-
Recent Posts
Recent Comments
- MediaMarkt in The Wall gaat te slordig om met persoonsgegevens - Leidsche-Rijn on Password database of MediaMarkt leaks again
- Cine se afla in spatele protestelor #REZIST & Chilotareala on Massive child porn site is hiding in plain sight, and the owners behind it
- Photos d'enfants sur les réseaux sociaux | Cmic Blog on Massive child porn site is hiding in plain sight, and the owners behind it
- Pierre Dekan (via Twitter) on Massive child porn site is hiding in plain sight, and the owners behind it
- avocatnet.ro (via Twitter) on Massive child porn site is hiding in plain sight, and the owners behind it
Archives
- July 2018
- June 2018
- May 2018
- April 2018
- March 2018
- February 2018
- January 2018
- December 2017
- November 2017
- October 2017
- September 2017
- August 2017
- July 2017
- June 2017
- May 2017
- April 2017
- March 2017
- February 2017
- January 2017
- December 2016
- October 2016
- July 2016
- June 2016
- May 2016
- March 2016
- February 2016
- January 2016
- December 2015
- November 2015
- October 2015
- July 2015
- March 2015
- February 2015
- November 2014
- September 2014
- September 2012
- July 2012
- May 2012
- March 2012
- October 2011
- September 2011
- August 2011
- July 2011
- June 2011
- May 2011
- February 2011
- January 2011
- December 2010
- September 2010
- June 2010
- April 2010
- March 2010
- August 2006
- January 2005
- July 2004
- January 1970
Categories
- advertising
- analysis
- anti-virus
- Apple
- article
- backup
- banking
- browser security
- bug
- camera
- child porn
- computer worm
- copyright
- credit card
- critical infrastructure
- cross site scripting
- cyber crime
- cyber security
- cyber terrorisme
- cyber warfare
- data leakage
- ddos
- deanonymization
- demonstration
- discussion
- drive-by
- e-voting
- election hacking
- fake profiles
- hacking
- ICT
- identity theft
- interview
- jargon
- javascript
- law enforcement
- legal
- magazine
- media
- menu
- online banking
- online dating
- osint
- password
- pentesting
- phishing
- PHP
- PHP security
- podcast
- presentation
- privacy
- process improvement
- radio
- ransomware
- responsible disclosure
- russia
- SAP
- scam
- scoping
- search engine optimization
- security
- security assessment
- security audit
- security awareness
- security management
- security vulnerability
- seo
- SNS Bank
- software development
- test
- tv
- Uncategorized
- vulnerability management
- w3c
- website
- website security
- WiFi
- wiretapping
- workshop
- zero day
Meta
Category Archives: website security
Security assessment of Dutch election software
Last month I started an independent security assessment on the software that totalizes votes in the upcoming Dutch elections on March 21, 2018. The software is called OSV (Ondersteunende Software Verkiezingen) and made by German company IVU Traffic Technologies AG. … Continue reading
Posted in critical infrastructure, cyber warfare, e-voting, hacking, responsible disclosure, security assessment, tv, website security
Comments Off on Security assessment of Dutch election software
Websites Nederlandse politieke partijen onvoldoende beveiligd
In de recente hack bij de Democratische Partij in de VS (toen Hillary Clinton presidentskandidate was), werden Clinton en haar partij in diskrediet gebracht doordat bijna twintig duizend interne mails van de partijtop op internet zijn geplaatst door WikiLeaks. Eerder publiceerde WikiLeaks meer … Continue reading
Hoe hackbaar zijn onze politieke partijen?
NOS’ Nieuws & Co vroeg mij hoe hackbaar onze politieke partijen zijn. In opdracht van de NOS deed ik een snelle steekproef en keek in naar hun websitebeveiliging. Luister het complete Radio 1 fragment terug op: Update 13 januari 2017 … Continue reading
Posted in interview, radio, website security
Comments Off on Hoe hackbaar zijn onze politieke partijen?
Access to 250,000+ event tickets and personal details
In today’s episode of the insecure internet I present you the company Ticketscript. This event ticketing company provides tools and features to make selling tickets for events easier. According to their website: “[..] Ticket buyers are your biggest asset. Why … Continue reading
Hack demonstration at the WatchGuard symposium
Last week I demonstrated on the WatchGuard symposium how you can break into a website and into WiFi connections from mobile phones. It’s always very awesome to see the disbelief first on one side and then the enthusiasm from attendees … Continue reading
Posted in presentation, security awareness, website security, WiFi
Comments Off on Hack demonstration at the WatchGuard symposium
Interviewed by Lock Me Down podcast
Max McCarty from Lock Me Down podcast interviewed me for an hour (view the show notes) and we talked about web security and how software developers can improve it:
How I could hack internet bank accounts of Danish largest bank in a few minutes
In August I visited the Chaos Communication Camp near Berlin. Once every four years this great and world’s greatest hacker festival is organized. I spoke with a couple of cool Danish hackers there and we talked about internet security and … Continue reading
Posted in responsible disclosure, website security
183 Comments
Lukt het om in te breken in de website van Massa Media?
Die vraag stelde een TV-ploeg van RTV Utrecht mij:
Posted in hacking, website, website security
Comments Off on Lukt het om in te breken in de website van Massa Media?
Mitigations against critical universal cross-site scripting vulnerability in fully patched Internet Explorer 10 and 11
This week David Leo disclosed a critical universal cross-site scripting vulnerability in fully patched Microsoft Internet Explorer 10 and 11 (from now on called the UXSS leak). He notified Microsoft on October 13 last year, but Microsoft didn’t publish a … Continue reading
2.364 Nederlandse bedrijfswebsites met ernstige beveiligingslekken
Toen ik in oktober 2012 op internet op zoek was naar een nieuwe auto, kwam ik een autobedrijf tegen waar ik een auto wou gaan kopen: (bovenstaande website is van een willekeurig bedrijf uit de lijst die ik later beschrijf) … Continue reading
Wat is een veilige aanpak voor downloadscripts?
Via een forum post op PFZ.nl kwam ik de onderstaande vraag tegen. Uit de beveiligingsscans die ik op websites uitvoer, zie ik vaak de onderstaande aanpak terug komen. Daarom leek het mij nuttig om deze casus ook via de weblog … Continue reading
Posted in website security
Comments Off on Wat is een veilige aanpak voor downloadscripts?
Hoe Knuz.nl het lekken van gegevens over 280.000 leden had kunnen voorkomen
Zojuist las ik een bericht op www.security.nl dat de datingsite www.knuz.nl persoonlijke gegevens lekt van 280.000 leden: “Door een fout in de inlogprocedure waren de privégegevens van 280.000 leden van de gratis datingsite Knuz.nl voor enige tijd voor onbevoegden toegankelijk, … Continue reading
Posted in website security
3 Comments