Slashdot Mirror
Security Expert Jailed For Reporting Vulnerabilities In Lee County, FL Elections (theregister.co.uk)
rootmon writes: Information Security Professional David Levin was arrested 3 months after reporting un-patched SQL injection vulnerabilities in the Lee County, Florida Elections Office run by Sharon Harrington, the Lee County Supervisor of Elections. Harrington's office has been in the news before for voting systems problems (for example in during the 2012 election, 35 districts in Lee County had to remain open 3 hours past the closing of polls due to long lines and equipment issues, wasting $800,000 to $1.6 million of taxpayer money on incompatible iPads for which her office is facing an audit. Rather than fixing the issues in their systems, they chose to charge the whistleblower with three third-degree felonies. The News Press also has several related interviews.
For a running service 'testing' hacks is still hacking.
Next time don't report it to them, report it to the media.
If you are not hired by the owner of the systems you are breaking into, then you are not a white hat.
Breaking into or executing code on a system without permission is a criminal offense. Even if he was doing it ostensibly for the greater good, Levin should know better (and a tweet from him suggests that he knows he should have known better). The courts aren't going to let this slide just because he's a "good guy," because that sets a bad precedent.
If you're going to try to break into a system, get permission. If you absolutely must do it without permission, use a burner name and address to make the notification, or go through an attorney to make the notification.
You can never go home again... but I guess you can shop there.
How do you find a vulnerability without actually testing it?
It almost shouldn't matter in this case. It does, but it shouldn't. When you bring felony charges for basic pen testing, people who find a system is vulnerable are not going to report it. Even if they shouldn't have been snooping around in the first place, isn't it better if they're willing to report the vulnerability before someone does real damage?
Basic SQL injection vulnerabilities are so trivial to guard against these days that it is the person who spec'd or coded the system who should be facing severe punishment, not the person who ran a penetration test. It is very much like leaving a ballot box unguarded and unlocked at a polling place, and then arresting the person who lifts up the lid and says "hey, someone left this unlocked!" Sure, he shouldn't have been checking, but he's not the one who dropped the ball and you don't arrest him for it.
In a worse case, this could have been done easily by a random tech guy barely out of high school, a malicious government, a ransomware operator, or anyone who wanted to steal the election. Many people love this kind of soft target. The local government should be thanking their lucky stars it was done by someone who reported it instead of using it to elect the candidate slate of their choice.
Real lawyers write in C++
I hope the court realizes that the State officials are incompetent retards who created a serious security situation, not to mention wasting huge sums of money, and that all they're trying to do is use the courts to bury their severe intellectual and technical inadequacies. Courts shouldn't be used to protect the fundamentally moronic.
The world's burning. Moped Jesus spotted on I50. Details at 11.
I hope the court realizes that the State officials are incompetent retards who created a serious security situation.
Of course they may have just purchased or licensed a serious security situation. There are a lot of poorly written applications created by the private sector and sold to the public sector.
There should be no excuse for a State though. They should have the resources to check out software and services they purchase (especially elections related software or services). When it comes to the County and City level though, many don't have the resources to do this kind of evaluation whether it is available skill sets or money to pay an expert. This is a significant problem that really needs addressing in many localities.
Florida really should drop this one. All they are doing is making themselves look worse (hey!, why just look stupid when you can also look corrupt).
When exposing the vulnerability you simply run it through the legally ambiguous filter.
I was able to penetrate your system using an injection attack vector
becomes
Based on your code I surmised it was likely susceptible to an injection attack vector and wanted to make you aware of it before someone actually tries it.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
There will be no permission. The real reason he's in jail is they're pissed off everyone knows how fucked up their system is. He outed them and they popped his ass in the slammer for it. If they were actually interested in providing a secure system they would have rewarded him instead. The way he was treated says everything about Sharon Harrington's professionalism. She's a typical CYA type interested only in her own continuance of incompetence at her job. I'd say the people in that county should see that she's sacked if they ever want an improvement. Wonder how many of those Ipads walked off on her watch? Maybe they could find a cell for her too.
Or, in the future, sell it to the Russian mob for big bucks and retire.
Should be marked insightful, not funny.
If government is going to be douchey towards people who point out vulnerabilities, then best not to disclose anything to government. They completely deserve whatever comes next.
Let them fail all by themselves.
You are absolutely correct: the way he handled this is a crime. But that just highlights a massive deficiency. How are we supposed to catch security flaws like this?
I can't imagine that asking permission would end well. The target has nothing to gain, and everything to lose. We need someone (or some group) sanctioned to pen test government assets.
From election offices, to the ACA databases, to the DMV, and on and on, we have a LOT of personal data floating around. I would certainly prefer that someone is allowed to make sure these repositories are being kept up to standards.
This signature is false.
In this case, the saying definitely applies...there are a LOT of people who have no business creating code for important production systems doing so.
As scary as it is, there's a non-insignificant portion of workers actively creating software, often connected directly to the web, who have no idea what a SQL Injection is, nor why you need to worry about one.
Asking about what a SQL Injection is is one of my standard interview questions, you'd be shocked at the number of people who don't have a clue, even those who are interviewing for a senior position. Not really related, but I'm also shocked by the number of people who don't understand what an Outer Join is.
The thing is, if a security researcher asked for a unit to do security testing on, no permission would be forthcoming.
The security researcher, being a voter, has a legitimate interest in the safety and security of the voting system.
Also, as a voter, this person is ALREADY supposed to be able to access the system. It's the fault of the people setting up this system that his ability to access the system is that broad.
And, since the equipment is being purchased with taxpayer funds, there's a legitimate school of thought that permission for access is already implicit.
Criminals bent on subverting the voting system are NEVER going to ask permission.
Chas - The one, the only.
THANK GOD!!!