My CERT PL – Free Security Tools for Everyone (in Poland)

My CERT PL – Free Security Tools for Everyone (in Poland)

Speakers: Krzysztof Zając, CERT PL

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=3-pop9JM7-4

Overview

In a compelling presentation at FIRSTCON, Krzysztof Zając from CERT PL unveiled mycert.pl, a groundbreaking national security portal designed to provide free cybersecurity tools and services to the entire Polish public. As one of Poland's three national-level CERTs, CERT PL serves a broad constituency encompassing private entities, companies, and the general public, distinct from governmental and military cyber defense operations. The mycert.pl initiative stems from a critical need identified through CERT PL's incident response experience: widespread vulnerabilities, credential leaks, and a general lack of accessible security resources, particularly for organizations with limited budgets.

The portal's development was driven by several core motivations, including the urgent need to disseminate information about existing CERT tools, broaden the scope of security scanning beyond public entities, and establish reliable contact channels for vulnerability notifications. Zając highlighted real-world incidents, such as the Polish Press Agency attack, where leaked credentials led to the publication of fake news, underscoring the tangible impact of these security shortcomings. By centralizing services like vulnerability scanning, password leak monitoring, and threat intelligence, mycert.pl aims to empower individuals and organizations across Poland to significantly enhance their cyber resilience without incurring significant costs.

This talk serves not only as an introduction to mycert.pl but also as a powerful call to action for other national CERTs, hosting providers, NGOs, and even groups of enthusiasts to replicate similar initiatives. Zając meticulously detailed the portal's features, its underlying open-source technologies, and the agile development philosophy that enabled its rapid and successful deployment. The impressive statistics presented at the conclusion of the talk—over 20,000 users, 24,000 verified domains, and more than 1.5 million identified vulnerabilities—stand as a testament to mycert.pl's profound impact and its potential as a blueprint for improving national cybersecurity on a global scale.

Background

▶ Watch: CERT PL's role and motivation for myCERT.pl (0:00)

The genesis of mycert.pl is rooted in a series of persistent challenges faced by CERT PL in its mission to secure the Polish cyber landscape. One primary driver was the recurring nature of security incidents, many of which could have been prevented with better information and proactive measures. Zając cited the alarming incident involving the Polish Press Agency, where attackers exploited leaked credentials to compromise a news portal and disseminate fake news about military mobilization. Such events underscored the critical need for mechanisms that could detect credential compromises and help organizations secure their digital assets before they became targets.

Another significant hurdle was the fragmentation of information regarding valuable security tools developed by CERT PL. These tools, while effective, were often presented at various conferences or targeted at specific audiences, making it difficult for the broader public to discover and utilize them. mycert.pl was conceived as a centralized hub to consolidate and promote these resources, ensuring they reached the widest possible audience.

A key strategic objective for CERT PL was to broaden security scanning capabilities. While authorized to scan many public entities, the CERT lacked a comprehensive view of the entire national infrastructure. Universities, for example, might have numerous subdomains, promotional sites, and network ranges unknown to CERT PL, leading to incomplete security assessments. The portal addresses this by allowing any entity—from small blog owners to large corporations—to voluntarily register their infrastructure for free, comprehensive scanning. This approach bypasses the limitations of traditional, top-down scanning mandates by leveraging user consent, thus dramatically expanding the reach of proactive vulnerability detection.

Finally, the problem of contacting entities to report vulnerabilities or incidents was a constant source of frustration. CERT PL often relied on disparate, sometimes unreliable, contact databases, leading to delayed responses or no response at all. mycert.pl was designed to collect accurate, up-to-date contact information directly from registered users, streamlining communication and accelerating vulnerability remediation efforts. By tackling these multifaceted challenges head-on, mycert.pl emerged as a holistic solution to enhance Poland's national cybersecurity posture.

Key Findings

▶ Watch: Notifying victims of password leaks from various sources (7:00)

The talk, while describing a service rather than a research project, presented compelling "findings" in the form of the initiative's success metrics and operational insights. The most significant finding is the proven efficacy and high demand for a free, publicly accessible cybersecurity platform. Within a relatively short period since its beta launch, mycert.pl has amassed over 20,000 users and facilitated the verification and scanning of more than 24,000 domains. This rapid adoption underscores a widespread, unmet need for security services among entities that may lack the resources for commercial solutions.

