Slashdot Mirror
Election Assistance Commission Hacked Using SQL Injection (reuters.com)
whoever57 writes: The commission that is responsible for ensuring the integrity of voting machines was itself hacked. The hacker gained access to non-public reports on weaknesses in voting machines. The hack occurred after the election, so it is unlikely that this hack resulted in changing the result. However, if one hacker can break in, how does anyone know that there was not a prior hack? The hack used an SQL injection flaw to gain access to usernames and passwords which were then cracked.
wiredmikey adds: Researchers have discovered that a Russian-speaking hacker broke into the U.S. Election Assistance Commission (EAC) systems, and has been trying to sell stolen access credentials -- including admin-level -- on the underground. On December 1, researchers with Recorded Future discovered internet chatter that appeared to relate to an EAC breach. A hacker, called "Rasputin" by Recorded Future, was discussing the sale of more than 100 EAC access credentials to a middle-eastern government broker. The hacker claimed to have accessed the systems via an SQLi vulnerability, which Recorded Future was able to locate and report. EAC said Thursday that was aware of the "potential intrusion" and was investigating the incident.
They didn't. It was brought up in private discussions in October (September? I forget), but the white house decided not to go public with the findings out of fear of unduly influencing the election.
Never underestimate the stupidity inherent in all human beings.
They should have come out with it before the vote. Now the winner has no credibility.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
he had credibility before?
But it would still have been too late, people already found out that the loser also had no credibility.
I don't believe it would have changed much, half the country already hated Hillary and voted Trump out of spite.
I like forward to the reasonable, rational, well cited discussion to follow herein. I'm sure everyone will remain professionally calm and quite intelligible and on point in this. I look forward to it all, and god save the Lizard Queen.
Bobby Tables Strikes again !!!
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Maybe that was the plan all along. They sat on this information so they could bury it if their candidate won and bring it to light if their candidate lost so as to throw the legitimacy of the vote into question.
Perhaps, incredulously, the reason Señor Trump seemingly wildly accused the election of being rigged is that he knew more than we did, but mistakenly assumed he was not the beneficiary.
Hell, perhaps he's a savant with the ability to grasp immunity by merely convincing us all he's a clown.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Agreed. /default/ coding practice, not what you reluctantly pick up after a breach or an audit!
I get that developers are lazy and can be expected to shy away from security features that get in the way, but come on, Prepared Statements have been around for a very long time, and in a lot of ways, they make your life easier (prettier code, streamed-blob-handling, no escaping, datatype checks):
They should be your
Why is SQL injection still a thing? Hell, why is SQL still a thing? I have nothing against relational databases, but the Structured Query Language itself is an accident waiting to happen. Why the hell aren't people using proper language bindings instead of trying to pass control and data interleaved into a single text stream?
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
you obviously don't understand the idea of impossible. So what they had the site secured against injection attacks then did not and now they are vulnerable again magically? You could use a brush up with a dictionary dude. For you that are slower then tar you can attack multiple times and just because this one was DETECTED does not mean ones in the past were impossible.
Wow this place has slid a lot in recent years
That's Bobby Drop Tables to you...
My eyes reflect the stars and a smile lights up my face.
Fuck you guys for not hiring me.
Why is SQL injection still a thing?
Apparently it has something to do with outsourcing coding to the cheapest bidder. Can't comment on the rest.
Senate Majority leader objected, if I recall, to the information being made public so close to election day.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
For you that are slower then tar...
Hey! tar is pretty fast by itself. Just use a faster compression algorithm if it doesn't seem fast enough for you.
Everything I write is lies, read between the lines.
All votes are on paper. All counts are scrutineered at the polling booth, a quick and painless process. (Real scrutineering where the votes are seen, not some bullshit where scrutineers look through a window.) And then the subtotals are independently tallied by the parties.
Would be annoying if the main Electoral Computers computers were compromised, but no big deal. It would be obvious when the subtotals did not tally, and a recount would quickly rectify it.
So, what is so different in the USA!
"The hack used an SQL injection flaw. . ."
Jesus wept...excuse me while I execute a nuclear-grade facepalm. Have none of these people ever heard of sanitizing data?
Just cruising through this digital world at 33 1/3 rpm...
Billions of tax dollars went to purchase electronic voting machines that were designed to be hacked. If they were hacked perhaps the real issue was that they were hacked by the wrong people?
Only somebody that should be stuck in jail writes SQL by tacking strings together.
Bullshit, how would you involved the Russian hackers? How would you fake the evidence for the CIA and FBI both to confirm it?
http://www.aol.com/article/2016/12/16/fbi-backs-cia-assessment-of-russia-2016-election-hack/21629706/
The hacked election registration websites have been confirmed.
