8 ms·
U.S. Election Agency Breached by Hackers After November Vote
- shakna 10y agoBobby Droptables! How is SQL vulnerabilities like this still happening to systems that need to be secure?
- ryandrake 10y agoBuilt by the lowest bidder?
- godzillabrennus 10y agoWho then outsourced the work to Russia and China.
- brian-armstrong 10y agoIt seems obvious to us, but computer literacy in out country (and the world) is quite low. I think this underlines how bad it is. Can you imagine if the English literacy rate were only a few %? It wouldn't be uncommon to hear of people doing strange things since they wouldn't be able to read warning signs.
- shakna 10y agoYou're right, but it is depressing. I find it akin to hiring a librarian who cannot read. Either because they're cheap, or they have the right friends.
- brian-armstrong 10y agoIn this case, I think it's probably because most librarians can't read, or at least many in publicly funded libraries. It's hard to point to one illiterate librarian when their colleagues are also illiterate.
- hota_mazi 10y ago> Can you imagine if the English literacy rate were only a few % People would start to confuse "your" and "you're" or "its" and "it's". Quite a scary thought.
- ScottBurson 10y agoWe would definitely be lead into the abyss.
- KennyCason 10y ago> People would start to confuse "your" and "you're" or "its" and "it's". I am genuinely trying to determine if this is a joke. :) People already do confuse those! I have unfortunately seen many arguments on Facebook over the correct usage.
- hota_mazi 10y agoSince I was downvoted, you're not the only one who fails to detect e-sarcasm :-)
- jamaicahest 10y agoI think the point is this is not reddit, jokes not very constructive in a debate, however funny.
- KennyCason 10y ago:) In hindsight it should have been pretty obvious haha.
- Ar-Curunir 10y agoThis is pretty much almost already the case for mathematics; understanding of basic mathematical concepts in the general public is piss poor. No one is up in arms about that.
- rbanffy 10y agoAnd what the hell is a computer illiterate doing putting together a website?
- sasas 10y agoSome ideas - - Outsourcing offshore to lower costs through a 3PP - Junior developers with inadequate training - Sheer incompetence Incompetence can be extended to management - i.e. a lack of policies and auditing to undertake due diligence. Sometimes SQLi isn't always obvious even if they are aware of the attack vector if the developer is not thinking defensively. For example inputs from a cookie or HTTP headers such as HTTP referer etc.
- Mtinie 10y ago4) Intentional negligence.
- kuschku 10y ago> "Sometimes SQLi isn't always obvious" Pretty simple: 100% of the time use prepared statements, NEVER build an SQL query yourself. Tada, 0% SQLi.
- UncleMeat 10y agoYet researchers have actually investigated the problem of automatically generating prepared statements from existing code and it turns out to be weirdly challenging. The problem isn't that some people are idiots. The problem is that we, as an industry, don't have great security solutions.
- sasas 10y agoIn the words of Bruce Schneier - "Security is a process, not a product" [1] Process that could help mitigate this bugs - - Security / safe coding training - Code audits - Testing - static and dynamic - Policies that are communicated such as "Always use prepared statements" or "use X framework" [1] https://www.schneier.com/crypto-gram/archives/2000/0515.html https://www.schneier.com/crypto-gram/archives/2000/0515.html
- 234dd57d2c8db 10y agoWhile this is true, the developer implementing this can still make a mistake. I've seen (esp. on long multiline queries that get modified over some time), a mix of prepared variables for things like userids and string concat for things like table names but the dba or the dev doesn't realize the attacker has control over the table name due to how they are handling user input on that particular endpoint. Maybe the table name is passed in on one endpoint because it's old and janky. Then it fools people because they see it's a str passed to prepared statement func and assume it's safe. I've seen this in some place in a large number of the apps I've worked on.
- Animats 10y agoPHP. It's just too easy to do it wrong in PHP.
- pvg 10y agoIt's not just PHP. It's too easy to do in many languages. It almost seems odd there isn't a 'libsodium but for DB access' or 'linter that makes your CI server explode on dangerous DB API use'. Things like that don't have to be foolproof but they'd be better than the current anything-goes default.
