
And he was punished for "hacking", not for stealing, and for indirectly putting to shame who was responsible for the epic fail.
You're failing to address the point. It is also trivial to switch price tags in supermarkets. If a kid rips off the tag of an expensive product, tacks on another price tag for pennies, and proceeds to pay the reported price at the checkout counter, is this something deemed acceptable or even classified as vulnerability research?
Make no mistake: the system was a shit show and all companies involved pulled some "sociopath mid-level manager saving his ass" moves. But the issue is nuanced.
Sounds more like vulnerability reasearch than crime to me.
This is the key difference. The comment I was replying to implied that the transaction was actually completed, or at least I thought it did.
If the guy[0] didn't indeed actually benefit from the vulnerability then that is a very different story, and I don't think he should be arrested in that case.
0: not "kid" -- he is 18 which I assume is above the age of criminal responsibility in Hungary.
Then you took their money and gave them the item without saying anything.
Would seem like a weird situation but I don’t see how its theft.