Quantifiable impact is another critical finding: the platform has identified over 750,000 vulnerabilities and misconfigurations, including a substantial 44,000 high-severity vulnerabilities, specifically within the infrastructure voluntarily submitted by users. When combined with CERT PL's mandated scanning of public entities, the total number of identified issues surpasses 1.5 million, demonstrating the platform's monumental contribution to national cyber hygiene. These figures highlight the sheer volume of exploitable weaknesses present in the wild and the effectiveness of a centralized, proactive scanning approach.

Furthermore, the project revealed important lessons in agile development and technology choice. Zając emphasized the success of starting small, launching early, and iteratively building features based on user feedback, rather than attempting a monolithic, perfectly planned rollout. The choice of "boring technology" like Django, PostgreSQL, and Kubernetes, eschewing modern, complex JavaScript frameworks, allowed the small development team (starting with just two people, now six) to focus on security functionality and reliability rather than debugging bleeding-edge tools. This pragmatic approach proved instrumental in achieving rapid development and deployment within less than eight months from its initial git init to public launch. The evolution of the portal's user interface, from a "pretending to be a UI designer" aesthetic to a polished design, further illustrates the principle that functionality and early user engagement can precede aesthetic perfection.

Technical Deep Dive

▶ Watch: Mapping organizational infrastructure to reduce attack surface (14:00)

The mycert.pl portal is a comprehensive suite of security tools, built on a robust, open-source-centric architecture, designed to provide actionable intelligence and remediation guidance. At its core, the platform allows users to register and verify ownership of their digital assets, including domains and subnets. Domain verification is achieved through a simple process: users either add a specific TXT record to their DNS zone or place a file with predefined content on their web server. Subnet verification, currently a manual process, requires submission of ISP documentation or referencing RIPE database entries. Once verified, these assets become eligible for a range of security services.

A cornerstone of mycert.pl is its vulnerability scanning capability. This is powered by Artameis, an open-source tool developed by CERT PL. Artameis leverages a variety of other well-known open-source tools under the hood, including Nuclei for template-based vulnerability scanning and SQLMap for detecting SQL injection flaws. The scanning modules are not static; they are dynamically informed by CERT PL's real-world incident response experience. If a particular type of attack, such as SQL injection or weak subdomain enumeration, becomes prevalent in the Polish cyberspace, CERT PL prioritizes building and enhancing corresponding detection capabilities within Artameis. The scans identify a wide array of issues, from common misconfigurations like SSL certificate problems, improperly configured SPF and DMARC records, to high-severity vulnerabilities like Remote Code Execution (RCE). Users receive detailed reports outlining the problem, affected URLs, relevant versions (e.g., outdated WordPress), and clear recommendations for remediation.

Beyond active scanning, mycert.pl offers critical password leak monitoring. This feature aggregates data from multiple sources: commercial providers specializing in breach data, publicly available breach dumps, CERT PL's own threat hunting operations, and increasingly, contributions from sectoral CERTs (such as the CERT for the Polish finance sector). When a credential compromise is detected, mycert.pl can notify affected entities. For example, if "[email protected]" appears in a dump, both the mail provider and any website owner where the credentials were used can be alerted to take preventative action, such as blocking accounts. Users registered with mycert.pl can view details of leaks affecting their domains, including the date of acquisition, publication date, source description, a fragment of the username, and the context of the login attempt if it originated from stealer malware.

The platform also provides crucial network event intelligence. Utilizing N6, an open-source network event aggregator built at CERT PL, the portal collects data from over 90 data sources, with Shadowserver being a primary contributor. These events include indicators of malware infections (e.g., attempts to connect to Command and Control (C2) servers), hosts engaged in scanning activities, or servers hosting phishing campaigns. The raw event data is enriched with contextual information, explaining what categories like "bots" mean or identifying specific malware families such as "SmokeLoader," making the information more accessible and actionable for network administrators.

Furthermore, mycert.pl serves as a central repository for security advisories, categorized for both technical (administrators) and non-technical (general users) audiences. These advisories cover a spectrum of threats, from new phishing campaigns and malware outbreaks to critical vulnerability disclosures requiring immediate patching (e.g., for Fortinet devices). Dissemination occurs through multiple channels, including the website, email subscriptions (over 10,000 subscribers), RSS feeds, and a comprehensive API, ensuring broad reach.

