Capitol Fax.com - Your Illinois News Radar » “Foreign” hack attack on state voter registration site
SUBSCRIBE to Capitol Fax      Advertise Here      Mobile Version     Exclusive Subscriber Content     Updated Posts    Contact
CapitolFax.com
To subscribe to Capitol Fax, click here.
“Foreign” hack attack on state voter registration site

Thursday, Jul 21, 2016

* From the McLean County Clerk’s Facebook page

The State Board of Elections (SBE) fell victim to a cyberattack that was detected on July 12, 2016. Specifically, the target was the [Illinois Vital Records System] database. Once discovered, State Board of Elections closed the point of entry. On July 13th, once the severity of the attack was realized, as a precautionary measure, the entire IVRS system was shut down, including online voter registration.

SBE’s Information Technology and Voting and Registration Systems staff immediately began researching the extent of the infiltration. Thus far, we have determined the following:

    · The pathway into IVRS was NOT through our firewalls but through a vulnerability on our public web page that an applicant may use to check the status of their online voter registration application.
    · The method used was SQL injection. The offenders were able to inject SQL database queries into the IVRS database in order to access information. This was a highly sophisticated attack most likely from a foreign (international) entity.
    · We have found no evidence that they added, changed, or deleted any information in the IVRS database. Their efforts to obtain voter signature images and voter history were unsuccessful.
    · They were able to retrieve a number of voter records. We are in the process of determining the exact number of voter records and specific names of all individuals affected. (Because of the complex methods used to access the data, this may take 10-15 days.)
    · In an effort to prevent an attack such as this from happening in the future, we have made a number of security enhancements to the IVRS and POVA systems.
    · Once the system is brought back online, all IVRS user passwords will need to be changed at the first login (or by your vendor for system specific accounts). The new password must be a minimum of eight characters in length, one of which must be a non-alphanumeric character ($, *, # etc.).

Pursuant to the Personal Information Protection Act (815 ILCS530/), the Illinois General Assembly and the Office of the Attorney General have been notified of the incursion. Furthermore, once we have determined the number of voter records and the individuals whose information was collected, we are prepared to take the proper steps required to notify those persons.

A separate notification will be sent indicating when you and your staff may access IVRS. Thank you for your patience regarding this matter.

Kyle Thomas
Illinois State Board of Elections
Director-Voting and Registration Systems

* Dan Petrela

The registration database is a frequent target of cyberattacks, [Ken Menzel, the Illinois State Board of Elections’ general counsel] said, but “this is the first time that we’re aware of that anybody’s gotten into anything — not for lack of trying .”

Menzel said the board is confident that no voter information in the database was altered and will follow the proper notification procedures if any personal information was compromised.

- Posted by Rich Miller        

15 Comments
  1. - Union Dues - Thursday, Jul 21, 16 @ 12:37 pm:

    SQL injection is not an advanced techique at all and only possible if your web page is poorly written.


  2. - Ghost - Thursday, Jul 21, 16 @ 12:39 pm:

    Points to them for detecting this and their actions afterward. well done.


  3. - Formerly Known as Frenchie M - Thursday, Jul 21, 16 @ 12:42 pm:

    I’m sorry this happened — but there’s very little excuse these days to not prevent a SQL injection attack. They’ve been — for years — a primary attack vector for publicly accessible websites.

    Another issue, though, and one that’s even more troubling — and something I don’t see in the post — is how the passwords were stored (encrypted? properly salted and then hashed?). They say the passwords need to be changed — and that’s good. But I hope — I hope — they’re stored properly.


  4. - Bigtwich - Thursday, Jul 21, 16 @ 12:58 pm:

    So, an early story today was about,

    “Schneider complimenting Rauner’s campaign for helping get tons more data and info on IL voters”

    Hum? s/


  5. - illinois manufacturer - Thursday, Jul 21, 16 @ 1:05 pm:

    Probably China but funny on Rauner. China has been hacking huge amounts of medical data.No one really knows why


  6. - Skeptic - Thursday, Jul 21, 16 @ 1:19 pm:

    *facepalm* You got breached by SQL Injection? Really?


  7. - Jon - Thursday, Jul 21, 16 @ 1:32 pm:

    Isn’t Vital Records, like birth certificates, etc., IDPH, not SBOE? Could it be Illinois Voter Registration System?


  8. - Honeybear - Thursday, Jul 21, 16 @ 1:47 pm:

    I don’t know what this all means but it sounds quite bad.


