Polish internet infrastructure vulnerable to cyberattacks, researchers warn
What's the story
Polish security researchers Robert Kruczek and Kamil Szczurowski have discovered major vulnerabilities in their country's public internet infrastructure. At the Def Con cybersecurity conference in Las Vegas, the duo revealed that over 10,000 public entities and 250,000 websites are susceptible to cyberattacks. The affected sectors include critical services such as airports, hospitals, and government offices.
Exploitable vulnerabilities
Researchers explain reasons behind vulnerabilities
The researchers attributed these security risks to buggy software from vendors and the absence of bug bounty programs or reporting channels for security flaws.
They noted that some vulnerabilities were extremely easy to exploit but weren't always taken seriously by vendors who dismissed them as mere inconveniences.
This negligence could potentially expose Poland's public services to hijacks and other cyberattacks.
System breach
Unauthorized access to over 300 public websites
The researchers also found critical vulnerabilities in the widely used content management system, Pad CMS.
The flaws enabled them to gain unauthorized access to over 300 public websites without any password.
This was possible because the software developer had not patched it as it had reached its "end of life" and was no longer supported.
Judicial breach
Access to two-thirds of Poland's judiciary
Another vulnerability discovered by the duo gave them access to the websites of about two-thirds of Poland's judiciary, or some 245 courts.
They reported their findings through various official channels to ensure that these critical vulnerabilities were addressed.
Despite the challenges faced during this process, they believe their efforts have made Poland's public internet infrastructure "a little bit more safe."