US voting machine certification agency probes potential hack
The US agency charged with ensuring that voting machines meet security standards may have been compromised, according to evidence uncovered by cyber security firm Recorded Future.
In a statement, the EAC confirmed it was investigating a potential breach.
EAC has become aware of a potential intrusion into an EAC web-facing application. The EAC is currently working with Federal law enforcement agencies to investigate the potential breach and its effects.
Recorded Future said it latched onto the "hack" after discovering someone offering log-on credentials for access to computers at the US Election Assistance Commission (EAC) during its regular work monitoring underground cyber markets earlier this month. It claimed it subsequently engaged the seller - whom it dubbed Rasputin - to assess the full scope of the unauthorised access. It reported that "Rasputin" had sent it a systems status report page as evidence that he had obtained access to EAC’s back-end systems.
Further analysis identified more than 100 potentially compromised access credentials, including some with administrative privileges, said the firm. These administrative accounts could potentially be used to access sensitive information as well as to surreptitiously modify or plant malware on the EAC site, an excellent staging ground for a potential watering hole attack targeting government employees.
The EAC is responsible for testing and certifying voting equipment, maintaining the National Voter Registration form, and administering a national clearinghouse on elections. The Commission also accredits testing laboratories and voting systems as well as maintaining an anonymous voter machine fraud reporting system (ie, a confidential whistleblower process).
http://www.theregister.co.uk/2016/12/16/us_election_agency_hacked/
= new reply since forum marked as read