- int_19h 10y agoIt's easy to do in any language/framework which accepts raw strings as SQL input. Which is pretty much all of them, except for ORMs and similar (and even those usually have an escape hatch, which sufficiently lazy/clueless developers can and will find eventually). If a raw string is allowed, then the standard facilities - string concatenation, formatting etc - can be used to write injection-vulnerable code. The only mitigation that does not require educating the end developers is to completely banish strings from the API, and require everything to go through a DSL layer instead. Said layer can then ensure that all values are properly quoted and/or parametrized prepared statements are used as needed.
- pvg 10y ago"Said Leopard to Baviaan (and it was a very hot day), "Where has all the game gone?" And Baviaan winked. He knew. Said the Ethiopian to Baviaan, "Can you tell me the present habitat of the aboriginal Fauna?" (That meant just the same thing, but the Ethiopian always used long words. He was a grown-up.)"
- stephenr 10y agoBy the same token, the Texas Chainsaw Massacre is the fault of Makita because chainsaws just make it too easy to go on a murderous rampage.
- 10y ago
- intransigent 10y agoBecause many developers don't honestly believe that SQL represents a code execution boundary. Much of the time, the tendency is to think of SQL as simple I/O with a disk. And one rarely needs to worry about escaping interpretted expressions when streaming into and out of an I/O pipe. They don't think of it as "executable code" because of the limited and monotonous nature of CRUD operations typically associated with data persistence. They just think of it as yet another inconvenient form of declaritive data already at rest. Perhaps akin to mark-up. Raw data, like XML. With JSON, some developers innately clue themselves in, because JavaScript, but they don't honestly understand the root of the hazard. They're just thinking FIRE BAD! Then they hack some JSONP into place because it's fun to do that sort of thing. Most novice developers (my younger self included, tisk tisk) strongly resist protections against even HTML injection, until they see a massacre play itself out in the real world, when someone drops the ball.
- eganist 10y agoThis is also why smart money in appsec is focused on langsec and framework-integrated security controls, such as by forcing security patterns (e.g. html-context output encoding) by default and by compelling developers to work harder or, should they decide to break the rules, to do so more visibly.
- eganist 10y ago("work harder to be wrong" specifically)
- xapata 10y agoReading XML ain't secure against malicious data either.
- int_19h 10y agoI don't know why you're downvoted, because this is exactly correct. https://www.vsecurity.com//download/publications/XMLDTDEntityAttacks.pdf https://www.vsecurity.com//download/publications/XMLDTDEntit... Granted, most modern parsers disable the features that can trigger this by default. But there's still a lot of code out there compiled against libraries that did not, and some of that code is still updated and extended today.
- atecle 10y agoA combination of: 1. Incompetent contractors 2. Well-meaning non-technical hiring managers with slim budgets 3. Talent that's not lining up to work for the gov't because it's most definitely awful compared to the opportunities available The story of the US gov't dismal IT infrastructure. In 2017, IT budget is projected to be 90 billion. https://www.whitehouse.gov/sites/default/files/omb/budget/fy2017/assets/fact_sheets/Smarter%20IT%20Delivery.pdf https://www.whitehouse.gov/sites/default/files/omb/budget/fy... How much of that do you estimate is wasteful? It'd sure be nice to register to vote/get healthcare/etc on my phone.
- closeparen 10y agoBecause no part of "securing an enterprise network" includes any meaningful filter on the shitty software the organization is going to buy and run. If something "needs to be secure" then IT is likely up to its ears in reams of policies and reports, Cisco firewalls, VLANs, Group Policies, Symantec antivirus products, Websense, and password complexity regimes. It seems only elite tech companies and the military/intelligence community are making serious steps towards "How can I choose and commission software that is not so likely to contain serious vulnerabilities?" Even obvious ones. Mainstream IT security practices can, at best, put up a perimeter around the steaming pile of garbage fresh from the lowest bidder so that it can't infect anything else, and only insiders can exploit it, and maybe there will even be a record of them doing things that look like exploit attempts.
- peterwwillis 10y agoVirtually every organization i've seen, private or public, that isn't focusing on secret or higher clearance data, doesn't spend more than a weekend on appsec. Even organizations that have security teams dedicated to trying to secure its appsec infrastructure often do it as a black box, or after it is already in production. Aside from that? It should just be expected that any system that uses a structured query language and can receive user input is vulnerable to injection.
