Feeds

Pennsylvania officials bail after voter reg site springs a leak

Flaw exposes sensitive user data

Remote control for virtualized desktops

Pennsylvania officials pulled the plug on a voter registration website after a user posted online instructions that showed the site was exposing sensitive information about people who used the service.

The flaw with the state's Voter Registration Application made it possible for anyone on the net to view registration forms that had been completed online. The forms contained a bevy of personal information, including the voter's name, date of birth, driver's license number and political party affiliation, ComputerWorld reports.

The revelation comes a month before the state holds a high-profile presidential primary that could determine who wins the nomination for the Democratic candidate for US President. Users who tried visiting the site on Wednesday got a message that it was not available.

A user with the handle mtg169 first disclosed the leak in on Digg. The post showed that it was possible to view the PDF applications of voters my modifying request parameter included in the URL of the voter registration site. Simply adding or subtracting numbers was all it took to view a different application.

"Valid IDs appear to be working from 50000 and up to 58500+," mtg169 wrote. "Very bad PA ... very very bad!" PA is the US postal abbreviation for Pennsylvania.

In a comment following the post, mtg169 added that IDs in the 20,000 range also exposed applications.

The breach represents a serious blow to the privacy of people who may have used the service. The instructions on Digg had been up for hours before the service was unplugged, and there's no telling how long miscreants had been using the flaw to take a peak at voters' personal details. ®

If you have a tip about the leakage of personal information, please contact your reporter here.

Internet Security Threat Report 2014

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Google Glassholes are UNDATEABLE – HP exec
You need an emotional connection, says touchy-feely MD... We can do that
Lawyers mobilise angry mob against Apple over alleged 2011 Macbook Pro crapness
We suffered 'random bouts of graphical distortion' - fanbois
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
US court SHUTS DOWN 'scammers posing as Microsoft, Facebook support staff'
Netizens allegedly duped into paying for bogus tech advice
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Verizon bankrolls tech news site, bans tech's biggest stories
No agenda here. Just don't ever mention Net neutrality or spying, ok?
Inside the EYE of the TORnado: From Navy spooks to Silk Road
It's hard enough to peel the onion, are you hard enough to eat the core?
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
How to simplify SSL certificate management
Simple steps to take control of SSL certificates across the enterprise, and recommendations centralizing certificate management throughout their lifecycle.