-
Recent Posts
Recent Comments
- MediaMarkt in The Wall gaat te slordig om met persoonsgegevens - Leidsche-Rijn on Password database of MediaMarkt leaks again
- Cine se afla in spatele protestelor #REZIST & Chilotareala on Massive child porn site is hiding in plain sight, and the owners behind it
- Photos d'enfants sur les réseaux sociaux | Cmic Blog on Massive child porn site is hiding in plain sight, and the owners behind it
- Pierre Dekan (via Twitter) on Massive child porn site is hiding in plain sight, and the owners behind it
- avocatnet.ro (via Twitter) on Massive child porn site is hiding in plain sight, and the owners behind it
Archives
- February 2021
- November 2020
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- April 2020
- February 2020
- December 2019
- October 2019
- August 2019
- July 2019
- June 2019
- May 2019
- April 2019
- March 2019
- February 2019
- January 2019
- December 2018
- November 2018
- October 2018
- September 2018
- July 2018
- June 2018
- May 2018
- April 2018
- March 2018
- February 2018
- January 2018
- December 2017
- November 2017
- October 2017
- September 2017
- August 2017
- July 2017
- June 2017
- May 2017
- April 2017
- March 2017
- February 2017
- January 2017
- December 2016
- October 2016
- July 2016
- June 2016
- May 2016
- March 2016
- February 2016
- January 2016
- December 2015
- November 2015
- October 2015
- July 2015
- March 2015
- February 2015
- November 2014
- September 2014
- July 2012
- March 2012
- May 2011
- April 2010
- July 2004
- January 1970
Categories
- advertising
- analysis
- anti-virus
- article
- automation
- backup
- banking
- biometrics
- bluetooth
- bnr nieuwsradio
- browser security
- bug
- camera
- chat-app
- child porn
- computer worm
- copyright
- critical infrastructure
- cross site scripting
- cryptography
- cyber crime
- cyber security
- cyber terrorisme
- cyber warfare
- data leakage
- ddos
- deanonymization
- demonstration
- discussion
- drive-by
- e-voting
- election hacking
- espionage
- fake profiles
- hacking
- hart van nederland
- identity theft
- internet of things
- interview
- javascript
- law enforcement
- magazine
- media
- menu
- mobile phone
- multi-factor authentication
- nos
- online banking
- online dating
- osint
- password
- pentesting
- phishing
- PHP
- PHP security
- podcast
- presentation
- privacy
- radio
- ransomware
- responsible disclosure
- russia
- SAP
- scam
- scoping
- search engine optimization
- security
- security advice
- security assessment
- security audit
- security awareness
- security management
- security monitoring
- security vulnerability
- seo
- smart devices
- software development
- telecom
- tv
- Uncategorized
- vulnerability management
- website
- website security
- WiFi
- wiretapping
- zero day
Meta
Category Archives: responsible disclosure
Security assessment of Dutch election software
Last month I started an independent security assessment on the software that totalizes votes in the upcoming Dutch elections on March 21, 2018. The software is called OSV (Ondersteunende Software Verkiezingen) and made by German company IVU Traffic Technologies AG. … Continue reading
Posted in critical infrastructure, cyber warfare, e-voting, hacking, responsible disclosure, security assessment, tv, website security
Comments Off on Security assessment of Dutch election software
Het verhaal achter het datalek van contactgegevens van honderden BN-ers bij showbizzfotografen Peter en Edwin Smulders
Vorige week vrijdag ontving ik een anonieme tip van een hacker dat de server van showbizzfotografen Peter en zijn zoon Edwin Smulders totaal onbeveiligd was. Dit heb ik onderzocht en vastgesteld dat dit inderdaad het geval was. Privégegevens van honderden … Continue reading
Posted in analysis, backup, data leakage, interview, responsible disclosure, tv
Comments Off on Het verhaal achter het datalek van contactgegevens van honderden BN-ers bij showbizzfotografen Peter en Edwin Smulders
Brandweercommandowagen gehackt op hackersfestival SHA2017
Afgelopen weekend was de SHA2017-hackersconferentie in Flevoland. Brandweerregio Noord- en Oost-Gelderland stelde twee brandweerwagens beschikbaar die gehackt mochten worden. Eén van die wagens was een commandowagen die alleen ter ondersteuning wordt ingezet om regie te voeren over alle brandweer inzet … Continue reading
Websites Nederlandse politieke partijen onvoldoende beveiligd
In de recente hack bij de Democratische Partij in de VS (toen Hillary Clinton presidentskandidate was), werden Clinton en haar partij in diskrediet gebracht doordat bijna twintig duizend interne mails van de partijtop op internet zijn geplaatst door WikiLeaks. Eerder publiceerde WikiLeaks meer … Continue reading
How to hack the upcoming Dutch elections – and how hackers could have hacked all Dutch elections since 2009
As everybody has read in the newspapers, the recent American elections involved multiple and severe hacking attacks. Tens of thousands of confidential and private emails from Hillary Clinton and the Democratic National Committee (DNC) were leaked via WikiLeaks. It is thought … Continue reading
Access to 250,000+ event tickets and personal details
In today’s episode of the insecure internet I present you the company Ticketscript. This event ticketing company provides tools and features to make selling tickets for events easier. According to their website: “[..] Ticket buyers are your biggest asset. Why … Continue reading
How I accidentally found a huge data leak during a college lecture
A few weeks ago I gave a guest lecture at the Windesheim University of Applied Sciences in The Netherlands. Being a Windesheim graduate myself I’ve always kept in touch with my former teachers. One of them told me recently that … Continue reading
Posted in responsible disclosure, security assessment
44 Comments
Epic failure of Phone House & Dutch telecom providers to protect personal data: How I could access 12+ million records #phonehousegate
On September 11, 2015 I visited MediaMarkt in Utrecht Hoog Catherijne, a well-known electronics shop in The Netherlands. Since summer 2014, the biggest independent Dutch phone retail company Phone House also operates (white labeled) from within MediaMarkt locations as a … Continue reading
How I could hack internet bank accounts of Danish largest bank in a few minutes
In August I visited the Chaos Communication Camp near Berlin. Once every four years this great and world’s greatest hacker festival is organized. I spoke with a couple of cool Danish hackers there and we talked about internet security and … Continue reading
Posted in responsible disclosure, website security
183 Comments
Full disclosure: multiple critical security vulnerabilities (including a backdoor!) in PHP File Manager
In July 2010 I was looking for a web based file manager that I could use on my own web server. After some research I found the PHP File Manager from Revived Wire Media. A basic, but good looking web … Continue reading
Cross-site scripting in millions of web sites
In August 2014 I found a severe cross-site scripting security vulnerability in the latest version (1.13.0) of the ‘jQuery Validation Plugin‘ during a security penetration test for a customer. This jQuery plugin which adds easy form validation functionality to a web site, is … Continue reading
Posted in cross site scripting, Google, PHP, responsible disclosure
62 Comments
2.364 Nederlandse bedrijfswebsites met ernstige beveiligingslekken
Toen ik in oktober 2012 op internet op zoek was naar een nieuwe auto, kwam ik een autobedrijf tegen waar ik een auto wou gaan kopen: (bovenstaande website is van een willekeurig bedrijf uit de lijst die ik later beschrijf) … Continue reading
Password hash disclosure in Linksys Smart WiFi routers
This is my tale about reporting a specific security vulnerability in a major product, just to give some insight in how responsible disclosures are handled by a security researcher (me) and various software companies (Cisco, Linksys and Belkin). On May … Continue reading
Posted in password, responsible disclosure
5 Comments