- ethbro 10y ago> How is SQL vulnerabilities like this still happening to systems that need to be secure? Because third party code review wasn't a requirement in the contract or spec. How anyone these days accepts code from a vendor, verifies that it works, and then puts it into production and pays the contract baffles me.
- Fej 10y agoObligatory Tom Scott/Computerphile video on why electronic voting machines are awful. https://youtu.be/w3_0x6oaDmI https://youtu.be/w3_0x6oaDmI
- danielvf 10y ago"Though much of the commission’s work is public, the hacker gained access to non-public reports on flaws in voting machines."
- sandworm101 10y agoAnd how accurate was that data? I'd assume that the commission only has was has been provided to it by others. Someone really wanting to exploit a machine should probably start elsewhere. The russians would do better by just buying some machines and testing them themselves under the guise of 'evaluation'. Russia does have elections and therefor a reason to aquire and test such machines.
- mlvljr 10y agoWasn't us. :|
- sixothree 10y agoThat is certainly reassuring in this case. But this is a reminder that either our voting system is secure from tampering or we are pretending that our elections are honest and that the people in office are who we voted for. I think most people here would have a difficult time saying our voting system is secure from tampering.
- cryptarch 10y agoI like this! Hopefully it sends some kind of signal and reduces the chance of electronic voting being implemented where I live.
- KirinDave 10y agoThis isn't what you want. Because even if there are hand counted votes, if humans use computers to tally, communicate, or check the vote then that will certainly be open to vector of attack that use personal credentials (the easiest to lose). There is no escape from a desperate need for competent electronic voting and comprehensive government security in every department.
- whyenot 10y agoI am so frustrated with how muted the current administration's response has been to the recent hacks. This is an attack on the most fundamental part of US democracy. It should be considered an act of war. Not only should that shape the US response to whoever is responsible, but also the amount of resources it devotes to defending against attacks like this. Obama telling Putin to "cut it out" isn't enough. No matter what is happening behind the scenes. Our next president might not even go that far.
- brian-armstrong 10y agoThe US has been guilty of electronic espionage and tampering in other countries. The world would call us out for aggressive retaliation here, and rightly so.
- whyenot 10y agoThat's true, but it's a price worth paying IMO.
- brian-armstrong 10y agoRegardless of whether it was justified, it does weaken our position to complain when others do it to us
- peller 10y agoNot only that, but if we start dumping dirt, who knows what secrets our adversaries might choose to drag out of the closet and parade down main street. It's a loosing proposition.
- BuuQu9hu 10y agoI say it is time for the governments of the world to publicly display those secrets. Maybe then we can move forward into a world where humanity isn't constantly stabbing everyone else in the back.
- sqldba 10y agoI don't believe it. I feel the public service is just continuing it's attack against a Trump presidency by reinforcing mini narratives that he shouldn't be in power vs Hillary. Yes the article doesn't say this (of course the hacker is Russian, which isn't out of the ordinary). But your average person won't read that far or even past the headline and when it gets republished those parts will disappear. That's my read.
- peterwwillis 10y agoYou shouldn't trust anything you read without multiple independent sources to verify it. But that's what credible news organizations (usually) do. And government organizations don't (usually) lie just to provide a fuzzy narrative of doubt over something which literally no longer matters. That's my read.
- vfulco 10y agoHow come we know so much about the "stolen" US elections through hacking but very little about HRC's unsecure private server which was likely hacked due to her wanton irresponsibility and likely treasonous actions?
