With voting in Pennsylvania's presidential primary just a month away, the state was forced to pull the plug on a voter registration Web site Tuesday after it was found to be exposing sensitive data about voters in the state.
The problem lay in an online voter registration application form that was designed to simplify the task of registering to vote. State residents used it to enter their information on the Web site, which then generated a printable form that could be mailed to state election officials. Pennsylvania's Department of State disabled the registration form late Tuesday after being informed of the vulnerability by IDG News Service.
[ Learn more about how technology is reshaping the race for the U.S. presidency in InfoWorld's special report. ]
Because of a Web programming error, the Web site was allowing anyone on the Internet to view the forms, which contained data such as the voter's name, date of birth, driver's license number, and political party affiliation. On some forms, the last four digits of Social Security numbers could also be seen.
"Upon learning of this situation, the Department of State acted immediately to disable the specific page," said Department of State spokeswoman Leslie Amoros in an e-mail message.
"The Department is reviewing the facts to determine how this information became available," she said. "We are also taking all necessary steps to correct the situation and are implementing processes aimed to prevent future occurrences."
The flaw was first reported by a reader of Digg.com, who stumbled upon the bug after filling out a voter registration form.
"Being a security conscious programmer, I decided to test," wrote the reader, identified only as mtg169, "Very bad PA...very very bad!"
The bug did not expose all registration data, just the information supplied by those who used the Web site's online form. About 30,000 voter registration records appeared to be available on the site.
"That's bad, really bad," said Jeremiah Grossman, chief technology officer with Web security vendor WhiteHat Security. In an e-mail, he said he hadn't seen this type of error on a voter registration Web site before, but that it was caused by a common Web programming error. "We've seen a great many vulnerabilities like this in the course of doing our work."
Many counties offer online access to voter registration data so that residents can check on their status, but these databases typically remove data that could be misused, such as date of birth, Social Security numbers, and driver's license numbers.
The last four digits of a Social Security number are often used as a security question, required to access certain types of billing accounts, and a skilled identity thief could use a driver's license number, name, and address in a check forging scheme, according to privacy experts.
This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.
Download now »
Server virtualization is a popular option for dealing with mounting datacenter costs. Another equally promising approach is the use of an Application Delivery Controller. Citrix NetScaler provides a low-cost way for organizations to reduce their server count and accrue cost savings from a reduction in space, cooling, power and personnel.
Download now »
The emergence of WLANs has created a new breed of security threats to enterprise networks.
Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation
Effectively address data protection challenges, implementing solutions that help store and protect business–critical data while cutting costs and improving efficiency and reliability.
Download now »
Sign up to receive Security Resource Alerts
This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.
Download now! »
Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.
Download now! »
Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.
Download now! »
Recommend This
