Category Archives: security assessment

Security assessment of Dutch election software

Posted on 13-03-2018 by Sijmen Ruwhof

Last month I started an independent security assessment on the software that totalizes votes in the upcoming Dutch elections on March 21, 2018. The software is called OSV (Ondersteunende Software Verkiezingen) and made by German company IVU Traffic Technologies AG. … Continue reading →

Posted in critical infrastructure, cyber warfare, e-voting, hacking, responsible disclosure, security assessment, tv, website security | Comments Off on Security assessment of Dutch election software

‘Een patchkast hacken? Fluitje van een cent’

Posted on 19-10-2017 by Sijmen Ruwhof

Cobouw heeft me geïnterviewd over de digitale dreigingen die de bouwsector loopt tegenwoordig:

Posted in cyber crime, hacking, interview, magazine, phishing, security assessment, security awareness | Comments Off on ‘Een patchkast hacken? Fluitje van een cent’

Security awareness sessie voor ambtenaren tijdens Zaakgericht Werken congres

Posted on 25-09-2017 by Sijmen Ruwhof

Vandaag heb ik op het Zaakgericht Werken in de Overheid congres een presentatie mogen geven over wat er mis is gegaan in het digitaliseringsproces van onze verkiezingen, en wat we hier van hebben kunnen leren. Met de opkomst van Zaakgericht … Continue reading →

Posted in e-voting, hacking, presentation, security assessment, security awareness, software development | Comments Off on Security awareness sessie voor ambtenaren tijdens Zaakgericht Werken congres

NOS: “Zeker 15 van de 25 ziekenhuizen geïnfecteerd met ransomware”

Posted on 25-06-2017 by Sijmen Ruwhof

De NOS bericht vandaag: Zeker 15 van de 25 ziekenhuizen geïnfecteerd met ransomware Nederlandse ziekenhuizen zijn kwetsbaar voor aanvallen met een gijzelvirus. Zeker vijftien Nederlandse ziekenhuizen hebben de afgelopen drie jaar te maken gehad met zulke ransomware-aanvallen. In één ziekenhuis … Continue reading →

Posted in cyber crime, cyber terrorisme, data leakage, drive-by, interview, radio, ransomware, security assessment, security awareness, tv | Comments Off on NOS: “Zeker 15 van de 25 ziekenhuizen geïnfecteerd met ransomware”

Cqure Quick Question: over (non)scoping bij pentests

Posted on 03-02-2017 by Sijmen Ruwhof

Cqure nodigde me uit om te komen praten over de scoping van pentesten: Cqure: “Sijmen Ruwhof van Secundity vertelt deze week in de Cqure Quick Question over (non) scoping bij pentests. Sijmen vertelt in deze video dat veel pentesten in … Continue reading →

Posted in hacking, interview, pentesting, scoping, security assessment | Comments Off on Cqure Quick Question: over (non)scoping bij pentests

Websites Nederlandse politieke partijen onvoldoende beveiligd

Posted on 31-01-2017 by Sijmen Ruwhof

In de recente hack bij de Democratische Partij in de VS (toen Hillary Clinton presidentskandidate was), werden Clinton en haar partij in diskrediet gebracht doordat bijna twintig duizend interne mails van de partijtop op internet zijn geplaatst door WikiLeaks. Eerder publiceerde WikiLeaks meer … Continue reading →

Posted in e-voting, hacking, responsible disclosure, security assessment, security awareness, website security, zero day | 3 Comments

How to hack the upcoming Dutch elections – and how hackers could have hacked all Dutch elections since 2009

Posted on 30-01-2017 by Sijmen Ruwhof

As everybody has read in the newspapers, the recent American elections involved multiple and severe hacking attacks. Tens of thousands of confidential and private emails from Hillary Clinton and the Democratic National Committee (DNC) were leaked via WikiLeaks. It is thought … Continue reading →

Posted in e-voting, hacking, responsible disclosure, security assessment, security awareness, zero day | 46 Comments

How I accidentally found a huge data leak during a college lecture

Posted on 13-05-2016 by Sijmen Ruwhof

A few weeks ago I gave a guest lecture at the Windesheim University of Applied Sciences in The Netherlands. Being a Windesheim graduate myself I’ve always kept in touch with my former teachers. One of them told me recently that … Continue reading →

Posted in responsible disclosure, security assessment | 44 Comments

Epic failure of Phone House & Dutch telecom providers to protect personal data: How I could access 12+ million records #phonehousegate

Posted on 08-12-2015 by Sijmen Ruwhof

On September 11, 2015 I visited MediaMarkt in Utrecht Hoog Catherijne, a well-known electronics shop in The Netherlands. Since summer 2014, the biggest independent Dutch phone retail company Phone House also operates (white labeled) from within MediaMarkt locations as a … Continue reading →

Posted in data leakage, privacy, responsible disclosure, security assessment | 419 Comments

Full disclosure: multiple critical security vulnerabilities (including a backdoor!) in PHP File Manager

Posted on 27-07-2015 by Sijmen Ruwhof

In July 2010 I was looking for a web based file manager that I could use on my own web server. After some research I found the PHP File Manager from Revived Wire Media. A basic, but good looking web … Continue reading →

Posted in PHP security, responsible disclosure, security assessment | 36 Comments

Veiligheidsanalyse iDEAL Lite bijgewerkt

Posted on 25-02-2011 by Sijmen Ruwhof

Naar aanleiding van het overleg met Rabobank Nederland is het rapport over de iDEAL Lite voorbeeldcode bijgewerkt met nieuwe informatie.

Posted in responsible disclosure, security assessment | Comments Off on Veiligheidsanalyse iDEAL Lite bijgewerkt