Pierluigi Paganini
May 10, 2016
The security researcher David Levin, the owner of Vanguard Cybersecurity, was arrested and charged after discovering serious security flaws on a couple of elections websites in Florida.
In December Levin discovered that the elections website of Lee County was affected by an SQL injection vulnerability that allowed access to credentials stored in plain text. The expert also analyzed the Florida Division of Elections website discovering security vulnerabilities.
At this point, the researcher reported the issue to a supervisor of elections candidate, in January he made a video PoC of the SQL injection flaw that allowed him to access the credentials stored in the back-end of the elections website and then reported the issue to the Supervisor of Elections Office.
Unfortunately, the authorities arrested David Levin of Estero for unauthorized access of Lee County and state elections websites. He was released on a $15,000 bond after a few hours.
“The Florida Department of Law Enforcementaccused the 31-year-old Estero man of hacking into the state elections website Jan. 4 and Jan. 31. He hacked into the Lee County elections website Dec. 19.” reads the news-press.com website.
The Florida Department of Law Enforcement confirmed that the expert exploited on a SQL Injection flaw in order to compromise the election website.
He hacked into the state elections website two times in January and one into the Lee County elections site in December.
“An SQL (Structured Query Language) is a code injection technique used to attack data-driven applications. An SQL injection enables an individual to obtain secure information, such as usernames and passwords, from vulnerable sources.”
Levin was released by the police on a $15,000 bond after a few hours.
It is hilarious, Levin thought he was doing the right thing, but authorities had a different opinion about his activities.
[adrotate banner=”9″]
(Security Affairs – elections websites, hacking)
