Ethical hacking to make the internet more secure

Joining forces

"DIVD is a team of volunteers dedicated to tracing ICT vulnerabilities. Letting owners and operators know about issues without trying to take advantage of them is known as 'responsible disclosure'," explains Chris van 't Hof. "A lot of our team members were previously doing responsible disclosure work on an individual basis, but it's obviously much more effective to join forces, organise the work between us and get security investigators working together. So, in September 2019, I teamed up with Astrid Oosenbrug and Victor Gevers to found DIVD. Along with all our committed volunteers, we're now helping to make the internet more secure."

Finding and reporting vulnerabilities

"In pursuit of our shared mission, our main focus is finding general vulnerabilities on the internet. Some of the investigators on our team scan the internet for general vulnerabilities that have been making the news. The Citrix server leak that received worldwide coverage at the start of the year is a good example. Identification of the issue prompted the question: who's responsible for warning these servers' users? We decided to take on the job and set about identifying all Dutch IP addresses used for Citrix servers and scanning them for the vulnerability. We found 546 IPs linked to vulnerable servers and mailed their owners. In some cases, we don't go straight to an individual address's owner, but we approach the operator of the network that the address belongs to. After all, not everyone has heard of DIVD, but they'll generally be familiar with the operator of their network -- KPN, say. So they're more likely to trust a warning from the operator than one from us." "Once we've registered a vulnerability and alerted the owners, we'll normally go on repeating the scans until the owners put things right. We keep an eye on the process, so we know whether we need to contact the owners again," says Chris.

Dutch Security Hotline

It was the Citrix commotion that got the newly developed Dutch Security Hotline up and running. Part of the DIVD foundation, the Hotline is the central point from which the team of volunteers report the security-related issues they detect. Volunteers inform Dutch network and website operators about vulnerabilities reported to the Hotline. The Dutch Security Hotline focuses mainly on vulnerabilities with the potential to affect large numbers of users, as was the case with the Citrix server issue. The Hotline doesn't get involved with vulnerabilities that occur in just a handful of systems. "As well as finding and reporting vulnerabilities ourselves, we serve as a contact point for ethical hackers who come across issues," says Chris. "We're able to help them with our knowledge. We support younger hackers and work with people to identify ways of reporting system security flaws where possible."

Support from SIDN Fund

"Obviously the financial support from SIDN Fund is very welcome, but we also benefit from their recognition of our initiative. SIDN Fund helped us set up a volunteer organisation. For example, they highlighted the importance of the team having a shared objective and retaining energy and ambition within the project. The support from SIDN Fund has enabled us to continue professionalising and contributing to the strength of the internet." Mieke van Heesewijk, Programme Manager at SIDN Fund, is enthusiastic about what Chris and his team are doing. "The people behind DIVD are very capable and have developed an approach that enables them to pool their skill and expertise to bring a secure internet closer. DIVD is a very influential, innovative initiative."

Future research institute

"Ultimately, we'd like to develop DIVD into a proper research institute, developing fixed formats on the basis of our investigations. Formats that can help other people to carry out good scans, for example. Or that explain the types of vulnerability that can and can't readily be picked up by scanning. As an institute, we can help others do responsible disclosure work. So one of the things we plan to do in the future is set up a training course. That's something Astrid is going to oversee. The idea is both to train people to improve the security of the internet and to teach young ethical hackers the right way to contribute to internet security," says Chris. Want to know more about responsible disclosure and what it can mean for your organisation? Visit the DIVD website.