9 ms·
An Electronic Voting Firm Exposes 1.8M Chicagoans
- danso 9y agoSource blog post (and free of CNN's obnoxious autoplay video): https://www.upguard.com/breaches/cloud-leak-chicago-voters https://www.upguard.com/breaches/cloud-leak-chicago-voters As soon as I read the headline, I immediately thought "AWS misconfiguration". A few recent massive government-data breaches (by contractors) have fallen into that category: June 2017: http://gizmodo.com/gop-data-firm-accidentally-leaks-personal-details-of-ne-1796211612 http://gizmodo.com/gop-data-firm-accidentally-leaks-personal... May 2017: http://gizmodo.com/top-defense-contractor-left-sensitive-pentagon-files-on-1795669632 http://gizmodo.com/top-defense-contractor-left-sensitive-pen... Note that all of these breach reports (including this Chicago one) come from Upguard, which seems to have a method for scanning/crawling public S3 buckets.
- sctb 9y agoThanks! We've updated the link from http://money.cnn.com/2017/08/17/technology/business/chicago-voter-records-exposed-upguard/index.html http://money.cnn.com/2017/08/17/technology/business/chicago-..., which points to this.
- ckinnan 9y agoAmazon just launched a service to help scan, categorize, and protect data https://aws.amazon.com/macie/ https://aws.amazon.com/macie/
- dark_shadow 9y agoDon't you have to pay for that?
- lazyant 9y agoOne click away: https://aws.amazon.com/macie/pricing/ https://aws.amazon.com/macie/pricing/ "No charge for the first 1 GB processed by the content classification engine After first GB, $5 per GB processed by the content classification engine"
- flyGuyOnTheSly 9y agoWow that seems pricey. $5 just to look over a Gig of data with a fancy algorithm? ...data that's already on their servers, to boot!
- _salmon 9y agoThis looks like it only works for buckets you own. Upguard is scanning everyone.
- mtgx 9y agoSame with Nice Systems' leak of Verizon customers' data: https://www.engadget.com/2017/07/12/verizon-partner-exposes-14-million-customer-records/ https://www.engadget.com/2017/07/12/verizon-partner-exposes-...
- _salmon 9y agoI made a quick-and-dirty tool for doing this: https://github.com/sa7mon/S3Scanner https://github.com/sa7mon/S3Scanner I'll probably spend some time this weekend making things look better and improving the documentation. I made it mostly as a PoC
- rvail2 9y ago1.8M Voters. Somehow voted democrat 2.1M times....
- konceptz 9y agoNot a particularly useful comment but if you read the article it does say that there were admin credentials to the voting systems in the then publicly accessible data, so maybe. It does, however also say that there is no indication the data had been accessed previously, not that I believe that statement.
- rossitter 9y agoWhere are you getting your 2.1 million figure? It was 913,000[0]. Combined with 699,000 votes for Clinton/Kaine from suburban Cook County[1]—whose voters seem to have been unaffected by this breach—you get the 1.6 million number reported by AP for the county[2]. [0] - https://chicagoelections.com/en/wdlevel3.asp?elec_code=4 https://chicagoelections.com/en/wdlevel3.asp?elec_code=4 - must manually select 'President & Vice President, U.S.' [1] - http://results1116.cookcountyclerk.com/summary.aspx?eid=110816 http://results1116.cookcountyclerk.com/summary.aspx?eid=1108... [2] - https://www.nytimes.com/elections/results/illinois?mcubz=0 https://www.nytimes.com/elections/results/illinois?mcubz=0
- vforgione 9y agoI'm pretty sure this is a reference to the "vote early and vote often" phrase that is typically correlated with Chicago, and especially with the Democratic machine politics. Source: Chicagoan. And I found this hilarious.
- verytrivial 9y agoSo, what, now somehow a group of people impacted by this potential identity theft vector will need to rally together under some keen prosecutor to personally sue? Why aren't the vendors auto-summoned to court by the government when these breaches occur?</rhetoricalQuestion> Hooray for the free market .. ?
- chronic6h2 9y ago> Hooray for the free market The free market says they don't care. I've had my identity stolen from a data breach. Could I have sued? Yes. Could I have led a class action lawsuit? Yes. Did I? No. Why? I'm fine now and just like billions of other humans, I'm lazy and simply just don't care enough.
- SamuelAdams 9y agoIsn't this considered public data anyways? Illinois (and I believe every other US state) requires that certain voter data be publicly accessible. To access it in bulk, you'll have to pay a small fee, but anyone can get this. A misconfigured AWS instance is always an issue. I'm not trying to downplay that. Only that this data being released to the public isn't anything new - the public already had access to it. https://www.elections.il.gov/votinginformation/computerizedvoterdata.aspx https://www.elections.il.gov/votinginformation/computerizedv...
- mcone 9y agoNo. The Chicago Tribune [0] reported on the type of data exposed: > The files included names, addresses, dates of birth, the last four digits of many voters' Social Security numbers, driver's license and state ID numbers for the 1.8 million who are registered to vote in Chicago. [0] http://www.chicagotribune.com/news/local/politics/ct-chicago-voter-data-cloud-met-0818-20170817-story.html http://www.chicagotribune.com/news/local/politics/ct-chicago...
- SamuelAdams 9y agoSo the question becomes - what types of data is available using legal channels?
- mcone 9y agoAccording to Forbes [0]: - Name - Street address - Party affiliation - Elections in which you did (or did not) vote - Phone number - Email address [0] https://www.forbes.com/sites/metabrown/2015/12/28/voter-data-whats-public-whats-private/#76f45d481591 https://www.forbes.com/sites/metabrown/2015/12/28/voter-data...
