Slammer worm attacks Dail, reports say

dahamsta · 28-02-2003 12:07am #1

http://www.enn.ie/news.html?code=9351096

The Dail fell victim to the so-called Slammer worm on Wednesday, according to reports. Speaking at a meeting of the Information Systems Security Association, Government Chief Whip and Information Society Minister Mary Hanafin, TD, said that the Dail's voting system, which allows TDs to vote for or against various issues, was infected by a virus believed to be the fast-spreading SQL Slammer worm. Hanafin said the system did not have any anti-virus protection in place.

theciscokid · 28-02-2003 12:47pm

strange isn't it?

so their internal voting system is connected to their internal computers which are in turn connected to the net, unless there was a floppy used from one of the td's

if that is the case,. someone could easily get inside their polling system and corrupt results un-noticed

why didn't they have their polling computers separate and no anti-virus anyway....this really shows the governments complacent attitude towards technology around them.

Typedef · 28-02-2003 12:58pm

why didn't they have their polling computers separate and no anti-virus anyway

Becuase you can bet your arse that the only techie with enough paranoia and knowledge of 'how' to attack systems was complete ignored by the marketing degree/recuritment droid/management IT fascist in department (x), so there was no security (tm) to protect the system.

All hail muppets who think that there superior management knowledge, gives them the ability to make tech desicions.

Yes, I was attacked by a marketing degree as a child.

JohnK · 28-02-2003 1:05pm

...so their internal voting system is connected to their internal computers which are in turn connected to the net...

Thats just disturbing

scojones · 28-02-2003 1:14pm

What a bunch of ****ing tossers. In fairness. ****ing gov't.

yellum · 28-02-2003 2:13pm

Originally posted by sjones
What a bunch of ****ing tossers. In fairness. ****ing gov't.

Yeah stupid majority of people voting the mother ****s in

dahamsta · 28-02-2003 3:00pm

I'm surprised no-one has extended this to electronic voting in the elections yet. If the internal systems are insecure - and you can't get much more insecure than this - why should we trust the external systems used in elections? Have any independent tests been performed? Can I see the reports somewhere?

adam

theciscokid · 28-02-2003 4:03pm

Originally posted by dahamsta
I'm surprised no-one has extended this to electronic voting in the elections yet. If the internal systems are insecure - and you can't get much more insecure than this - why should we trust the external systems used in elections? Have any independent tests been performed? Can I see the reports somewhere?

adam

damn right, if public data is sent back to presumably the same sort of systems it is quite possible

theciscokid · 28-02-2003 4:07pm

check this out , taken from www.2600.com now it is american but it could be based on a similar design

ENGINEER BLOWS WHISTLE OVER TAINTED VOTING BOOTHS, FILES LAWSUIT

Posted 27 Feb 2003 07:31:53 UTC
A former employee of electronic voting booth maker VoteHere has filed a civil suit against the firm, claiming that the company's digital balloting systems contain error-laden software which has never been properly audited.

Daniel B. Spillane, whose job at VoteHere was terminated in the summer of 2001, claims that the company's voting software contains severe programming errors which could lead to massive deletion of ballots, among other problems. The company's touch-screen voting booths have been sold in a number of districts.

Spillane says that auditors from an Independent Test Authority (ITA) failed to properly review the voting booth software prior to giving it their seal of approval. ITA is the name of a technology auditing process licensed to contractors by the National Association of State Election Directors (NASED).

Spillane also claims that VoteHere undertook measures designed specifically to thwart the ITA review process. He initially took his concerns to VoteHere executives, but those actions led to his dismissal just hours before a crucial company meeting with ITA auditors and the U.S. General Accounting Office, which at the time was reviewing the ITA process.

A grant proposal for election modernization was released by NASED shortly after Spillane's dismissal, requesting a federal grant "burdened by very few conditions." In a transparent denial of the challenges of secure digital balloting, the proposal scoffs at the concept of new mechanisms which might assure that new systems comply with federal election laws. "All conditions [of the grant] should be concretely related to specific, demonstrated issues with our current election administration process," it reads (emphasis added).

