Slashdot Mirror
Security Expert Jailed For Reporting Vulnerabilities In Lee County, FL Elections (theregister.co.uk)
rootmon writes: Information Security Professional David Levin was arrested 3 months after reporting un-patched SQL injection vulnerabilities in the Lee County, Florida Elections Office run by Sharon Harrington, the Lee County Supervisor of Elections. Harrington's office has been in the news before for voting systems problems (for example in during the 2012 election, 35 districts in Lee County had to remain open 3 hours past the closing of polls due to long lines and equipment issues, wasting $800,000 to $1.6 million of taxpayer money on incompatible iPads for which her office is facing an audit. Rather than fixing the issues in their systems, they chose to charge the whistleblower with three third-degree felonies. The News Press also has several related interviews.
I hope the courts recognize that white hats are the good guys. I hope that paves the way for Levin (and EFF) to sue Lee County and Harrington for damages. And I hope that discourages other politicians from lashing out at the good guys.
He was arrested for actually hacking the website. Stop it with the clickbait headlines. This isn't the Star.
According to an episode of The X-Files, "all the nuts roll downhill" state.
I wish best for this guy. He did what was right and now faces several felonies. I hope this gets thrown out and he can files a big fat civil lawsuit at the count. He has his felony charges published all over the news and in postings. He'll never be able to get top secret clearance. Any potential employer will Google this guy and may consider him to be too hot to handle.
You say things that offend me and I can deal with it. Can you?
Replying because I mis-click moderated you.
Was going for +1 Funny and clicked -1 Troll instead.
My eyes reflect the stars and a smile lights up my face.
Next time don't report it to them, report it to the media.
Was going for +1 Funny and clicked -1 Troll instead.
Happens all the time. ;)
How do you find a vulnerability without actually testing it?
It almost shouldn't matter in this case. It does, but it shouldn't. When you bring felony charges for basic pen testing, people who find a system is vulnerable are not going to report it. Even if they shouldn't have been snooping around in the first place, isn't it better if they're willing to report the vulnerability before someone does real damage?
Basic SQL injection vulnerabilities are so trivial to guard against these days that it is the person who spec'd or coded the system who should be facing severe punishment, not the person who ran a penetration test. It is very much like leaving a ballot box unguarded and unlocked at a polling place, and then arresting the person who lifts up the lid and says "hey, someone left this unlocked!" Sure, he shouldn't have been checking, but he's not the one who dropped the ball and you don't arrest him for it.
In a worse case, this could have been done easily by a random tech guy barely out of high school, a malicious government, a ransomware operator, or anyone who wanted to steal the election. Many people love this kind of soft target. The local government should be thanking their lucky stars it was done by someone who reported it instead of using it to elect the candidate slate of their choice.
Real lawyers write in C++
The correct approach for fixing security issues in a voting system are to elect yourself, then appoint a team of people to correct the issue while funneling you money.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Security professionals and tech enthusiasts should take note of this technique and apply it in reverse: instead of reporting vulnerabilities to the government institutes who caused them, bring those guys to court. Sue them for unsafely handling the information you entrust them with. Things are not going to get better unless this kind of incompetence can cost someone's head.
There is no downhill for anything to roll to in Florida.
We play the game with the bravery of being out of range
When I was thinking about who could pass on this sort of useful information without exposing the source to prosecution, Wikileaks came to mind.
The joke is that things roll downhill from the rest of the US into Florida.
so it is kind of redundant to quantify the term money with "tax payer"
No, it's not. Because a LOT of people seem to think that there actually is something called "government money." Nearly half the country pays no income tax at all, and a large percentage of those get a "tax refund" on the income taxes they don't pay. That flow of money is rarely referred to as "other people's money" - just as tax credit, as earned income credit ... as anything other than a portion of the money that other people pay as taxes. Politicians, especially on the left, talk routinely about how they'll start a new program, or enhance regulatory power, or fund this, or that ... all with a glossy coat of the atmospherics of it being "government money." They say, "It's high time we funded and expansion of NIH's chimpanzee sexuality study..." instead of "It's high time we gathered up some money from the half of the country that pays income taxes, mostly from the minority of that half that pays almost all such taxes, and have them buy an expansion of NIH's ..."
It is this kind of attitude that pushes bean counting and attempted cost savings to such an extreme level that it is detrimental.
