Polish security researchers find thousands of public entities vulnerable to cyberattacks

Widespread Vulnerabilities Discovered

Security researchers Robert Kruczek and Kamil Szczurowski presented findings at Def Con detailing extensive cybersecurity vulnerabilities across Poland's public internet. Their research uncovered more than 10,000 public entities and 250,000 websites with security flaws, affecting critical services such as airports, hospitals, and government offices.

Specific Flaws and Vendor Response

The researchers identified issues stemming from buggy software from various vendors and a lack of bug bounty programs or clear reporting mechanisms. One significant finding involved critical vulnerabilities in Pad CMS, a widely used content management system. These flaws allowed access to over 300 public websites without requiring a password. The developer of Pad CMS did not patch the software, stating it was 'end of life' and no longer supported.

Impact on Judiciary and Public Services

Another vulnerability discovered by Kruczek and Szczurowski granted them access to the websites of approximately two-thirds of Poland's judiciary, encompassing about 245 courts. The researchers noted that some easily exploitable bugs were not taken seriously by vendors, who sometimes described the bug reports as mere inconveniences.

Context of National Cybersecurity

This research comes as Poland is actively working to strengthen its cyber defenses following a series of suspected Russian cyberattacks targeting its energy and water providers. Some of these previous attacks exploited existing cybersecurity weaknesses. The researchers reported their findings to the Polish government through official channels, aiming to contribute to national security improvements.