IT Pro Arrested After Demonstrating Bug in Kindergarten Software

Bulgarian authorities arrested an IT professional after he publicly demonstrated a vulnerability affecting software used by kindergartens.

On 25 June, the Bulgarian IT expert Petko Petrov shared his findings about the software on Facebook. His post included a video in which he launched an automated attack against a local municipality’s website where parents can enroll their children in kindergarten. By abusing that software flaw, he was able to make off with personal data relating to 235,543 citizens of Stara Zagora, a province in central Bulgaria.

He also included a link to a GitHub repository where anyone could download his exploit code for the software vulnerability.

In his caption to the Facebook video, Petrov said he attempted to contact both Information Services AD, the developer of the vulnerable software, as well as local authorities but didn’t receive a meaningful response.

Bulgarian authorities didn’t waste much time in responding to Petrov’s Facebook post, however. According to ZDNet, local law enforcement arrested the IT professional and jailed him for 24 hours before setting him free. As of this writing, Petrov is still facing charges under Article 319A of the Bulgarian Criminal Code of having obtained government information using illegal methods. He could spend up to three years in prison and pay a fine of up to 5,000 Bulgarian leva ($2,900) if convicted.

In the meantime, Stara Zagora officials took down the vulnerable software and contacted Information Services AD about the vulnerability. The mayor of the City of Stara Zagora said that officials have yet to receive a response.

This incident underscores the importance of security professionals and software developers working together to find and remediate vulnerabilities as quickly as possible. (Bug bounties are an excellent application of this responsible disclosure principle.) It also highlights (Read more...)