Latest articles

5 lessons learned from the breach

This week, identified that their server infrastructure got compromised. is the reference server of the open Matrix protocol used for real-time communication. People reacted differently: some tried to defend since it is offering an open and decentralized communication platform, others stated that is a security mess, and that they will stay with XMPP or their favorite instant messaging protocol. While still recovers from the data breach, it seems to be already clear that this breach was possible due to human error and organizational shortcomings.

In this article, we discuss lessons learned from the data breach that are important for everyone.

UltraVNC – a security nightmare

UltraVNC is open-source software to remotely control other systems and visually share desktops. If you look at its track record, it looks great: only 7 security vulnerabilities in 13 years. However, this month, Kaspersky published not only one newly-found vulnerability in UltraVNC, not two, not five, but 22 security vulnerabilities (KLCERT-19-003 to KLCERT-19-024) that all have their own CVE identifiers. Most vulnerabilities come with a CVSS v3.0 base score of 10.0 out of 10.0, which means that it can’t be worse anymore.

The official website and forum of UltraVNC aren’t better: there is no HTTPS, there are no modern security features, there was a file containing secrets, and the CMS is obviously totally outdated. In this article, we show several vulnerabilities of to raise awareness about insecure websites.

/e/ – privacy-enabled Android ROM, or Evil Corp?

Last November, LineageOS dropped support for more than 20 smartphones, leaving them vulnerable to future flaws in Android. Unfortunately, this also affected one of our 5 cell phones used for testing apps. We started to look for a replacement, and in January, we spotted the French /e/ Foundation that promises a privacy-enabled smartphone operating system.

In this article, we briefly look at the features offered by the /e/ Android ROM, and whether there is actual “better data privacy and data security for individuals and corporations” as promised by /e/.