Skip To main content

Fyrsta villuveiðigáttin fer vel af stað

Ís­lensk fjár­mála­fyrir­tæki eru meðal þeirra sem taka þátt í villu­veiði­gátt D­efend Iceland. Nú þegar hafa heiðar­legir hakkarar fengið greitt milljónir fyrir að benda á öryggis­galla og koma fyrir­tækjum frá til­heyrandi tjóni.

Villu­veiði­gátt (e. bug boun­ty plat­forms) D­efend Iceland hefur farið vel af stað en valin leiðandi ís­lensk fyrir­tæki taka þátt í verk­efninu. Mark­miðið er að virkja heiðar­lega hakkara til að þess að finna öryggis­galla og til­kynna þá til fyrir­tækja fyrir verð­launa­fé.

„Þetta er verk­efni sem ég hef sjálfur, í mínum frí­tíma, verið að reyna koma á fram­færi í fjögur ár núna,“ segir Theó­dór Ragnar Gísla­son, stofnandi D­efend Iceland en Theó­dór hefur um­fangs­mikla reynslu í tækni­legu net­öryggi í hartnær 25 ár.

D­efend Iceland var stofnað í fyrra og hlaut verk­efnið 2,6 milljóna evra styrk frá Fram­kvæmda­stjórn Evrópu­sam­bandsins sem eru tæpar 400 milljónir króna.

Að hans mati er þetta lang­besta leiðin til að koma í veg fyrir að tölvu­glæpa­menn geti valdið tjóni en villu­veiði­gáttir eru þekkt leið til að virkja öryggis­sér­fræðinga sem herma að­ferðir hakkara við leit að öryggis­veik­leikum.

Meðal þeirra sem taka þátt eru ís­lensk fjár­mála­fyrir­tæki en hefur eitt þerra til að mynda greitt út um fimm milljónir á nokkrum mánuðum fyrir á­bendingar og lag­færingar á öryggis­göllum. „Þeim fannst þetta vera smá­munir í sam­ræmi við tjónið sem hefði annars orðið,“ segir Theó­dór.

Aðrar fréttir

Sjá allar fréttir

Multiple Landspitali Employee Domain Accounts at Risk of Compromise

This report details a critical security vulnerability discovered within Landspitalinn's systems through the Defend Iceland bounty program. A series of chained vulnerabilities and misconfigurations were identified, allowing attackers to compromise multiple employee credentials and register multi-factor authentication (MFA) to themselves.
Lesa meira

Public disclosure for a healthier cybersecurity culture

Landspitali is the leading hospital in Iceland and the largest workplace for employees in health care. It is funded by the Ministry of Welfare, supervised by the Directorate of Health and provides specialised and general care and has the capacity of approx. 700 beds. To say that it is an important organisation in Iceland is an understatement and almost every Icelander relies on their services in some way.
Lesa meira

How I found all corporate usernames in Iceland

One of my favorite methods to gain initial access to companies is finding valid credentials. If your target is just one employee, this might be near impossible. But what if you have hundreds, or even thousands of targets? What if the target victim is anyone in Iceland? Then gaining valid credentials goes from near impossible to near certain.
Lesa meira

When Retired Domains Come Back to Haunt: The Hidden Risk of Legacy Corporate Assets

Organizations evolve through mergers, acquisitions, and rebranding. Old domains get retired, but what happens when those domains can still receive password resets or act as the login email for third-party services for the previous owner? This post reveals an overlooked vulnerability we've seen through Defend Iceland's bug bounty platform: expired corporate domains that remain deeply embedded in third-party SaaS accounts. When these domains become available for registration, attackers can inherit access to SaaS accounts that still use the retired email domain for login or recovery. We'll show you exactly how this happens and why "just let it expire" is a dangerous domain retirement strategy.
Lesa meira

XSS Beyond the Perimeter: When Internal Systems Become Attack Surfaces

Cross-site scripting (XSS) is often treated as a problem that ends at the public perimeter. In reality, customer input does not stop at the landing page. It flows into CRMs, ticketing consoles, and internal dashboards that may never have faced a penetration test. This walkthrough, based on real reports to Defend Iceland, shows how a harmless contact form can compromise the helpdesk staff who read it. To illustrate the chain end to end, we built a Netbankinn-themed lab that mirrors what we see in production environments. The public site is squeaky clean. The internal system is not,
Lesa meira

Where Unicode Collation Meets Punycode Domains: A Zero-Click Account Takeover

This post explains a subtle Unicode/Punycode pitfall that can appear in modern authentication flows. It highlights how a normalization mismatch enabled a zero‑click account takeover (ATO) scenario and how to remediate it safely. This vulnerability was reported through Defend Iceland's bug bounty platform, affecting one or more customers. The independent security research surfaced a subtle authentication quirk worth sharing with the broader community. For engineers, it's a clear lesson about the intersection of database collation and internationalized domains creating unexpected attack vectors.
Lesa meira

Þessi vefsíða notar vefkökur (e. cookies) til að bæta upplifun notenda af síðunni.