Category Archives: security assessment

Cqure Quick Question: over (non)scoping bij pentests

Cqure nodigde me uit om te komen praten over de scoping van pentesten: Cqure: “Sijmen Ruwhof van Secundity vertelt deze week in de Cqure Quick Question over (non) scoping bij pentests. Sijmen vertelt in deze video dat veel pentesten in … Continue reading

Posted in hacking, interview, pentesting, scoping, security assessment | Leave a comment

Websites Nederlandse politieke partijen onvoldoende beveiligd

In de recente hack bij de Democratische Partij in de VS (toen Hillary Clinton presidentskandidate was), werden Clinton en haar partij in diskrediet gebracht doordat bijna twintig duizend interne mails van de partijtop op internet zijn geplaatst door WikiLeaks. Eerder publiceerde WikiLeaks meer … Continue reading

Posted in e-voting, hacking, responsible disclosure, security assessment, security awareness, website security, zero day | 3 Comments

How to hack the upcoming Dutch elections – and how hackers could have hacked all Dutch elections since 2009

As everybody has read in the newspapers, the recent American elections involved multiple and severe hacking attacks. Tens of thousands of confidential and private emails from Hillary Clinton and the Democratic National Committee (DNC) were leaked via WikiLeaks. It is thought … Continue reading

Posted in e-voting, hacking, responsible disclosure, security assessment, security awareness, zero day | 43 Comments

How I accidentally found a huge data leak during a college lecture

A few weeks ago I gave a guest lecture at the Windesheim University of Applied Sciences in The Netherlands. Being a Windesheim graduate myself I’ve always kept in touch with my former teachers. One of them told me recently that … Continue reading

Posted in responsible disclosure, security assessment | 44 Comments

Epic failure of Phone House & Dutch telecom providers to protect personal data: How I could access 12+ million records #phonehousegate

On September 11, 2015 I visited Media Markt in Utrecht Hoog Catherijne, a well-known electronics shop in The Netherlands. Since summer 2014, the biggest independent Dutch phone retail company Phone House also operates (white labeled) from within Media Markt locations … Continue reading

Posted in data leakage, privacy, responsible disclosure, security assessment | 419 Comments

Full disclosure: multiple critical security vulnerabilities (including a backdoor!) in PHP File Manager

In July 2010 I was looking for a web based file manager that I could use on my own web server. After some research I found the PHP File Manager from Revived Wire Media. A basic, but good looking web … Continue reading

Posted in PHP security, responsible disclosure, security assessment | 36 Comments

Veiligheidsanalyse iDEAL Lite bijgewerkt

Naar aanleiding van het overleg met Rabobank Nederland is het rapport over de iDEAL Lite voorbeeldcode bijgewerkt met nieuwe informatie.

Posted in responsible disclosure, security assessment | Leave a comment

Vetrouwelijke rapporten openbaar gemaakt

Zojuist de volledige rapporten openbaar gemaakt over de iDEAL Lite en DirectAdmin beveiligingslekken uit eind 2009.

Posted in responsible disclosure, security assessment | Leave a comment