A unique feature is the integration with CERT PL's warning list, a large text file containing known phishing domains, scams, and fake shops. This list, supported by most major Polish ISPs for DNS-level blocking, resulted in 141 million blocked page views in 2025 (likely referring to a recent year, given the talk's context). mycert.pl allows users to check if their network, particularly corporate or institutional networks, is effectively protected by this warning list, offering configuration guidance if not.

The "Organization Infrastructure" feature provides an invaluable attack surface management overview. By analyzing scanning results, mycert.pl maps out an entity's exposed assets: domains, subdomains, open ports, IP addresses, identified login panels (e.g., WordPress, PHPMyAdmin), VPN gateways, Content Management Systems (CMS), and plugins. This detailed inventory helps organizations understand their exposure and proactively reduce their attack surface, as illustrated by the positive feedback from a corporation that used this information to address accidentally exposed login panels.

Finally, mycert.pl promotes email anti-spoofing best practices through an integrated SPF, DKIM, and DMARC check. This is powered by Mailgoose, another open-source tool developed by CERT PL, which supports multiple languages (English, Polish, Lithuanian) and is highly configurable. The goal is to encourage wider adoption of these email security mechanisms to combat pervasive spoofed email attacks. The portal also offers an API for broader integration, enabling entities to automate notifications or mirror advisories on their own platforms. The entire initiative is built on an agile development methodology, prioritizing functionality and user feedback, and relying on "boring technology" (Django, PostgreSQL, Kubernetes) to ensure stability and maintainability.

Demo / Proof of Concept

▶ Watch: Encouraging other CERTs to replicate myCERT.pl's success (18:00)

While Krzysztof Zając's presentation at FIRSTCON didn't feature a live, interactive hacking demonstration, it served as a comprehensive feature walkthrough and proof of concept for the mycert.pl portal itself. The speaker effectively demonstrated the portal's capabilities by showcasing screenshots of the user interface and explaining the workflow for various services.

Users logging into mycert.pl are presented with an intuitive dashboard where they can manage their infrastructure. Zając illustrated the process of adding domains and subnets, explaining the TXT record DNS verification for domains and the manual (currently) process for subnets. He then showed how users select assets for scanning and how the results are presented, including specific URLs, detected vulnerabilities (e.g., outdated WordPress versions, misconfigured SPF/DMARC), and clear recommendations for remediation. This visual tour highlighted the practicality of Artameis in delivering actionable security intelligence.

The demonstration extended to the password leak section, where users could see details of compromised credentials associated with their domains. Screenshots displayed information such as the date of acquisition, publication date, source of the leak, a fragment of the username, and the context if the leak originated from stealer malware. This visual evidence underscored the value of proactive monitoring for credential hygiene.

Zając also presented the network events interface, showing how N6 and Shadowserver data is enriched and displayed, allowing users to quickly identify malware infections or malicious activities originating from their networks. The security advisories section was shown with its categorization for technical and non-technical users, emphasizing the multi-channel dissemination options.

A particularly insightful part of the "demo" was the visual comparison of mycert.pl's initial landing page—described by Zając as "ugly" and the result of him "pretending to be a UI designer"—versus its current, more polished design. This served as a powerful proof of concept for the agile development philosophy: launching early with core functionality, even if imperfect, allows for immediate user feedback and iterative improvement. The initial, functional but aesthetically challenged UI proved that value delivery can precede design perfection, validating the "launch early and learn" approach. This holistic presentation successfully demonstrated the portal's robust features, user-centric design, and its proven ability to deliver tangible security benefits.

Defensive Implications

▶ Watch: myCERT.pl's impressive user statistics and Q&A highlights (24:30)

The mycert.pl initiative offers profound defensive implications, not just for entities within Poland but as a blueprint for cybersecurity agencies worldwide.