- GauntletWizard 9y agoLast four of social is so abused it shouldn't count, and date of birth is in nearly every company's loyalty database. That leaves drivers license and state ID number as the leaked data. I'm honestly not sure how important or secure those are.
- lpa22 9y agoThis is EXACTLY the reason I don't vote
- knieveltech 9y agoChoosing to abdicate your civic responsibility is certainly your right but this is easily the most bullshit rationale I've heard offered to support the choice. I'm guessing you also don't shop at Target or Amazon?
- colinyoung 9y agoAs both a Chicagoan and (obviously) an Illinois resident, this means my voter info has been exposed twice this year alone. Amazon sent out warning emails for owners of misconfigured boxes about 60 days ago. Why didn't the firm in question take action? I am an engineer and literally had to do that same task at work at that time. Easy as 2 clicks.
- monksy 9y agoThe ticket wasn't a high enough priority. Or the PO didn't want to prioritize it in the sprint.
- mattnewton 9y agoMy guess is they were staffed with contractors to build it out and it was no ones responsibility to maintain after they left. I've seen that happen more than once..
- komali2 9y ago"It was in the backlog!"
- monksy 9y agoTech debt "we'll get to it."
- sneak 9y agoT-Mobile uses the last4 of the account holder's SSN as a phone support authentication string. This is a trove.
- ams6110 9y agoAnd they're certainly not the only one. Last 4 of SSN is a very common authentication question.
- unclebucknasty 9y agoWhich is inane. We have to get away from this idea of having "secret" numbers that, if simply discovered, can cause so much damage. That includes credit card numbers, SSN, etc.
- lurker456 9y agowhat alternative do you have in mind ?
- unclebucknasty 9y agoWell, I haven't yet patented an alternative, but I think it's pretty clear that, in this climate of routine breaches, the old system of secret data is no longer viable. But, if you're interested in building an alternative, then off the top of my head, I'd suggest that we've got the blockchain. We've all got omnipresent palm-sized computing devices. We've got 2FA schemes, and more. The tools are there for you to create a much more robust system than one that says "here are a handful of secret numbers. Don't let anyone else see them or else your life may be ruined".
- lurker456 9y agoTo paraphrase a comment about virtual currencies: If you have a hard problem and try to solve it with a blockchain, you now have 2 hard problems.
- 9y ago
- incongruity 9y agoIs there any way for one to know if their info has been exposed? I had been registered to vote in Chicago ~6+ years ago but have since moved. Knowing Chicago, I'd bet I was still on the rolls (and probably having ballots cast for me ;)
- incongruity 9y agoNot sure why my original question has been down-voted. I think it's a legitimate issue – when things like this make the news, there's often an interest for potential victims to find out if they've been put at risk. Many companies go out of their way to protect their customers/users with offers of identity monitoring/credit monitoring, etc – will the city of Chicago do the same?
- ams6110 9y agoCool, now let's match them up against death records and see how many of the dead really do vote in Chicago ;)
- neuronexmachina 9y agoThe data is for registrations, not who actually voted. There's probably quite a few people who are deceased or moved who are probably still in the registration db.
- dark_shadow 9y agohahahaha
- kyle-rb 9y agoRecently, I got an email from AWS notifying my that one of my S3 buckets was publicly accessible (intentionally, for a static site). They really try to make sure that people can't screw this up.
- rayboy1995 9y agoYes not only that, they have changed the UI so much that it explicitly confirms that you want to make this data public.
- cozzyd 9y agoI wonder if Obama's info was leaked (mine almost certainly was was :( )
- aanet 9y agoIs there any way to find one's (personal) details were in the data that was exposed??
- shostack 9y agoHow far fetched would it be for this data to make it's way into Cambridge Analtyica-type targeting for future election advertising? Putting on my tinfoil hat for a moment, I have this nagging feeling in my guy that these issues are a little too coincidental. So how can we make sure all this data isn't used to tamper with voter rolls or uploaded to FB, etc. to create Custom Audiences based on voting history and district?
- adanto6840 9y agoAFAIK, the latter use-case is currently done all the time. Much of the data can be obtained legally, and is public data. Political campaigns are most definitely using all the data they have on you, including public data/legally-obtainable information such as voter turnout history/registration/party affiliation, street address, etc. to do targeting advertising already.
- jdmichal 9y agoI can tell you that campaigns have much of this information already, often provided directly by the state as public information. The idea that campaigns don't already "create Custom Audiences based on voting history and district" is laughable at best. Communications are often targeted in exactly this way. Here's Florida's relevant information: http://dos.myflorida.com/elections/for-voters/voter-registration/voter-information-as-a-public-record/ http://dos.myflorida.com/elections/for-voters/voter-registra... "Voter registration information is public record in Florida with a few exceptions. Information such as your social security number, driver’s license number, and the source of your voter registration application cannot be released or disclosed to the public under any circumstances. Your signature can be viewed, but not copied. Other information such as your name, address, date of birth, party affiliation, and when you voted is public information."
- shostack 9y agoMost of this info is public, but not who you voted for, or your email address.
- 9y ago
- shazzy 9y agoSlightly off-topic, but a great video on why Electronic Voting could be a bad idea: https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI I've wondered before why the UK doesn't have e-voting, and after watching it is sort of seems obvious. With traditional voting, it can easily be changed on a small scale, but is very hard to do in a meaningful way. Whilst with e-voting, its almost just as much effort to change on a small scale as a bigger scale, with much fewer people being involved. I particularly like the idea that the reason we use pencils is as a protection against somebody replacing pens with ones with invisible ink. Not sure if this is true though.