- deleted 10y ago[deleted]
- ChrisNorstrom 10y agoI'm confused, is this click-bate? Because just this past Friday, December 16, 2016 during President Obama's speech he mentioned there is no evidence that the election itself was hacked. The DNC (Democratic National Committee. Hillary Clinton's party) was hacked and had emails stolen, the election (voting machines etc...) was not. https://www.youtube.com/watch?v=LBvK-Rb681I https://www.youtube.com/watch?v=LBvK-Rb681I at 48:30 President Obama says "I can assure the public that there was not the kind of tampering with the voting process that was a concern. The votes that were cast were counted and they were counted appropriately, we have not seen evidence of machines being tampered with. That assurance I can provide. " A lot of news outlets from ABC to BBC news show "Russians hack election" in their article's titles to get more clicks, then further down into their articles state the DNC was hacked. "DNC emails stolen" does NOT equal "USA presidential election hacked". Revealing damaging information on a candidate is interfering with an election but not "hacking the election", which makes it sound like the russians cast fraudulent votes using hacked machines. Plus the recount in Detroit revealed this: http://www.detroitnews.com/story/news/politics/2016/12/05/recount-unrecountable/95007392/ http://www.detroitnews.com/story/news/politics/2016/12/05/re... Plus, didn't democratic candidate Hillary Clinton win the popular vote anyway?
- angry-hacker 10y agoThere has never shown any evidence about the state of Russia being involved in these hacks. Diplomats would choose their words wisely but media writers whatever their readers want. . It's fake news to one side, and truth serum to another. Repeat other way around...
- kurthr 10y agoYou may not like or accept the evidence, but there has been plenty over the last 6 months. If you demand more, then you will likely never get it from a spearphishing email dump so asking for it is pointless. https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... http://arstechnica.com/security/2016/12/the-public-evidence-behind-claims-russia-hacked-for-trump/ http://arstechnica.com/security/2016/12/the-public-evidence-... Do you demand the same level of proof that the emails are genuine?
- noahlt 10y agoThis is dated Dec 15—I'm surprised that I haven't heard of this before today.
- anigbrowl 10y agoI posted it the day of and it sank like a stone, perhaps people were sick of politics and the mention of the election turned them off.
- lvs 10y agoAre you astroturfing or did you not read the content of the article -- or both?
- dang 10y agoBoth those questions are uncivil. The second is one that the site guidelines explicitly ask you not to post, and the first will be in there soon too. Please post civilly and substantively, or not at all. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html We detached this comment from https://news.ycombinator.com/item?id=13252669 https://news.ycombinator.com/item?id=13252669 and marked it off-topic.
- lvs 10y agoOh right. What about when the commenter is obviously either astroturfing or responding to the headline alone? Or perhaps you prefer to get your website brigaded?
- dang 10y agoIn that case you should email us so we can take care of the problem right away. Fortunately, that's also what you should do about any other astroturfing concerns too. What you mustn't do is throw 'astroturfing' and 'shill' around as ammunition in an argument; that's as cheap as it is common, and uncivil. > obviously If I've learned anything moderating HN, it's that we all vastly overestimate what counts as 'obvious' and that this is the root of most of our problems here. When you find yourself thinking 'obviously', that's probably a good time to search for at least one alternate model.
- lvs 10y agoAnd if there's one thing I've learned from reading your website, it's that sometimes the argument will legitimately be that the commenter is astroturfing or spewing an argument that an astroturfer would use. It seems increasingly likely that the discourse on your website is being attacked by brigades of users -- ones even with established accounts here -- who bring along intellectually dishonest argumentation that is motivated by political trolling alone. If those people (or the people influenced by them) can't be called out as brigaders and astroturfers, then I suspect many normal users here will increasingly be influenced by spurious arguments of the sort to which I originally responded. Keep in mind that you are not making a neutral call by preventing me from calling out a commenter. You legitimize their arguments and leave it to others to find a way to call them out without raising your hackles. Truthfully, the fact that I'd waste time on the matter is, I suppose, my own problem to fix in the new year...
- solarengineer 10y agoGiven how much the US messes about with itself and the rest of the world when the Government is supposed to have been elected fairly, I shudder when I think of the impact on the world when the elections have been unfair and rigged. I am appalled at how candidates from the same party - e.g. Hillary and Sanders, Hillary and Obama, Trump and who-ever - first criticise each other a lot, raking muck, raising FUD, casting aspersions, indulge in a lot of rabble-rousing - just to win some popularity contest. If the candidates stoop so low for their own party, then how much lower they must stoop to "defeat" the candidates of the opposing parties. The world has been seeing regular evidence of how easy it is to tamper with the voting machines, with the votes, and what-not. Does this call for a special situation where the elections are held again but with such concerns addressed? Otherwise, this farce of elections would simply continue, and the world would continue to be in a worse situation.
