California & Florida Voter Websites Vulnerable To Hackers

Two cyber security firms sent the Department of Homeland Security (DHS) a troubling report in July this year that described a possible vulnerability in the online voter registration systems in dozens of counties in California and Florida. 

Many states, including Florida, make voters' information, including their names and party affiliations, easily accessible to members of the public who request it. Iranian intelligence was responsible for a recent campaign of emails sent to intimidate Florida voters, the FBI announced recently, adding that Russia was also working to influence the election

Now the Director of National Intelligence John Ratcliffe has announced that Russian and Iranian hackers had used some voter registration information in a bid to send misinformation to voters and sow discord ahead of the election. 

Both Iran and Russia had obtained some Americans' voter registration information, Ratcliffe said. Last year, a cybersecurity company found a software flaw in Riverside County in California voter registration lookup system, which it believes could have been the source of the breach.

The cyber security company, RiskIQ, said it was similar to the vulnerability that appears to have allowed hacks by Russian military hackers.The election threat report that flagged the vulnerability was written by cybersecurity experts  RiskIQ and  Northrop Grumman compared voter registration websites around the country with those that appeared to have been hacked in 2016. 

Administration officials have confirmed publicly that they believe that several counties in Florida, the State of Illinois Board of Elections, and possibly several counties in California had been victims of a hacking campaign four years ago.

The RiskIQ / Northrop Grumman report found that dozens of counties in Florida had voter registration websites that had lots of similarities to those in Riverside County in 2016. The report also raises the concern that these Florida counties could potentially be even more vulnerable than Riverside County was four years ago because they all share the same website management system. So if a hacker is inside one website he or she could have access to all the others too. 

In May, the FBI briefed Florida lawmakers on which of their 67 counties were successfully breached back in 2016. The officials were not allowed to divulge what they had learned, but they stressed that there was no evidence that cyber attacks changed any votes. "The actors got loud and essentially shut down the voter registration database, and that called attention to the problem," said Neil Jenkins, Chief Analytic Officer at the Cyber Threat Alliance

The report also looked at the websites' vulnerability to a particular kind of hack, something called a Padding Oracle Exploit (POE)  It was popular with hackers over a decade ago and is used to decrypt encrypted information. One of the concerns laid out in the report is that bad actors could use a POE to decrypt credentials to give themselves administrator access to the voter registration website.

Armed with this type of access hackers could potentially plant malware, change code, and even insert errors into the data.

The report also said, however, that the websites could have been compromised before the migration happened. The last voter website to migrate to a new operating system did so in 2019. The report says that the DHS do an audit of the Florida voter registration websites to make sure some vulnerability didn't accidentally slip in. However, DHS officials might hesitate to address details of the report or contact local officials about its findings because they haven't seen any indication that this hack is imminent.

As a general matter, local officials are unlikely to patch their systems against a possible vulnerability this close to the election. The last thing election officials would want to do just a week before their big day, he said, is to patch a website against a vulnerability that might not be severe and then find themselves watching helplessly when the patch makes their website crash. 

NPR:      NBC News:      Tallahassee Democrat:        NBC:   

You Might Also Read: 

Foreign Influence In The American Election Of 2020 Is Declining

 

« Cyber Spying Laws Are Changing
Securing AI In Military Systems »

Perimeter 81

Directory of Suppliers

Cylance Smart Antivirus

Cylance Smart Antivirus

An antivirus that works smarter, not harder, from BlackBerry. Lightweight, non-intrusive protection powered by artificial intelligence. BUY NOW - LIMITED DISCOUNT OFFER.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

WEBINAR: How To Build A Security Observability Strategy In AWS

WEBINAR: How To Build A Security Observability Strategy In AWS

Thursday, Apr 22, 2021 - Join this webinar to learn how to build a security observability strategy in AWS, covering cloud-native monitoring sources, guardrails, and automation capabilities.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

Perimeter 81

Perimeter 81

Perimeter 81 is a Zero Trust Network as a Service designed to simplify secure network, cloud and application access for the modern and distributed workforce.

CyLab - Carnegie Mellon University

CyLab - Carnegie Mellon University

CyLab is a world leader in both technological research and the education of professionals in information assurance, security technology, business and policy.

Mitek Systems

Mitek Systems

Mitek's global mobile capture and identity verification technology optimizes the digital user experience for thousands of financial services organizations.

SureVine

SureVine

Surevine builds secure, scalable collaboration solutions for the most security conscious organisations, enabling collaboration on their most sensitive information.

Belden

Belden

Belden is a global leader in signal transmission and security solutions for mission-critical applications in enterprise and industrial markets. Belden brands include Hirschmann and Tofino Security.

Secure Cloudlink

Secure Cloudlink

Secure Cloudlink solves online security by taking a new and inherently different approach to stop the wrong people gaining access to your digital systems.

Council to Secure the Digital Economy (CSDE)

Council to Secure the Digital Economy (CSDE)

CSDE brings together companies from across the ICT sector to combat increasingly sophisticated and emerging cyber threats through collaborative actions.

Angel Kings

Angel Kings

Angel Kings offers a focused cybersecurity accelerator and incubator research labs for top-ranked cybersecurity startups and early-stage companies.

Calypso AI

Calypso AI

Calypso AI build software products that solve complex AI risks for national security and highly-regulated industries.

Mjenzi Cloud

Mjenzi Cloud

Mjenzi Cloud is a provider of cloud IaaS solutions including managed backup services, affordable & secure cloud virtual compute/storage/compute services, bare-metal services and cloud security.

QuoIntelligence

QuoIntelligence

QuoIntelligence experts can help your team understand the evolving cyber threats and provide simple yet comprehensive recommendations so you can focus on what matters.