Victor Gevers

Background

Victor Gevers is a Dutch security researcher who has described himself as hacking since 1998. Over more than two decades he built a reputation within the international security community for locating exposed and misconfigured systems on the public internet — ranging from open databases to poorly secured government and corporate infrastructure — and reporting them to the responsible parties under the principles of responsible, or coordinated, vulnerability disclosure.

GDI Foundation

Gevers founded the GDI Foundation (GDI standing for "GDI.foundation"), a volunteer-driven nonprofit organization dedicated to identifying vulnerable and exposed systems and notifying their owners free of charge. The organization operates internationally, scanning the internet for weaknesses such as open databases, exposed credentials, and unpatched services, and has been credited with reporting large numbers of such cases over the years, including widescale exposures of unsecured MongoDB and Elasticsearch instances.

Founding DIVD

On September 26, 2019, Gevers co-founded the Dutch Institute for Vulnerability Disclosure (DIVD) together with Astrid Oosenbrug, formalizing coordinated vulnerability disclosure work under a Netherlands-based nonprofit. DIVD describes its mission as making the digital world safer by scanning the internet for vulnerabilities and reporting them to the people who can fix them, operating what it calls a global reach carried out "Dutch style: open, honest, collaborative, and for free." Since 2022, DIVD has held status as a CVE Numbering Authority, the first independent Dutch organization to receive that designation, allowing it to formally assign CVE identifiers to vulnerabilities its volunteers discover.

The SenseNets disclosure

In 2019, Gevers discovered and disclosed a major data breach involving SenseNets, a Chinese facial-recognition and surveillance technology company, whose exposed, unsecured database reportedly contained tracking data on an estimated 2.5 million people, many linked to surveillance of the Uyghur population in Xinjiang. The discovery drew significant international press attention to the scale of biometric and location surveillance conducted through commercially exposed systems.

The Kaseya VSA case

In early April 2021, DIVD researcher Wietse Boonstra, working under Gevers' organization, discovered and reported a set of vulnerabilities in Kaseya's VSA remote-monitoring software, including the flaw later tracked as CVE-2021-30116. DIVD worked with Kaseya for roughly three months attempting to get the vulnerabilities patched before they could be exploited. In a July 4, 2021 blog post, Gevers wrote that Kaseya had been "very cooperative" and "asked the right questions," sharing partial patches for validation, but that DIVD was ultimately "beaten by REvil in the final sprint, as they could exploit the vulnerabilities before customers could even patch," referring to the REvil ransomware gang's large-scale supply-chain attack on Kaseya VSA customers in July 2021. Gevers also noted a broader pattern DIVD had observed: that products intended to keep networks safe were increasingly showing structural security weaknesses.

Trump Twitter account access

Gevers received wide media coverage after reporting in 2020 that he had been able to log into the Twitter account of then U.S. President Donald Trump, reportedly by guessing the account's password. He was not criminally charged in connection with the incident. The episode, alongside his other disclosures, was frequently cited in press coverage as an illustration of the legal ambiguity that ethical hackers can face even when their intent is to demonstrate a security weakness rather than cause harm.

Significance and legacy

Gevers is regarded as a prominent figure in the coordinated-vulnerability-disclosure movement, particularly for his role in scaling up volunteer-driven, internet-wide scanning as an organized nonprofit activity rather than solitary research. Through the GDI Foundation and DIVD, his work has been credited with notifying the operators of large numbers of exposed systems, and DIVD's near-miss involvement in the Kaseya ransomware incident is frequently referenced as a case study in the difficulty of racing ransomware actors to patch critical vulnerabilities. His combination of high-profile disclosures and non-prosecution in cases like the Trump Twitter incident has also made him a recurring reference point in discussions of how legal systems treat unauthorized-but-disclosed access by security researchers.

Timeline

• 1998Gevers states he began hacking, later describing decades of security research activity.
• 2019-09-26Co-founded the Dutch Institute for Vulnerability Disclosure (DIVD) with Astrid Oosenbrug.
• 2019Discovered and disclosed the exposed SenseNets surveillance database in China, affecting an estimated 2.5 million people.
• 2020-10Reported gaining access to Donald Trump's Twitter account; he was not criminally charged over the incident.
• 2021-04-02DIVD researcher Wietse Boonstra, under Gevers' organization, reported the Kaseya VSA vulnerability later tracked as CVE-2021-30116.
• 2021-07-04Gevers published a blog post detailing DIVD's effort to get Kaseya vulnerabilities patched before the REvil ransomware attack exploited them.
• 2022DIVD became a CVE Numbering Authority, the first independent Dutch organization with that designation.