Category Archives: responsible disclosure

Security assessment of Dutch election software

Posted on March 13, 2018 by Sijmen Ruwhof

Last month I started an independent security assessment on the software that totalizes votes in the upcoming Dutch elections on March 21, 2018. The software is called OSV (Ondersteunende Software Verkiezingen) and made by German company IVU Traffic Technologies AG. … Continue reading →

Posted in critical infrastructure, cyber warfare, e-voting, hacking, responsible disclosure, security assessment, tv, website security | Comments Off

Het verhaal achter het datalek van contactgegevens van honderden BN-ers bij showbizzfotografen Peter en Edwin Smulders

Posted on February 8, 2018 by Sijmen Ruwhof

Vorige week vrijdag ontving ik een anonieme tip van een hacker dat de server van showbizzfotografen Peter en zijn zoon Edwin Smulders totaal onbeveiligd was. Dit heb ik onderzocht en vastgesteld dat dit inderdaad het geval was. Privégegevens van honderden … Continue reading →

Posted in analysis, backup, data leakage, interview, responsible disclosure, tv | Comments Off

Brandweercommandowagen gehackt op hackersfestival SHA2017

Posted on August 8, 2017 by Sijmen Ruwhof

Afgelopen weekend was de SHA2017-hackersconferentie in Flevoland. Brandweerregio Noord- en Oost-Gelderland stelde twee brandweerwagens beschikbaar die gehackt mochten worden. Eén van die wagens was een commandowagen die alleen ter ondersteuning wordt ingezet om regie te voeren over alle brandweer inzet … Continue reading →

Posted in analysis, drive-by, hacking, radio, responsible disclosure, tv | Comments Off

Websites Nederlandse politieke partijen onvoldoende beveiligd

Posted on January 31, 2017 by Sijmen Ruwhof

In de recente hack bij de Democratische Partij in de VS (toen Hillary Clinton presidentskandidate was), werden Clinton en haar partij in diskrediet gebracht doordat bijna twintig duizend interne mails van de partijtop op internet zijn geplaatst door WikiLeaks. Eerder publiceerde WikiLeaks meer … Continue reading →

Posted in e-voting, hacking, responsible disclosure, security assessment, security awareness, website security, zero day | 3 Comments

How to hack the upcoming Dutch elections – and how hackers could have hacked all Dutch elections since 2009

Posted on January 30, 2017 by Sijmen Ruwhof

As everybody has read in the newspapers, the recent American elections involved multiple and severe hacking attacks. Tens of thousands of confidential and private emails from Hillary Clinton and the Democratic National Committee (DNC) were leaked via WikiLeaks. It is thought … Continue reading →

Posted in e-voting, hacking, responsible disclosure, security assessment, security awareness, zero day | 46 Comments

Access to 250,000+ event tickets and personal details

Posted on December 20, 2016 by Sijmen Ruwhof

In today’s episode of the insecure internet I present you the company Ticketscript. This event ticketing company provides tools and features to make selling tickets for events easier. According to their website: “[..] Ticket buyers are your biggest asset. Why … Continue reading →

Posted in data leakage, hacking, password, responsible disclosure, security vulnerability, website security | 23 Comments

How I accidentally found a huge data leak during a college lecture

Posted on May 13, 2016 by Sijmen Ruwhof

A few weeks ago I gave a guest lecture at the Windesheim University of Applied Sciences in The Netherlands. Being a Windesheim graduate myself I’ve always kept in touch with my former teachers. One of them told me recently that … Continue reading →

Posted in responsible disclosure, security assessment | 44 Comments

Epic failure of Phone House & Dutch telecom providers to protect personal data: How I could access 12+ million records #phonehousegate

Posted on December 8, 2015 by Sijmen Ruwhof

On September 11, 2015 I visited MediaMarkt in Utrecht Hoog Catherijne, a well-known electronics shop in The Netherlands. Since summer 2014, the biggest independent Dutch phone retail company Phone House also operates (white labeled) from within MediaMarkt locations as a … Continue reading →

Posted in data leakage, privacy, responsible disclosure, security assessment | 419 Comments

How I could hack internet bank accounts of Danish largest bank in a few minutes

Posted on October 4, 2015 by Sijmen Ruwhof

In August I visited the Chaos Communication Camp near Berlin. Once every four years this great and world’s greatest hacker festival is organized. I spoke with a couple of cool Danish hackers there and we talked about internet security and … Continue reading →

Posted in responsible disclosure, website security | 183 Comments

Full disclosure: multiple critical security vulnerabilities (including a backdoor!) in PHP File Manager

Posted on July 27, 2015 by Sijmen Ruwhof

In July 2010 I was looking for a web based file manager that I could use on my own web server. After some research I found the PHP File Manager from Revived Wire Media. A basic, but good looking web … Continue reading →

Posted in PHP security, responsible disclosure, security assessment | 36 Comments

Cross-site scripting in millions of web sites

Posted on November 18, 2014 by Sijmen Ruwhof

In August 2014 I found a severe cross-site scripting security vulnerability in the latest version (1.13.0) of the ‘jQuery Validation Plugin‘ during a security penetration test for a customer. This jQuery plugin which adds easy form validation functionality to a web site, is … Continue reading →

Posted in cross site scripting, Google, PHP, responsible disclosure | 62 Comments

2.364 Nederlandse bedrijfswebsites met ernstige beveiligingslekken

Posted on November 8, 2014 by Sijmen Ruwhof

Toen ik in oktober 2012 op internet op zoek was naar een nieuwe auto, kwam ik een autobedrijf tegen waar ik een auto wou gaan kopen: (bovenstaande website is van een willekeurig bedrijf uit de lijst die ik later beschrijf) … Continue reading →

Posted in responsible disclosure, search engine optimization, security vulnerability, website security | 15 Comments

Password hash disclosure in Linksys Smart WiFi routers

Posted on November 1, 2014 by Sijmen Ruwhof

This is my tale about reporting a specific security vulnerability in a major product, just to give some insight in how responsible disclosures are handled by a security researcher (me) and various software companies (Cisco, Linksys and Belkin). On May … Continue reading →

Posted in password, responsible disclosure | 5 Comments