Officials blame “sophisticated” Russian hackers for voter system attacks

The profile of attacks on two US state voter registration systems this summer presented in an FBI "Flash" memo suggests that the states were hit by a fairly typical sort of intrusion. But an Arizona official said that the Federal Bureau of Investigation had attributed an attack that succeeded only in capturing a single user's login credentials to Russian hackers and rated the threat from the attack as an "eight on a scale of ten" in severity. An Illinois state official characterized the more successful attack on that state's system as "highly sophisticated" based on information from the FBI.

Arizona Secretary of State Office Communications Director Matt Roberts told the Post's Ellen Nakashima that the FBI had alerted Arizona officials in June of an attack by Russians, though the FBI did not state whether they were state-sponsored or criminal hackers. The attack did not gain access to any state or county voter registration system, but the username and password of a single election official was stolen. Roberts did not respond to requests from Ars for clarification on the timeline and other details of the attack.

Based on the details provided by Roberts to the Post, it's not clear if the Arizona incident was one of the two referred to in the FBI "Flash" published this month. The FBI has not responded to questions about the memorandum on the attacks first published publicly by Yahoo News' Michael Isikoff, but a SQL injection attack wouldn't seem to be the likely culprit for stealing a single username and password. It's more likely that the Gila County election official whose credentials were stolen was the victim of a phishing attack or malware.

The Illinois breach was described in detail by a message to county election officials by Kyle Thomas of the Illinois State Board of Elections. The attack, which began in June, was detected on July 12; the site was shut down, forcing the state to revert to paper voter registration for more than a week. The paperless Illinois Voter Registration System (IVRS) was specifically targeted by the attack, Thomas said:

On July 13th, once the severity of the attack was realized, as a precautionary measure, the entire IVRS system was shut down, including online voter registration. The pathway into IVRS was NOT through our firewalls but through a vulnerability on our public web page that an applicant may use to check the status of their online voter registration application. The method used was SQL injection. The offenders were able to inject SQL database queries into the IVRS database in order to access information. This was a highly sophisticated attack most likely from a foreign (international) entity. We have found no evidence that they added, changed, or deleted any information in the IVRS database. Their efforts to obtain voter signature images and voter history were unsuccessful. They were able to retrieve a number of voter records. We are in the process of determining the exact number of voter records and specific names of all individuals affected.

The characterization of the attack on the Illinois system as "highly sophisticated" doesn't necessarily match the techniques described by the FBI Cyber Division's memorandum. As Thomas noted, the attackers used a public, non-secure webpage to gain access—a page that tapped directly into the voter rolls from outside the firewall without any data validation. And as Ars reported yesterday, the vulnerability was discovered by the attackers with software from Acunetix, a security tools firm based in London and Malta, along with other free and open source software—software that is usually used to validate the security of websites rather than break into them.

"Acunetix automatically crawls and scans websites and Web applications to identify Web application level vulnerabilities that may then be exploited to gain access to databases and other trusted systems," said Acunetix General Manager Chris Martin in an e-mail to Ars. "The idea behind Acunetix is for a website owner to use it to assess the security posture of its website and Web applications for exploitable code before the bad guys get to do that for their own nefarious aims."

Martin said that the Acunetix team had checked the IP addresses mentioned in the FBI report as the source of the attackers' scans and said that they "cannot link those IP addresses to any legitimate installation of Acunetix technology. Unfortunately, as with all successful independent software vendors, Acunetix is pirated, and illegal unlicensed copies are used without authorization." He added that Acunetix is volunteering assistance to the FBI in its investigation.

For what it's worth, voter registration rolls in Illinois are public records, supplied widely to campaigns and other organizations for direct-mail campaigns. And after the attack, passwords were reset on the IVRS—with a new password policy requiring a minimum of eight characters, at least one being non-alphanumeric.