Latest articles

UltraVNC – a security nightmare

UltraVNC is open-source software to remotely control other systems and visually share desktops. If you look at its track record, it looks great: only 7 security vulnerabilities in 13 years. However, this month, Kaspersky published not only one newly-found vulnerability in UltraVNC, not two, not five, but 22 security vulnerabilities (KLCERT-19-003 to KLCERT-19-024) that all have their own CVE identifiers. Most vulnerabilities come with a CVSS v3.0 base score of 10.0 out of 10.0, which means that it can’t be worse anymore.

The official website and forum of UltraVNC aren’t better: there is no HTTPS, there are no modern security features, there was a file containing secrets, and the CMS is obviously totally outdated. In this article, we show several vulnerabilities of uvnc.com to raise awareness about insecure websites.

/e/ – privacy-enabled Android ROM, or Evil Corp?

Last November, LineageOS dropped support for more than 20 smartphones, leaving them vulnerable to future flaws in Android. Unfortunately, this also affected one of our 5 cell phones used for testing apps. We started to look for a replacement, and in January, we spotted the French /e/ Foundation that promises a privacy-enabled smartphone operating system.

In this article, we briefly look at the features offered by the /e/ Android ROM, and whether there is actual “better data privacy and data security for individuals and corporations” as promised by /e/.