Spillane is not the first engineer to question the wisdom of such electronic balloting systems. Noted Bryn Mawr Bohemian Dr. Rebecca Mercuri wrote in November about Sequoia Voting Systems, an outfit seeking to install electronic voting booths in Santa Clara County, California. Most of Sequoia's machines provide nothing in the way of receipts or physical audit trails which would facilitate a recount, ripening the prospects for electronic election fraud. She and other experts have also been barred from examining Sequoia's product, because it is sold under restrictive trade-secret agreements.

Spillane, Mercuri, and 453 other technologists have endorsed a "Resolution on Electronic Voting" which warns of the dangers inherent in electronic voting systems that keep only digital records of ballots cast. The resolution states that programming error, equipment malfunction, and malicious tampering are serious risks which call for a voter-verifiable audit trail -- a permanent, physical, tamper-resistant record of each vote which can be checked by the voter before casting their ballot, and retained afterward.

Despite the resolution, Santa Clara County made its final decision on Tuesday to spend $20M on 5,000 touch-screen voting booths made by Sequoia, most of which will not include a printed audit trail. Sequoia has a history of involvement with government corruption, including the pay-off of Louisiana election official Jerry Fowler.

Spillane filed his suit against VoteHere on the same day, claiming $475,000 in lost wages and other damages.

Typedef · 28-02-2003 4:15pm

Err, just a note.

It's quite obvious the Dial's IT department hasn't a notion about security, seriously, if it did, there would be a range of Unix systems in place, to prevent really basic things like infection of pretty critical systems (like dial voting systems).

This is what happens when you let the business grads (instead of the techies) make decisions about software in use, network security paradigms and so on.

Qed.

ecksor · 28-02-2003 4:48pm

It is fairly clear that someone made a huge mistake here and hopefully this will be filed under lessons learned and we'll see more care taken with government systems in future. If anyone actually has some information on how this situation came to pass then I'd be interested in hearing (not saying that some of the speculation on this thread isn't likely or probable).

Where responsibility lies for this is an interesting question, but I don't think it is being properly addressed here. I mean, if the government hired a company to build a bridge and the bridge was found to be unsafe, would people be complaining that the government don't put enough care into bridge building? I'm inclined to wonder who was hired to implement this system, how they justified connecting it to the Internet, whether they did any sort of risk analysis that might lead them to the conclusion that maybe it shouldn't be on the Internet, whether or not they gave any assurances that it couldn't be tampered with easily by outside parties, etc etc.

I was at the ISSA meeting that the minister is quoted as speaking at, and she didn't mention the slammer worm when she mentioned that the system had been infected by a virus. She did explain the reasons they had been given for having no AV software in place, which were certainly implausible in my opinion. And one saving grace I'd note is that the system failed during the routine testing before being used to vote, so perhaps the overall dependence on the technology is actually quite low with adequate failsafes such as this routine testing actually reducing the risk to an acceptable level? (No, I don't think that's likely, but I'm throwing you people some bones to actually have an intelligent thread about this).

p.s. ONE MORE BL33T ABOUT HOW SOME POOR BL33TING TECHIE WAS IGNORED, THE POOR DIDDUMS, OR THAT THEY SHOULD HAVE BEEN RUNNING UNIX COS THAT WOULD HAVE PROTECTED THEM OR ANYTHING ELSE THAT I CONSIDER TO BE COMPLETE AND UTTER MUPPETRY WILL GET YOU BANNED FOR A WEEK!!

BogoBot · 28-02-2003 5:35pm

Originally posted by ecksor
I was at the ISSA meeting that the minister is quoted as speaking at, and she didn't mention the slammer worm when she mentioned that the system had been infected by a virus. She did explain the reasons they had been given for having no AV software in place, which were certainly implausible in my opinion.

I was also at the ISSA meeting. Actually, I was sitting behind a journo who began to scribble furiously when the Minister mentioned the voting problems........fast forward to next day and I was very confused at the coverage of a virus problem in the Dail.
Did I zone out while she gave more details or is there another source for this story?

As an aside, I thought her speech was rather weak and I was disappointed to see her leave early regardless of her other duties.

Bogobot.

ecksor · 28-02-2003 5:43pm

She said that a virus had caused a problem. She also said that the reason she'd heard for no AV software being installed was that it interfered with some countdown that's built into the process.

I thought her speech was fine. Someone at her level preaching that we need more assurance in our online systems can only be a good thing, no?

If there was a vote in the house that evening, then I think those duties should be her first priority ...

Slammer worm attacks Dail, reports say

Comments