For individual organizations and users, the portal provides an immediate, free, and accessible pathway to significantly enhance their security posture. Defenders should:

• Proactively Register and Verify Assets: Organizations should register all their domains and subnets with mycert.pl (or a similar national service) to gain continuous vulnerability scanning and attack surface visibility. This moves them from reactive incident response to proactive risk management.
• Prioritize Remediation: The detailed scanning reports, identifying issues from misconfigurations (SSL, SPF, DMARC) to high-severity vulnerabilities (SQLi, RCE), provide clear, actionable steps for remediation. Prioritizing these fixes based on the provided severity ratings is crucial.
• Monitor for Password Leaks: Regularly checking the password leak feature and implementing immediate password resets for any compromised accounts is essential to prevent credential stuffing and account takeover attacks.
• Leverage Threat Intelligence: Utilizing the network event data and security advisories (both technical and non-technical) helps defenders stay informed about emerging threats, patch vulnerabilities, and educate their users about phishing and malware campaigns.
• Strengthen Email Security: Actively using the SPF, DKIM, and DMARC check, and configuring these protocols correctly, is a fundamental defense against email spoofing, phishing, and business email compromise (BEC) attacks.
• Reduce Attack Surface: The organization infrastructure view helps identify accidentally exposed services (e.g., WordPress login panels, PHPMyAdmin). Defenders should use this information to review and minimize their external attack surface.

For other national CERTs, hosting providers, NGOs, and enthusiast groups, mycert.pl presents a compelling model for national-scale cybersecurity improvement:

• Adopt User-Permission-Based Scanning: The model of obtaining explicit user consent for scanning circumvents legal hurdles often associated with broad, unsolicited network scanning, making it easier to launch similar initiatives without government backing.
• Embrace Open Source and "Boring Technology": Replicating mycert.pl's reliance on open-source tools like Artameis, N6, Mailgoose, and data sources like Shadowserver, combined with stable technologies (Django, PostgreSQL, Kubernetes), can significantly reduce development costs and accelerate deployment.
• Start Small and Iterate: The agile development approach, focusing on core features first and iteratively adding more based on user feedback, is a practical strategy for resource-constrained organizations.
• Foster Collaboration: The integration of sectoral CERTs and the open invitation for other nations to adopt and localize tools like Mailgoose highlight the importance of collaborative defense and information sharing.

Ultimately, mycert.pl empowers a broader segment of the population to actively participate in their own cyber defense, democratizing access to critical security tools and intelligence. Its success underscores that effective cybersecurity does not always require massive budgets but rather strategic, community-driven initiatives leveraging technology and collaboration.

Key Takeaways

• Democratization of Cybersecurity: mycert.pl successfully provides free, high-quality cybersecurity services (vulnerability scanning, password leak monitoring, threat intelligence) to a wide audience, including small businesses and individuals lacking dedicated security budgets.
• User-Centric, Consent-Based Scanning: The portal's model of requiring explicit user permission to scan registered domains and subnets offers a scalable and legally sound approach for national CERTs or other entities to broaden their security assessment reach.
• Leveraging Open Source for National Impact: The initiative heavily relies on open-source tools like Artameis, N6, and Mailgoose, and integrates with global threat intelligence feeds like Shadowserver, demonstrating how open-source ecosystems can be effectively utilized for national cybersecurity infrastructure.
• Agile Development and Pragmatic Tech Choices: mycert.pl's rapid and successful development (less than 8 months to public launch) was attributed to an agile approach, starting small, iterating based on user feedback, and choosing "boring technology" (Django, PostgreSQL, Kubernetes) to prioritize functionality and stability.
• Comprehensive Threat Coverage: The portal addresses a wide array of threats, from technical vulnerabilities (SQLi, RCE, misconfigurations) and credential compromise to network-level events (malware C2, scanning hosts) and user-focused advisories (phishing campaigns), providing a holistic defensive posture.
• A Blueprint for Global Replication: CERT PL actively encourages other countries and organizations to adopt and adapt their open-source tools and mycert.pl's operational model, offering assistance to foster a safer internet globally.

About the Speaker(s)

Krzysztof Zając works at CERT PL, one of the three national-level CERTs in Poland. His organization's specific constituency covers private entities, private companies, and the general public, distinguishing it from the government and military CERTs. Zając's role at CERT PL involves spearheading initiatives like mycert.pl, which focuses on developing and deploying free security tools and services to improve national cybersecurity. His expertise stems from direct experience in handling cybersecurity incidents and understanding the practical challenges faced by various organizations in securing their digital assets. He is a strong advocate for leveraging open-source technologies and community collaboration to enhance collective cyber defense.