  9. - PENSIONS ARE OFF LIMITS - Thursday, Jul 21, 16 @ 1:57 pm:

    SQL injection is hacking 101. The superstars at the newly created division of IT definitely dropped the ball here. “Phony” superstars.


  10. - Rhino - Thursday, Jul 21, 16 @ 3:42 pm:

    The registration database is not private but is supposed to be available to anyone at any time. The key question is whether data was or could have been altered. If not, no harm, no foul.


  11. - Arthur Andersen - Thursday, Jul 21, 16 @ 4:38 pm:

    All snark aside, they need a guy like John Bambenek right now.


  12. - Downstate Libertarian - Thursday, Jul 21, 16 @ 6:15 pm:

    Not happy to see this. As other said, it is not an advanced attack. Not happy to see the password standards that are in place. Considering the “sophistication” of the attack, the point raised by Formerly… is a definite concern. Would not be surprised that any encryption not be up to current standards and salting is probably out of the question.


  13. - PENSIONS ARE OFF LIMITS - Thursday, Jul 21, 16 @ 9:33 pm:

    These rookies need to figure out what information was obtained. I’m not going to tell them what constitutes a breach. I ain’t no superstar. Hint: PIPA


  14. - PENSIONS ARE OFF LIMITS - Thursday, Jul 21, 16 @ 9:38 pm:

    Rhino

    There is personal information in the database that is not publicly available. SQL injection gets that information from a poorly hosted website. Don’t argue for people who messed up. Ever.


  15. - OneMan - Monday, Jul 25, 16 @ 3:23 pm:

    Guess they should be thankful Little Bobby Tables isn’t of voting age yet.

    https://xkcd.com/327/

    Others have said it, but SQL injection is not a sophisticated attack.

    Is the IVRS more than just voter data?


Sorry, comments for this post are now closed.


* Question of the day
* Russians revived the Chicago Daily News before Twitter shut it down
* Harith Augustus coverage roundup
* Transitions: Baise, Denzler, Demmer, DeWitte, Mazzochi
* Caption contest!
* *** LIVE *** Campaign finance reports
* Rauner denies tacking to the right with Pence praise
* Rauner signs Firearms Restraining Order Act, 72-hour gun purchase waiting period, will veto gun shop regulation bill
* John McGovern: "An honorable man in politics"
* *** UPDATED x1 - Rauner to veto *** Raoul to Rauner: "Get us out of Crosscheck"
* Unclear on the concept
* Mitchell is "a foot in the door for the next generation"
* *** LIVE COVERAGE ***
* Yesterday's stories

Support CapitolFax.com
Visit our advertisers...

...............

...............

...............

...............
<


Loading


* Rauner signs pair of gun bills..
* New Law Keeps Guns Away from Those Deemed '.....
* Gov. Rauner signs two gun control bills, says h.....
* Lobbying business for former Madigan aid.....
* Five at 5: Rauner signs pair of gun control mea.....
* Rauner urged to help more parents..
* Illinois governor receives mixed reaction for o.....
* Question of the day..
* New Illinois program to offer retirement saving.....
* Gov. Rauner Signs Two New Guns Laws..


* SIU trustees vote for ending Randy Dunn’s presidency
* 2 CVS workers lose jobs after cops called on black customer
* Illinois pastor unpaid for FBI, police tips made 2 years ago
* Illinois governor signs 2 bills to tighten gun restrictions
* The Latest: Spokesman says officers can conduct pat downs.
* Chicago activist demands all footage from police shooting
* Correction: CVS-Black Customer story
* Rauner signs gun order of protection, waiting period laws
* Groups getting $11.5 million for children’s mental health
* Authorities: 2-year-old child dies after Illinois house fire

* Gov. Rauner signs two gun control bills, says he'll veto another
* Rauner doesn't want Illinois pulled from multistate voter registration system
* Londrigan outraises Davis in 2nd quarter; Davis has more in fund
* Gov. Rauner signs two gun control bills
* Londrigan outraises Davis in 3rd quarter; Davis has more in fund
* Durbin not confident Illinois election systems are secure
* Jeff Keicher to finish Bob Pritchard's term in Illinois House
* New Illinois program to offer retirement savings plan
* Illinois Governor's Mansion reopens to public
* State agency director Mays has spent $66K on travel

* Ana Dutra resigns as CEO of Executives' Club of Chicago
* University chiefs take a hit from tax bill
* Big Pharma's metabolism is slowing down
* FCC rejects Sinclair plan for TV station sales in Tribune deal


