Category Archives: security assessment

NOS: “Zeker 15 van de 25 ziekenhuizen geïnfecteerd met ransomware”

Posted on 25-06-2017 by Sijmen Ruwhof

De NOS bericht vandaag: Zeker 15 van de 25 ziekenhuizen geïnfecteerd met ransomware Nederlandse ziekenhuizen zijn kwetsbaar voor aanvallen met een gijzelvirus. Zeker vijftien Nederlandse ziekenhuizen hebben de afgelopen drie jaar te maken gehad met zulke ransomware-aanvallen. In één ziekenhuis … Continue reading →

Posted in cyber crime, cyber terrorisme, data leakage, drive-by, interview, radio, ransomware, security assessment, security awareness, tv | Leave a comment

Cqure Quick Question: over (non)scoping bij pentests

Posted on 03-02-2017 by Sijmen Ruwhof

Cqure nodigde me uit om te komen praten over de scoping van pentesten: Cqure: “Sijmen Ruwhof van Secundity vertelt deze week in de Cqure Quick Question over (non) scoping bij pentests. Sijmen vertelt in deze video dat veel pentesten in … Continue reading →

Posted in hacking, interview, pentesting, scoping, security assessment | Comments Off on Cqure Quick Question: over (non)scoping bij pentests

Websites Nederlandse politieke partijen onvoldoende beveiligd

Posted on 31-01-2017 by Sijmen Ruwhof

In de recente hack bij de Democratische Partij in de VS (toen Hillary Clinton presidentskandidate was), werden Clinton en haar partij in diskrediet gebracht doordat bijna twintig duizend interne mails van de partijtop op internet zijn geplaatst door WikiLeaks. Eerder publiceerde WikiLeaks meer … Continue reading →

Posted in e-voting, hacking, responsible disclosure, security assessment, security awareness, website security, zero day | 3 Comments

How to hack the upcoming Dutch elections – and how hackers could have hacked all Dutch elections since 2009

Posted on 30-01-2017 by Sijmen Ruwhof

As everybody has read in the newspapers, the recent American elections involved multiple and severe hacking attacks. Tens of thousands of confidential and private emails from Hillary Clinton and the Democratic National Committee (DNC) were leaked via WikiLeaks. It is thought … Continue reading →

Posted in e-voting, hacking, responsible disclosure, security assessment, security awareness, zero day | 46 Comments

How I accidentally found a huge data leak during a college lecture

Posted on 13-05-2016 by Sijmen Ruwhof

A few weeks ago I gave a guest lecture at the Windesheim University of Applied Sciences in The Netherlands. Being a Windesheim graduate myself I’ve always kept in touch with my former teachers. One of them told me recently that … Continue reading →

Posted in responsible disclosure, security assessment | 44 Comments

Epic failure of Phone House & Dutch telecom providers to protect personal data: How I could access 12+ million records #phonehousegate

Posted on 08-12-2015 by Sijmen Ruwhof

On September 11, 2015 I visited Media Markt in Utrecht Hoog Catherijne, a well-known electronics shop in The Netherlands. Since summer 2014, the biggest independent Dutch phone retail company Phone House also operates (white labeled) from within Media Markt locations … Continue reading →

Posted in data leakage, privacy, responsible disclosure, security assessment | 419 Comments

Full disclosure: multiple critical security vulnerabilities (including a backdoor!) in PHP File Manager

Posted on 27-07-2015 by Sijmen Ruwhof

In July 2010 I was looking for a web based file manager that I could use on my own web server. After some research I found the PHP File Manager from Revived Wire Media. A basic, but good looking web … Continue reading →

Posted in PHP security, responsible disclosure, security assessment | 36 Comments

Veiligheidsanalyse iDEAL Lite bijgewerkt

Posted on 25-02-2011 by Sijmen Ruwhof

Naar aanleiding van het overleg met Rabobank Nederland is het rapport over de iDEAL Lite voorbeeldcode bijgewerkt met nieuwe informatie.

Posted in responsible disclosure, security assessment | Comments Off on Veiligheidsanalyse iDEAL Lite bijgewerkt