The hacked DNC emails were released DURING the election, you claim "sat on information" yet no such sitting occurred.
CIA says they hacked the RNC emails too. They just haven't released them, and haven't sexed them up.
That means that Putin has both chosen the USA President, AND has the secrets of the elected lot for future leverage.
Can I remind you that Hillary got more millions votes than Trump. And Trump has not sold off his foreign businesses, despite promising to do so by Thursday, a deadline passed already. He still has offshore accounts, he still received foreign income.
You want to put him, with fewer votes, into the Whitehouse, using the rules, yet he is in violation of those rules. You are helping turn USA into a Russian puppet state.
"The leaked emails are certainly legit - that's not the question"
Not they're not, they're a mass of legit emails with a bit of propaganda added (or critical information removed) to sex them up a bit. That's how Russian propaganda works.
" Every day, more clinton email scandal and no chance for policy discussion. That's how propaganda works."
Exactly, every day you would make some innuendo against emails provided for the purpose by Manafort (Trump's propagandist who's a lobbyist known for doing similar pro-Russia elections around the world), and many of you were doing Putin's work for him.
Trump isn't the choice of the America people, they voted for Hillary. He isn't the GOP's choice, he just hijacked their primaries. He's Putin's choice of President.
They want to put him in power using the Electoral College, yet he won't even abide by the Emolument clause. He'll literally have offshore bank accounts and a company to launder that money (name brand licenses) AND be running the country at the same time.
It's strange how many ACs there are out there telling us how Russia is our friend.
The world's burning. Moped Jesus spotted on I50. Details at 11.
I am:
"That played well before the election. Now? We don't care."
or maybe this one is better:
"You people were vicious, violent, screaming, 'Where's the wall? We want the wall!' Screaming, 'Prison! Prison! Lock her up!' I mean you are going crazy. I mean, you were nasty and mean and vicious and you wanted to win, right? But now, you're mellow and you're cool and you're not nearly as vicious or violent, right? Because we won, right?"
Someone had to do it.
I can think of two reasons. One, they wanted to embarrass the commission, SQL injection flaws are seriously novice. Two, they are lying, and want to throw out a red herring.
Some people encrypt by using rot-13 twice. I prefer the more secure method of using rot-1 a total of twenty six times.
I have nothing against relational databases, but the Structured Query Language itself is an accident waiting to happen.
Agreed. Lost track of the number of times I've forgotten to type 'where' and all my conditions get tagged to the last join without something warning me about how much of a dumbass I am.
Seriously. Rasputin ?
This is just part of the show people, don't you see that ?
You have bigger enemies within your own country than Russia will ever be.
The ones that are "manufacturing" these retarded articles/news for a start.
Less than 20 percent voted for Obama too. The fact that most of the US land mass is rural and Republican is irrelevant. Most US citizens live in the small patches that vote Democratic. One person, one vote - except for the extra 2 votes that give rural states an extra 60 or so EC votes. Yep, that's the system - but don't claim it means that most Americans want Trump as President. Only the barest majority wanted him in some of the biggest states he won. FL, PA, WI, MI.
Posted from my Android phone. Oh, I can change this? There, that's better...
I think that the phrase "this attack" is being used in multiple senses. I don't even think you're disagreeing with each other, just not understanding each other.
"this attack" 1) This instance of an attack. 2) This variety or technique for attacking a site.
Both meanings are valid, but if you mix them up misunderstanding results.
I think we've pushed this "anyone can grow up to be president" thing too far.
IIUC, when you trace this back the the original article (for this kind of article, not necessarily this particular article), it means it was routed through a Russian ISP. Even then I'm not sure they take into account the possibility of forged headers.
That said, for the kind of attack this is reported to be there's no particular reason to doubt that the attack came from Russia. But even so why claim government involvement when it's the kind of attack a high school kid could put together? Of course, this doesn't prove the Russian government wasn't involved. Or the Nigerian government. Possibly there is evidence in "Who's selling the goods?", but that's inferential, as information can be sold repeatedly...and sold on by the buyer.
I think we've pushed this "anyone can grow up to be president" thing too far.
You think a foreign business is a conflict of interest!? Sure, a little, but nothing like accepting bribes from Qatar, you dummy! Your so called "sane" politicians have been doing this for YEARS! Maybe a little bit of what you think is crazy is what we've needed all along. Good becomes evil in an empire of lies.
Hillary didn't win. It's not about who appeals to the most people, it's about who appeals to the most different kinds of people. Otherwise, you have 5% of indoctrinated counties monopolizing elections against 95% of diverse-minded Americans.
Comment removed based on user account deletion