Slashdot Mirror
File-Sharing Software On State Election Servers Could Expose Them To Intruders (propublica.org)
An anonymous reader quotes a report from ProPublica: As recently as Monday, computer servers that powered Kentucky's online voter registration and Wisconsin's reporting of election results ran software that could potentially expose information to hackers or enable access to sensitive files without a password. The insecure service run by Wisconsin could be reached from internet addresses based in Russia, which has become notorious for seeking to influence U.S. elections. Kentucky's was accessible from other Eastern European countries.
The service, known as FTP, provides public access to files -- sometimes anonymously and without encryption. As a result, security experts say, it could act as a gateway for hackers to acquire key details of a server's operating system and exploit its vulnerabilities. Some corporations and other institutions have dropped FTP in favor of more secure alternatives. Officials in both states said that voter-registration data has not been compromised and that their states' infrastructure was protected against infiltration. Still, Wisconsin said it turned off its FTP service following ProPublica's inquiries. Kentucky left its password-free service running and said ProPublica didn't understand its approach to security. "FTP is a 40-year-old protocol that is insecure and not being retired quickly enough," said Joseph Lorenzo Hall, the chief technologist at the Center for Democracy and Technology in Washington, D.C., and an advocate for better voting security. "Every communication sent via FTP is not secure, meaning anyone in the hotel, airport or coffee shop on the same public Wi-Fi network that you are on can see everything sent and received. And malicious attackers can change the contents of a transmission without either side detecting the change."
The service, known as FTP, provides public access to files -- sometimes anonymously and without encryption. As a result, security experts say, it could act as a gateway for hackers to acquire key details of a server's operating system and exploit its vulnerabilities. Some corporations and other institutions have dropped FTP in favor of more secure alternatives. Officials in both states said that voter-registration data has not been compromised and that their states' infrastructure was protected against infiltration. Still, Wisconsin said it turned off its FTP service following ProPublica's inquiries. Kentucky left its password-free service running and said ProPublica didn't understand its approach to security. "FTP is a 40-year-old protocol that is insecure and not being retired quickly enough," said Joseph Lorenzo Hall, the chief technologist at the Center for Democracy and Technology in Washington, D.C., and an advocate for better voting security. "Every communication sent via FTP is not secure, meaning anyone in the hotel, airport or coffee shop on the same public Wi-Fi network that you are on can see everything sent and received. And malicious attackers can change the contents of a transmission without either side detecting the change."
The article talks about the how ftp can be used to peek at the operating system but any worthwhile ftp blocks that sort of nonsense. No, ftp doesn't encrypt or sign data but neither does http and people love that protocol.
Ftp actually can be secure. See gss.
FTP doesn't seem to be reported for getting compromised. Is that because it is mostly non-existent now?
Or is it like the Vice item, where they reported on a something, browser history sniffing, that would only occur for those that don't care about how much they lose.
can the MPAA and RIAA's shut down the vote if say the hot new movies where to be hosted there?
Well surely this new internet evil "FTP" should be banned. We need to draft new legislation against this new insidious threat actor.
FTP use by State and local employees at that level wouldn't have dedicated infrastructure, so accessing it from the wifi provided by coffee shops and hotels would be totally expected.
So yes, you can be 100% certain that many involved routers are easily infiltrated.
If you found a sucker to take that sort of bet; switch to sales. You have a gift and don't need to take chances.
These could also be reached from internet addresses based in any other country, because it's facing the internet and poorly secured.
This is my signature. There are many like it, but this one is mine.
Regardless of the presence of state actors wanting to interfere in our elections...
WHAT KIND OF MORON RUNS FTP ON AN ELECTIONS SERVER?
#DeleteChrome
This article is so much FUDD that is disgusts me.
Yes, the servers the allow people to register and post the election results are connected to the Internet and they should have FTP so the public can get election data.
The missing part is that the tabulation servers and equipment are air gapped and on their own separate system, as well as the state database that maintains registration. Can you hack the site and change the results? Yes, you can change the html export from the tabulation system to say whatever you want. It isn't going to change the official tabulation results that are communicated to the state and verified three times against the ballot boxes and tabulation systems.
The system is secure. Don't believe me? You can ask to be an auditor and watch how the poll-workers conduct the election and the procedures used back at the warehouse. Every ballot is counted. The numbers must match ballots issued at the poll vs ballots tabulated vs voters checked in. These are three separate systems that are reconciled against each other by hand and electronically by multiple individuals.
Overall the system is only as secure as the folks conducting it. They usually welcome outsiders to watch as it reinforces transparency.
to explain what FTP is on a /. post? I get TFA might have ...but...in the preview text, really?
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
“As recently as Monday, computer servers .. ran software that could potentially expose information to hackers or enable access to sensitive files without a password. The insecure service .. could be reached from internet addresses based in Russia, which has become notorious for seeking to influence U.S. elections. Kentucky's was accessible from other Eastern European countries.”
.. doh .. network. Serious dudes, enough with this anti-Russian cyber bollix.
Yea, there's this thing called the Internet, it's like a network of computers that can connect to other computers on the same er
It's not a voting machine, and it's not a critical system. It's a reporting machine that has to be publicly facing to give the public the election reports. In fact, putting FTP on it is a *good* idea to allow bulk transfer of data, as it's a much more appropriate protocol than HTTP for file transfer. Oh, and you idiots suggesting rsync or scp, the entire point is to allow the data to be available without a login. FTP does that, your favorite protocols don't.
https://xkcd.com/463//
100% of real-world FTP servers I've seen running in the last decade were setup on orders from Sales or Marketing departments. Those folks tend to have low technical ability, zero understanding of security, and far more political power than Dev or IT.
In fact, the presence of an FTP server on an important host tells us something about their organizational structure. It tells us there is at least one zero-tech-knowledge person in the org, whose mere whim carries more weight than the CTO's (or CSO's) total office-political power.
It's a social problem. We now live in a world where everything is controlled by computers. Yet programmers have no real upward career path and are systematically excluded from leadership positions in most organizations. Thus even highly tech- dependent orgs usually have 100% tech-illiterate leaders.
Until this social problem is fixed, expect security incidents to get steadily worse and more frequent.
Rumor has it that AWS us-east-1, at least, is protected by a SAM battery (among other things, no doubt).
there is nothing wrong with ftp, as long as it is used in the correct way.
On a long enough timeline, the survival rate for everyone drops to zero.
I still use FTP for file transfer. It's simple to set up and has many good features, it's extremely handy for transferring multiple and large files. I mean what else are you going to use? HTTP? Good luck trying to transfer that 500GB file without restarting the transfer when you are losing the connection every once in a while. FTP has restarts and retries and I don't see how you are going to get that with HTTP. FTP isn't insecure by default, it's just as secure as any other protocol.