Securax

Securax (1998–2002) was considered as one of Belgium's strongest hacking movements in the past twenty years and was founded by Filip Maertens and co-founded by Davy Van De Moere as an online community in order to combine skills and experiences in the domain of vulnerability identification, zero-day exploit creation and penetration testing methods. The movement was known for its critical insights into the information security industry, bold press interviews and its near-daily newsletter (in Dutch).

At its peak, the newsletter was read by over 90,000 Dutch-speaking readers, both professionals and non-professionals. As of September 1999, companies could make use of the knowledge by way of "legal intrusion tests", where Securax assembled high quality and very skilled Tiger Teams to perform the projects. It was as of May 2000 that Securax made the choice to walk the thin line between attaining a community of security experts and hackers, while offering commercial services at enterprise level. In 2002 the community was disbanded.

Origins

Filip Maertens and Davy Van De Moere met as teenagers, after Maertens gained unauthorised access to a bulletin board system that Van De Moere ran. By the age of eighteen the two had set up an Internet Relay Chat channel named Securax, which grew into a gathering point for the emerging Belgian hacker community; Bloomberg Businessweek reports that it counted close to 100,000 subscribers at its height. The criminologist Rafael Rondelez likewise describes the channel as the digital meeting place of that community.

The initiative moved from a chat channel to a public organisation in 1999. Ahead of the launch an anonymous spokesperson told Gazet van Antwerpen that the website would go live on 17 September 1999, and that the organisation meant both to assemble detailed technical material on intrusion techniques and to serve as a point of contact with the press, speaking for Belgian hackers as well as for companies whose systems had been breached.

Website and publications

The site at securax.org carried the tagline belgian.networking.security and set out its remit under three headings: discussion forums for the Belgian scene, hosting for Belgian scene and security groups, and a newsletter on information technology and network security. Eight other Belgian groups were hosted on the domain, and the site credited two webmasters working under the handles "neo" and "vorlon". Alongside the forums the site maintained a vulnerability database and an archive of exploit code and security tooling.

The Dutch-language newsletter was summarised on a recurring basis by the Netherlands security news site Security.NL, which reproduced the vulnerabilities and industry items covered in individual issues.

Vulnerability research

Members published a numbered series of security advisories, running up to Securax-SA-22, which were distributed through the Bugtraq mailing list and archived on the group's own site. Each carried a header repeating the site's tagline.

The second advisory described a buffer overflow in Windows 98 triggered by unusually long filename extensions, and was posted to Bugtraq on 21 April 2000 by a member using the handle Zoa_Chien. The ninth reported a directory traversal flaw in the Serv-U FTP server, circulated on 5 December 2000 and catalogued as CVE-2001-0054, for which the Bugtraq posting is cited as the originating reference.

Three further advisories, among them one describing a means of freezing an X Window System server, were released on 1 January 2001 and drew follow-up discussion on Bugtraq from other researchers, including Michał Zalewski. The twenty-first advisory, on weak password encryption in the GlobalSCAPE CuteFTP client, was listed in the security handbook Mac OS X Maximum Security. The twenty-second, describing a method of forcing users to be added automatically to an ICQ contact list, appeared on 23 August 2001 and is catalogued as CVE-2001-1305.

Public role in Belgium

From the outset the organisation presented itself as distinct from intrusion carried out for criminal ends. Speaking to Gazet van Antwerpen in August 1999, its spokesperson criticised Frans Devaere, who operated under the handle ReDaTtAcK, for failing to notify the companies whose systems he had entered and for relying on techniques long familiar within the community, and put the number of what he called genuine hackers in Belgium at several hundred.

The group was regularly approached by Flemish media for comment on security incidents. After the ILOVEYOU worm spread in May 2000, its spokesperson told Het Belang van Limburg that members had examined the code the same day and found it soundly built, judged it likely to be the most damaging virus released to that point, estimated that close to ninety per cent of large European companies had been obliged to deal with it in some form, and doubted the claim in the message that its author was a student in Manila. He argued in the same interview that corporate network protection remained inadequate, recommended that firms re-examine their firewall configurations, and predicted that the scale of the incident would encourage imitators.

Commercial services

From September 1999 companies and private individuals could ask the organisation to attempt to compromise their systems. Some services were offered without charge, while on-site testing was expected to be billed. Writing in 2021, Trends stated that Maertens had set up Securax in 1998 and that it had acquired a reputation for penetration and intrusion testing. Both founders were subsequently engaged by Ernst & Young to audit corporate networks.