* EDITORIAL: Police shooting of Harith Augustus demands a thorough investigation
* Missing 45-year-old man last seen in Loop, family ‘extremely concerned’
* Reactions to police-involved shooting in South Shore shows wide divide
* CPS to add social workers, case managers, but not enough for CTU
* 2 Democratic senators, 3 House Republicans agree on Trump’s Helsinki comments
* 4 in custody in connection with home invasion in Hammond
* Internal competition could fuel Blackhawks’ blue line for years to come
* Emanuel outraises all of his opponents combined
* 2 found fatally shot about a mile apart in Gary
* ‘Hamilton’ exhibition postpones Chicago opening


* CTA Blue Line halted at Logan Square after object thrown on tracks, agency says
* Showtime comes naturally for All-Stars Javier Baez, Willson Contreras
* France star Antoine Griezmann after World Cup win: 'I love Derrick Rose'
* Lawmakers call Trump's press conference with Putin 'bizarre,' 'shameful'
* Niles auction to feature political memorabilia, personal items belonging to late Congressman Dan Rostenkowski
* Alderman asks for water-safety changes after 13-year-old's drowning, proposes task force
* Lava flies through roof of Hawaiian tour boat, injuring 23
* One step back, huge step forward for Mariners All-Star outfielder Mitch Haniger
* Beach Boys still get around, will perform in New Buffalo
* After historic summit, Trump offers little pushback to Putin's denial of election interference


» Cook County Commissioners Confounded By Hiring Of Health System Consultant
» Third Party Candidates for Governor; Student Loans & Retirement Saving; New Illinois Made Makers
» CPD Officer Shoots And Kills Man In South Shore
» Durbin Says He Hasn't Taken Position on SCOTUS Pick — Also Has Doubts About Election Security
» Look Inside The Renovated Governor's Mansion
» Angry Crowd Protests After Chicago Police Fatally Shoot Man
» Chicago Police: Man Killed By Police Appeared To Be Armed
» State Week: SCOTUS Nominee, Dan Ryan Protest, Misleading Ads
» Controversy Over Firing Of Popular Chicago Public Schools Principal


* Londrigan outraises Davis in 2nd quarter; Davis has more in fund
* Gov. Rauner signs two gun control bills, says he'll veto another
* Rauner doesn't want Illinois pulled from multistate voter registration system
* Gov. Rauner signs two gun control bills
* Londrigan outraises Davis in 3rd quarter; Davis has more in fund
* Durbin not confident Illinois election systems are secure
* Jeff Keicher to finish Bob Pritchard's term in Illinois House
* George Will: Don't fix baseball, even if it may be broken
* New Illinois program to offer retirement savings plan
* Illinois Governor's Mansion reopens to public


* Woman charged with using cord to choke, beat child
* Troy couple injured in three-vehicle crash
* Two charged with burglarizing rural home; one escapes from custody
* Sleepy driver cited in crash on I-64, police say
* Boil order issued in Murphysboro
* Get ready Decatur: America In Bloom judges arrive Wednesday
* Five at 5: Rauner signs pair of gun control measures and 4 other stories to see
* Pope County pastor unpaid for FBI, police tips made 2 years ago
* State Police respond to I-57 crash involving Union County Sheriff patrol car
* Northbound I-255 clear after previous restriction to 2 lanes near Caseyville


* SIU trustees vote for ending Randy Dunn's presidency
* Feder: ABC 7's Cheryl Scott engaged 'on top of the world'
* Illinois lawmakers pile on Trump/Putin summit, use the 'T' word
* Boomers want to replace stadium press box with lounge for suite holders
* Underwood outraises Hultgren in latest campaign finance report

* Nearly 100 Indian American candidates runn...
* FBI agent defiant as Republicans claim bia...
* Ex-FBI Lawyer Testifies to House Panels on...
* Republicans praise Page's testimony on...
* Rod Rosenstein Calls for United Front Agai...
* 'Just a dumb move': Democrats dism...
* Rep. Meadows: Strzok Bias Should Have Led ...
* Underwood outraises Hultgren in latest cam...
* Ant-Man and the Wasp end credits scene: Di...
* I Have a Weird Theory about Ant-Man and Th...

* Rep. Brad Schneider Slams Trump Press Conf......
* 2 Democratic senators, 3 House Republicans......
* Illinois lawmakers pile on Trump/Putin sum......
* Local Congress members react to Trump-Puti......
* Lake County Clerk: No local results from 2......