- mzw_mzw 10y agoBefore you panic (well, before you continue panicking) you should probably read the article. There is nothing in there that even remotely suggests anything untoward happened in this past election. > Does this call for a special situation where the elections are held again but with such concerns addressed? No.
- sixothree 10y agoEither our voting system is secure from tampering or we are all just ignoring a horrible probability.
- valgaze 10y agoTo calm things down a bit keep in mind the target was a backwater agency called the "Election Assistance Commission" which is not exactly the hive-center of democracy: "The security firm, Recorded Future, was monitoring underground electronic markets where hackers buy and sell wares and discovered someone offering log-on credentials for access to computers at the U.S. Election Assistance Commission, company executives said. Posing as a potential buyer, the researchers engaged in a conversation with the hacker..." Sounds like somebody found a vuln in probably a creaky lowest-bid government contractor website and wanted to monetize. I've never heard of this "Election Assistance Commission" agency before but it sounds like they exist to help US states implement a law from 2002 called the Help America Vote Act (HAVA.) I'm not at all comfortable with all these infiltrations, but this "American Election Commission" has done a pretty awful job, hacked or not. The fact that voter fraud/suppression shenanigans exist or that there's any ambiguity about how votes gets counted indicates to me they're assisting a pretty screwball election system.
- arghnoname 10y agoI know someone who used to work there. They don't do much. One of their initial responsibilities was ensuring that funds for HAVA (Help America Vote Act) were dispensed and electronic voting machines were certified following the hanging chad adventure. As we all know, electronic voting machines aren't so hot and in my personal opinion, the EAC hasn't done much very effectively and has been under fairly regular attack in congress and under (maybe toothless) threat of being shut down. I don't think they have any actual power over much of anything in elections because that power is distributed to the the state level secretary of state's, so their role is more advisory at best and also is disjoint from the more powerful FEC.
- ethbro 10y agoThe amount of power they have isn't as important as the amount of network access they have. Have there been any steps towards coming up with a formal graph of privileged network links between government organizations? If A works with B & C, then if A is penetrated then B & C should be formally notified and audited as well.
- whybroke 10y agoThe logical extension of your statement means the Russians should be invited to hack the DNC or any enemies of Trump forever because in your opinion leaks about debate questions and Pizzerias are so very, very critical to democracy. Perhaps denying the hacks every time they happens because, after all, they serve such a 'noble' purpose. And I imagine I am not remotely the first one to realize this. (Edit) My goodness but this is earning a lot of down votes. How very odd.
- PKop 10y agoI just think it's very childlike and immature to blame others for your own mistakes. The Democrats were unhappy embarrassing information they hid from voters was leaked to voters. They have no one to blame but themselves. If they didn't do the things talked about in the emails, there would be nothing to leak. How many people even viewed the emails, anyways? I think both: [0] the info in the emails was bad and [1] not that many people knew about it, or needed the Wikileaks info to not want to vote for Hillary Clinton. I think she just lost.
- whybroke 10y agoAnd I think a hostile nation affecting one's internal politics is an act of war, successful or not. This didn't just damage Hillary, although the media you so deprecate made it into just that. The hack also serves to de-legitimatize Trump. It is also causing Trump to fight with and denounce all the intelligence agencies critical to US functioning. Beside refusing their intelligence, the demoralization affect alone is huge (who will risk their life for a president who calls them a liar?). It has also thrown the whole electoral process into doubt. etc. And they hacked the RNC too. You can bet that will be used to to maximum damage at some point. It is no doubt that most damaging and successful attack on the US in decades. But even more shocking is that it is condoned because it furthers certain parties political ends. What happens if both political parties start using acts by hostile nations to help them win elections?
- dang 10y agoPlease don't break the HN guidelines by going on about downvotes. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html We detached this subthread from https://news.ycombinator.com/item?id=13252882 https://news.ycombinator.com/item?id=13252882 and marked it off-topic.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- petre 10y agoNow Obama can claim election fraud and point a finger at Russia. Which he has been doing anyway since they lost the election.