No, it's this kind of attitude that helps remind people whose money is being spent. That's part of keeping keeping such expenditures reasonable, instead of running up tens of trillions of dollars of debt ... do you really need to hear an explanation as to why that is detrimental?
Don't disappoint your bird dog. Go to the range.
I'll go with the Simpsons: "Florida, America's wang."
I've abandoned my search for truth; now I'm just looking for some useful delusions.
manishs, did you investigate this one before pushing it up? The more I read about it, the more this all looks like a stunt by Sinclaire. Instead of going through proper channels, this guy went through an opposing candidate, and actively goes above and beyond privately reporting a security flaw; instead publically exposing it on YouTube and going on to actually explore the system once gaining access. All this with no time for the government to fix it. That's not how security evaluators should _ever_ behave. So then he goes to jail, allowing crummy summaries like this one, to effectively say "RAWR, HARRINGTON BAD!!". Harrington did not appear to pursue the arrest. It looks like Sinclair hoped to get an arrest to increase negative exposure on Harrington to help get her voted out. Publishing a summary like this on Slashdot means that these people are effectively playing the editors. The only good thing is that the summary feels so incredibly slanted that it sets off some people's bullshit detectors.
Frankly I'm disgusted that there's no "+1 Funny Troll" option.
It seems my first post disappeared for some reason. Thank you so much for your great article above. Most of your posts have been fantastic. A see a very few who are a little misguided. I hope the following information helps: There was no “break[ing] into an account” as Sharon Harrington states. Sharon left the door open. Dave was driving by and saw the door had been left open by his neighbor renting the house, Sharon. He knew the person who left the door open would call the police and pretend that Dave somehow opened the door. So, he called a neighbor who understands doors and could confirm that, yes, the door in fact was left wide open. He wanted a witness, in case the person who was renting the house lied to the police. The neighbor he called, Dan, called the renter and informed her she left her door wide open. The renter couldn’t be bothered to call Dan back, ever. Instead, she called her door repair guy to call Dan back. This door guy works full time for the renter and was actually the one who left the door open to begin with. Dan and Dave had to explain repeatedly to the door guy: a. That the door was left open b. What door it was on the house c. How to close the door d. How to secure the door, so this did not happen again e. That they were lucky a burglar did not see the open door and steal anything or vandalize the house before Dave saw the open door and Dan reported it *BREAK* 1. No one was "caught." The issues were reported by Dave. In fact neither the county nor the state could tell if they had EVER had a data breach. The state was very clear about that. 2. Dave stopped as soon as he proved the holes were real. There was no rummaging around inside someone else's system. He did not take any information, either. 3. Dave never perused around the system. He simply logged in once to show the holes were real, not a honeypot. As soon as he proved his point, he backed out and never entered again. 4. None of the information was released to the public until AFTER Dave helped them fix the holes, and the systems were claimed to be secure. 5. Dave not only reported the holes, he showed them how to find the holes. After explaining where the holes were, they still could not find them. So, he showed them how to fix the holes and gave them Best Practices going forward. The state asked for a written report, which he provided. They gave him permission to go into the system. When Dave found they did not even have the most basic tools to detect intruders, he provided them with those software tools. 6. The FDLE did not actually investigate. They just tried to find a law they felt Dave broke (which is not an applicable law in this case), and tried to figure out how to nail him on it. They reported the current Supervisor's claims as fact without investigating. The claims turned out to be false. The FDLE did not put a real IT person on the case and STILL does not understand what happened or how it happened. The only dates they used they received from Dave and I, in cooperating into the investigation of why the holes were left there for years to begin with. The investigation is supposed to be into the Gross Negligence of the state and county. However, the FDLE is allowing themselves to be used as political pawns by a corrupt politician. *BREAK* There is a synopsis at: www.gofundme.com/237czxgc You can find more videos and information at www.Facebook.com/DanForSupervisor Also, there is a list at www.DanSinclair.com/supervisornews.htm The site is ugly and boring. However, the facts are accurate. I see on here some posts that appear to be from one of the two under qualified IT guys for the agency that was responsible for protecting the systems, and did not. FYI, the IT person responsible used a password of 1234. I can tell you now as it has been changed. That gives you an idea of the problem we are dealing with here. All of the UserID's and Passwords they left exposed to the public facing interface were in clear text and part of the primary database. There are a L