* Trump's Own Team: He 'Looked Incre......
* QC lawmakers have different responses to T......
* Illinois lawmakers pile on Trump/Putin sum......
* Tammy Duckworth says Putin has turn......
* Trump-Putin Press Conference Slammed By Lo......

* Slow and Steady
* Bi-partisan criticism broils about Trump's comments during post-summit press conference Monday
* A judge ordered Trump to unite kids and their parents.
* Garry McCarthy.
* The [Wednesday] Papers
* The [Monday] Papers
* So, You Think You're Tolerant?
* Illinois School District Threatens to Call Police over Bible Giveaway
* Where’s Weyermuller? Running 5k with Team Patlak for Safe Haven Foundation
* Illinois Governor's mansion is reopened


* Gov. Rauner meets one of oldest living WWII veterans
* IDOT reopening lanes where possible for July 4 travel
* Bellock named DHFS director
* Follow-Up Samples from the Illinois River Show No Microcystins
* Illinois Department of Public Health Heat Safety Tips

  
* Amazon Prime Day 2018: the best deals
* GPU Turbo update confirmed for these Huawei devices (Update: Not coming to US)
* Watch: iPhone survives 450 foot fall from amusement park ride
* Amazon Prime Day 2018 deals: All the best tech deals on the internet
* Amazon’s Nintendo Switch Prime Day deal bundles a 64GB microSD and $20 eShop gift card for $299.99
* Paralyzed man invents hands-free instrument. Now he wants to play the anthem at a MLB game
* Apple unveils new emoji on World Emoji Day

* Play Ball holds clinic on South Side
* Where Cubs and White Sox players will bat in All-Star lineup
* White Sox Weekly Minor League Update: Week 15
* White Sox Weekly Minor League Update: Week 15
* Powell: First Half Takeaways For The Cubs And White Sox
* Join the SSS team!
* Lambert, Johnson on Pipeline Team of the Week


Main Menu
Home
Illinois
YouTube
Pundit rankings
Obama
Subscriber Content
Durbin
Burris
Blagojevich Trial
Advertising
Updated Posts
Polls

Archives
July 2018
June 2018
May 2018
April 2018
March 2018
February 2018
January 2018
December 2017
November 2017
October 2017
September 2017
August 2017
July 2017
June 2017
May 2017
April 2017
March 2017
February 2017
January 2017
December 2016
November 2016
October 2016
September 2016
August 2016
July 2016
June 2016
May 2016
April 2016
March 2016
February 2016
January 2016
December 2015
November 2015
October 2015
September 2015
August 2015
July 2015
June 2015
May 2015
April 2015
March 2015
February 2015
January 2015
December 2014
November 2014
October 2014
September 2014
August 2014
July 2014
June 2014
May 2014
April 2014
March 2014
February 2014
January 2014
December 2013
November 2013
October 2013
September 2013
August 2013
July 2013
June 2013
May 2013
April 2013
March 2013
February 2013
January 2013
December 2012
November 2012
October 2012
September 2012
August 2012
July 2012
June 2012
May 2012
April 2012
March 2012
February 2012
January 2012
December 2011
November 2011
October 2011
September 2011
August 2011
July 2011
June 2011
May 2011
April 2011
March 2011
February 2011
January 2011
December 2010
November 2010
October 2010
September 2010
August 2010
July 2010
June 2010
May 2010
April 2010
March 2010
February 2010
January 2010
December 2009
November 2009
October 2009
September 2009
August 2009
July 2009
June 2009
May 2009
April 2009
March 2009
February 2009
January 2009
December 2008
November 2008
October 2008
September 2008
August 2008
July 2008
June 2008
May 2008
April 2008
March 2008
February 2008
January 2008
December 2007
November 2007
October 2007
September 2007
August 2007
July 2007
June 2007
May 2007
April 2007
March 2007
February 2007
January 2007
December 2006
November 2006
October 2006
September 2006
August 2006
July 2006
June 2006
May 2006
April 2006
March 2006
February 2006
January 2006
December 2005
April 2005
March 2005
February 2005
January 2005
December 2004
November 2004
October 2004

Blog*Spot Archives
November 2005
October 2005
September 2005
August 2005
July 2005
June 2005
May 2005

Syndication

RSS Feed 2.0
Comments RSS 2.0
WordPress




Hosted by MCS SUBSCRIBE to Capitol Fax Advertise Here Mobile Version Contact Rich Miller