With voting in the 2018 midterm elections under way, a new analysis has revealed a security flaw hackers could exploit to corrupt voter registrations and election results.
The news: A study by ProPublica found that computer servers in two states, Kentucky and Wisconsin, were running software that could be compromised by a cyberattack. Kentucky’s system deals with online voter registration, while Wisconsin’s handles results reporting. The two states told ProPublica that voter registration data hasn’t been tampered with, and that they have robust cyberdefenses to prevent intrusions. Still, Wisconsin took its server offline after ProPublica contacted it.
The security flaw: The servers were using File Transfer Protocol (FTP), which is a 40-year-old set of software rules that dictate how networked computers transfer data files. FTP, which sometimes allows files to be transferred anonymously and without encryption, is notoriously insecure. A hacker could take advantage of its weaknesses to compromise a server and then use it to introduce malware or cause it to malfunction.
How it was found: ProPublica used internet protocol addresses for states’ election bodies to see if the servers associated with them had on-ramps to the internet, known as “ports,” that were publicly accessible. Open ports can be used to determine some of the software a server is using.
The bigger picture: As we’ve been reporting, the US electoral system still has plenty of tempting targets for hackers, in spite of efforts to bolster security since the 2016 presidential race. Electronic voting machines are especially vulnerable. Yet in spite of this, we’re still seeing evidence of concerning glitches. In Texas, a technical issue with electronic machines has sometimes caused votes being cast in the hotly contested senate race to be switched accidentally between candidates.
This isn’t the result of a hack—election officials have blamed voters for tapping too fast on screens. But the fact that such a basic issue with the hardware hadn’t been identified and corrected in the run-up to the election is still deeply disturbing.
Everything dies, including information
Digitization can help stem the tide of entropy, but it won’t stop it.
What’s next in cybersecurity
“When it comes to really cutting off ransomware from the source, I think we took a step back.”
Cyber resilience melds data security and protection
Organizations face pervasive and sophisticated cyberattacks, but modern data protection techniques can provide a multifaceted defense.
A new age of disaster recovery planning for SMEs
How cybersecurity threats have morphed, why SMEs need to plan for disaster recovery, and what they should do about it.
Get the latest updates from
MIT Technology Review
Discover special offers, top stories, upcoming events, and more.