Iowa Election App Vulnerable To Hackers

The US media only recently  learned that the Iowa Democratic Party planned to use a mobile app to report the Democrat Presidential Candidate caucus  results in their state, but the party refused to reveal details about the app. 

Now a fault in the smartphone app used to count and report votes from individual precincts has caused a severe delay to the results from Iowa  being made known. 

A  closer look shows that the App had potentially very serious problems that, so far as is presently known, did not come into play. These problems mean the App was  vulnerable to hacking.

The Democrats didn’t publish the app’s source code for independent security researchers to inspect. Nor did they give any information about how thoroughly the app had been tested which apparently it had not been very thoroughly tested. At the time the party wouldn’t even name the vendor that it hired to develop the app, a litlle-known firm named Shadow Inc. saying that doing so could inadvertently help potential cyber attackers.

Elected officials couldn’t get answers, either. The office of Democrta Senator for Oregon. Ron Wyden asked the Democratic National Committee for details about the app three times in lead-up to the Iowa caucuses, but the requests were ignored, 

The App was so insecure that vote totals, passwords and other sensitive information could have been intercepted or even changed, according to officials at Massachusetts-based Veracode, a security firm that reviewed the software.

A lack of adequate safeguards, including transmissions to and from the phone means that data was left largely unprotected. An attack would require some degree of sophistication, but it would have been much easier to pull off had a precinct worker used an open Wi-Fi hotspot to report votes instead of a mobile phone data plan.

To date there is no evidence that hackers intercepted or tampered with caucus results.

The turmoil over counting the votes in Iowa has raised fresh doubts about the election’s integrity. The question that has been asked is was the Iowa caucus chaos is a hit job by election-meddling Russians. The morning after caucus-goers filed into high-school gyms across Iowa, the state’s Democratic Party is still unable to produce results. The app it developed for precisely this purpose seems to have crashed.

The party was questioned by experts about the wisdom of using a secretive app that would be deployed at a crucial juncture, but the concerns were brushed away. Worried about Russian hacking, the party addressed security in all the wrong ways: It did not open up the app to outside testing or challenge by independent security experts.

If the App developer, Shadow Inc. had opened up the app to experts, they likely would have found many bugs, and the app would have been much stronger as a result. An app that is downloaded onto the phones of thousands of precinct officials across Iowa, with varying degrees of phone security and different operating systems, could not be fully protected against Russian or any other hackers. 

Underground “hacks for sale" allow remote attackers to infiltrate phones, especially ones without the latest system updates, as is the case for many Android phones. 

Creating a more hardened phone network is possible, but that would require issuing secure phones to every official, and providing training and technical support. There is no indication that any of that was done.Even without a more substantial reform of the complex and demanding caucus process, a simple adversarial confirmation system, which is a process used by many countries, would have worked well.

The US has experienced previous difficulties with obsolete election technology. The National Academy of Sciences released a lengthy report about it last year, complete with evidence-based recommendations for every step of the electoral process. 

The US Department of Homeland Security offered to test the app for the Iowa Democratic Party, but the party never took the government up on it, according to a US official familiar with the matter who was not authorised to speak publicly. The official said the party did participate in a dry run, known as a tabletop exercise.  
 

DefenseOne:       ProPublica:        The Intercept:

You Might Also Read:

Foreign Cyber Intrusions On The USA:

 

« Preparing Your Employees & Business Systems For A Cyber Attack
Leaked Report: The United Nations Was Hacked »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Navista

Navista

Navista's hardware and software modules are especially designed to ease the deployment of secure networks.

Adeptis Group

Adeptis Group

Adeptis are experts in cyber security recruitment, providing bespoke staffing solutions to safeguard your organisation against ever-changing cyber threats.

Momentum

Momentum

The Cyber Security team at Momentum offers a professional and specialist recruitment service across Cyber & IT Security.

Rohde & Schwarz Cybersecurity

Rohde & Schwarz Cybersecurity

Rohde & Schwarz Cybersecurity provide solutions for Secure Networks, Secure Communications, Network Analysis, and Endpoint Security.

Early Warning Services

Early Warning Services

Early Warning Services identity, authentication and payment solutions empower financial institutions to make confident decisions, enable payments and mitigate fraud.

Sysmosoft

Sysmosoft

Sysmosoft specializes in providing highly secured telecommunication solutions for mobile devices for companies requiring protected access to sensitive data remotely.

PRODAFT

PRODAFT

PRODAFT, Proactive Defense Against Future Threats, is a cyber security and cyber intelligence company providing solutions to commercial customers and government institutions.

Y-PARC

Y-PARC

Y-PARC is a center of excellence for cybersecurity, precision industries and medtech, fostering innovation and development and support for startups.

ToucanX

ToucanX

ToucanX has eliminated remote attack vectors without sacrificing productivity. We’ve brought embedded near real time virtualization to the enterprise endpoint.

Evalian

Evalian

Evalian is a data protection services provider. Working with organisations of all sizes, we specialise in Data Protection, GDPR, ISO Certification & Information Security.

Evina

Evina

Evina offers the most advanced cybersecurity and fraud protection for mobile payment.

ESC - Enterprise Security Center

ESC - Enterprise Security Center

ESC is a system house specializing exclusively in IT security - Security Implementation & Optimization, Operations, Managed Security Services.

CyberCatch

CyberCatch

CyberCatch provides an innovative cybersecurity Software-as-a-Service (SaaS) platform designed for SMBs.

Quantum Security Services

Quantum Security Services

Quantum Security Services is a specialist information security firm providing a range of risk, compliance and technical security services.

TerraEagle

TerraEagle

Terraeagle is a boutique cyber security services company providing tailor-made solutions. Our core competency is in SOCaaS, MDRaaS & and Incident Response Retainer Services.

Tamnoon

Tamnoon

Tamnoon is the Managed Cloud Detection and Response platform that helps you turn CNAPP and CSPM alerts into action and fortify your cloud security posture.