Perhaps surprisingly, we already do this in the UK. Public-facing side of the security services are all over it.
I get emails from the German Federal Office for Information Security (BSI) via hetzner letting me know if I have db ports open etc.
SecurityBaseline.eu
71–80 of 112 posts
Re: SecurityBaseline.eu
#72Earlier quoted context omitted.
How is the home of chaos computer club so bad at this....
It is only this degree of malice and incompetence that can give rise to something like the CCC.
Yeah it does feel like much tech competence that sprouts in Germany is either sequestered off and penned in, and/or leaves the country.
Re: SecurityBaseline.eu
#73Earlier quoted context omitted.
Might be worth enclosing that URL in quotes or using [dot] in the URL instead, so people don't accidentally click on that "mortal-kombat-2-cs.pdf" file that Europa.EU is hosting. VirusTotal claims the PDF file is clean, but I don't think I'd fully trust it anyway. If you do find malicious content, could be worth submitting the URLs to VirusTotal so that the domain is flagged by browsers (eg Google SafeBrowsing) and p…
> people can't accidentally visit ec.europa.eu domains until it has been cleaned Just to be safe, couldn't we globally disable BGP and internet transit in general in the meantime? In case someone tries to visit it by other means?
Oh man, I didn't think of that! You're right, disabling BGP is a better approach.
Although a narrower approach might just be to MITM SSL connections of the general European public. Then you can check if any of those visits are to ec.europa.eu, and either block it outright, or keep a record of people who visited the website. You've already got their IP from the tracking cookies europa.eu drops before asking cookie permission, and you want to make sure you inform them of compromise. It shouldn't be too hard to lookup the citizen's postal address, it's probably in one of those ec.europa.eu databases that was left in a public AWS bucket. [1]
[1] https://www.bleepingcomputer.com/news/security/european-comm...
Re: SecurityBaseline.eu
#74Might this be because any kind of genuine pentesting, unless it's explicitly been paid for, is highly illegal in countries like Germany (§ 202c StGB, § 202a StGB, etc.)? For example, I'd be more than happy to pentest some govt websites here in Germany, if the very act of visiting them with a non-standard browser couldn't somehow already be misconstrued as breaking various hacking laws. No thanks! Keep your security v…
As a German I fear the only way I can see one of our government agencies to react upon an external pentesting report is if you threatened to release data from it, anyway (this is not a recommendation, please don't raid my home). I just do not see them fixing even a dangerous bug if a stranger came along and told them to.
Thats far from reality. Just use the online form of BSI for disclosure. They contact the affected party for you. This way you optionally can stay anonymous and the vulnerabilities get fixed because BSI appears as the messenger.
Re: SecurityBaseline.eu
#75Today we launch SecurityBaseline: monitoring 67.000 governments and 200.000 sites. Headlines: 3.000 governmental sites use tracking cookies illegally, over 1.000 database management interfaces are publicly reachable, 99% of governmental email is poorly encrypted.
Tiny request that you probably can't do anything about - but despite this page being in English, the HTML is incorrectly reporting it as lang="nl-NL" in the first line of the source. There's a few other hreflang="nl" floating around pointing to English pages as well.
(Only noticed because I have a tiny indie search engine that can only index English right now, and the "nl-NL" is causing the page to be misclassified.)
Weird niche bug report aside though - love to see this project, congratulations for working on this. I think it's a great idea.
I'd personally love to see a closer look on government sites that drop cookies before the consent banner has asked permission to do so. I'm not worried about cookies, but if we're going to ignore the consent banner anyway, why waste everyone's time with asking in the first place.
Re: SecurityBaseline.eu
#76Might this be because any kind of genuine pentesting, unless it's explicitly been paid for, is highly illegal in countries like Germany (§ 202c StGB, § 202a StGB, etc.)? For example, I'd be more than happy to pentest some govt websites here in Germany, if the very act of visiting them with a non-standard browser couldn't somehow already be misconstrued as breaking various hacking laws. No thanks! Keep your security v…
It's a good way to ensure that people outside of Germany pentest German sites instead :D
Re: SecurityBaseline.eu
#77Interesting data set. Would be interesting to repeat the same for SMEs. In my experience, Germany is pretty hopelessly behind on everything except GDPR enforcement. They are kings of that. Must have a cookie screen, apparently. That's why they score so good on that and not much else. When the GDPR became active eight or so years ago, we got a few GDPR related requests to our service. Basically strongly worded request…
> Germany is pretty hopelessly behind on everything except GDPR enforcement.
Re: SecurityBaseline.eu
#78At least for Hungary most of these are totally random websites with no connection to the government at all. 4/4 of the "region" websites are very random and all "district" sites seem to be pointing to a single decomissioned/archived site. The other lists I only spot-checked but they contain a mix of government sites and local news sites.
I don't see how such thing could go out in the public calling out government security when they didn't do the bare minimum of checking if the sites they "monitor" are truly governmental sites.
Re: SecurityBaseline.eu
#79Earlier quoted context omitted.
In most (all?) European countries comma is the decimal separator
I skimmed https://wikipedia.org/wiki/Decimal_separator but still don't understand. Why does this difference exist? Also, why did the conflict eventually settle into something between full stops and commas? What stopped other symbols from continued usage like bars or underscores? It seems weird that a system would eventually settle on just full stops and commas, yet not settle on where to put them. If your system is g…
Because in English you say "three dot two", whereas in German it is "Drei-Komma-Zwei".
It just reflects the spoken language. And having the unused symbol then be the thousand separator is natural.
Re: SecurityBaseline.eu
#80Can we start using a comma as a thousands separator instead of a period?
Oh, sweet summer child...