Three of every 10 candidates running for the U.S. House of Representatives have significant security problems with their websites, according to a new study by independent researchers that underscores the threat hackers pose to the November elections.
The research was due to be unveiled on Sunday at the annual Def Con security conference in Las Vegas, where some attendees have spent three days hacking into voting machines to highlight vulnerabilities in technology running polling operations.
A team of four independent researchers led by former National Institutes for Standards and Technology security expert Joshua Franklin concluded that the websites of nearly one-third of U.S. House candidates, Democrats and Republicans alike, are vulnerable to attacks. NIST is a U.S. Commerce Department laboratory that provides advice on technical issues, including cyber security.
Using automated scans and test programs, the team identified multiple vulnerabilities, including problems with digital certificates used to verify secure connections with users, Franklin told Reuters ahead of the presentation.
The warnings about the midterm elections, which are less than three months away, come after Democrats have spent more than a year working to bolster cyber defenses of the party’s national, state and campaign operations.
Democratic National Committee officials told Reuters they have completely rebuilt the party’s computer network, including email systems and databases, to avert a repeat of 2016, when Russian intelligence agents hacked into Democratic accounts and then used stolen data to undermine support for Hillary Clinton’s presidential bid.
“No one wants to be the next ‘patient zero,’” said DNC Chief Technology Officer Raffi Krikorian, a former executive with Twitter and Uber.
The report follows a string of warnings by Trump administration security officials that Russia is actively interfering in the November elections. FBI Director Christopher Wray recently warned that Russian government agents were working around the clock to sow discord ahead of the election.
Democratic Senator Claire McCaskill, who is facing a tough re-election battle in Missouri, last month said that hackers had tried and failed to access her office’s computer network. The Def Con study did not address that incident.
The researchers did not identify any cases where it appeared that politically motivated hackers had exploited those vulnerabilities.
“We’re trying to figure out a way to contact all the candidates” so they can fix the problems, said Franklin, who joined the nonprofit Center for Internet Security last month.
Department of Homeland Security officials said at Def Con that they are offering aid to states and counties for securing election equipment.
Still, some states said they are not getting enough help, and new funding efforts failed in Congress. Individual campaigns are not eligible for federal assistance, so they rely on party officials, an increased number of tech-savvy volunteers and nonprofit groups such as Defending Digital Democracy, a bipartisan project at the Kennedy School of Government at Harvard University.
Franklin also said he found numerous potentially malicious web pages that closely resemble the names of candidates. Hackers use that practice, known as “typo-squatting,” to develop copycat sites for use in phishing campaigns to steal credentials or to criticize candidates.
The candidates at most risk of hacks are ones with small campaigns that have with little expertise in computer technology or security, Franklin said.
STEPS BY THE DNC
The Democratic National Committee agreed to discuss some steps it has taken to bolster security in the hope it can serve as a model for other election offices.
Since Krikorian joined the DNC a year ago, the party has moved email and data storage to Google cloud and replaced most Windows computers with easier-to-defend Apple hardware and Google Chromebooks, he said.
The party also requires staff to fill out monthly surveys pledging that they are following key security practices, including use of two-factor authentication for personal accounts, long and unique passwords, and encryption on computers. They are also asked if they are running operating systems and application software with up-to-date security patches.
The party uses software from San Francisco-based Okta that grants access to DNC systems only after testing devices to confirm the identity of users and verify they are not running malicious software.
The biggest change has been psychological, as staffers and volunteers are trained to assume that the network has been breached, avoid putting the most sensitive information in emails and use end-to-end encrypted messaging like Signal.
The party is also reaching out to campaigns and stressing basic precautions.
DNC Chief Security Officer Bob Lord, a former security executive with Yahoo and Twitter, sent an email a week ago to state party leaders, urging them not to use phones from Chinese manufacturers Huawei [HWT.UL] and ZTE Corp.
U.S. intelligence officials have warned that Chinese authorities could seek to use those devices to spy on Americans.
Reporting by Joseph Menn in Las Vegas; Editing by Jim Finkle and Steve Orlofsky
Oil prices soar more than 10% after Saudi plant attacks
Oil prices surged more than 10 percent Monday after attacks on two Saudi Arabian plants that slashed output in the world's top producer by half, with Donald Trump blaming Iran and raising the possibility of a military strike on the country.
West Texas Intermediate jumped 10.68 percent to $60.71 and Brent climbed 11.77 percent to $67.31 in early Asia trading following the blasts at facilities run by state-owned giant Aramco.
The attack by Tehran-backed Huthi rebels in neighbouring Yemen, where a Saudi-led coalition is bogged down in a five-year war, effectively shut down six percent of the global oil supply.
Trump used to play Elton John at ‘eardrum-rupturing decibels’ on campaign plane for a bizarre reason: AP reporter
MSNBC's Joe Scarborough and Mika Brzezinski mocked President Donald Trump's fixation on singer Elton John.
The rock legend reportedly rejected his longtime fan's invitation to perform at his January 2017 inauguration, and Trump has bitterly fixated on breaking John's attendance records at arenas where he holds campaign rallies.
"The saddest part of this story was when Donald Trump asked his staff members had anybody been writing about the Elton John attendance records that he supposedly broke," Scarborough said. "They said no, and he was angry and upset for days about that, also claiming that it was one more example of how, in the immortal words of Rodney Dangerfield, he don't get no respect."
‘RIP GOP’: Polling expert predicts devastating Trump 2020 electoral wipeout
Democratic pollster and strategist Stanley Greenberg went on CNN Monday to explain why he believes President Donald Trump and the Republican Party are headed toward a historic and humiliating defeat in the 2020 elections.
In an interview with CNN's John Berman, Greenberg discussed his new book called "RIP GOP" in which he makes a case that Trump's presidency has shifted public opinion in Democrats' favor while repelling moderate voters from the Republican Party.
"I think what happened going into 2016 is Donald Trump took over the Tea Party base of the party, allied it with evangelicals and took the party to a very extreme end," he said. "I believe... Donald Trump's election will speed the defeat of the Republican Party because of its dominance by the Tea Party and evangelicals, which won't consider compromise, which won't consider a multicultural America in a part of our future. And I also thought it would speed up the resistance and also people's consciousness of what they believe and their values, and all of that has happened."