#Shellshock live 2 hacked registration
#Shellshock live 2 hacked software

The Shellshock vulnerability is different from the Drupal one Lamb discovered when he visited the Center’s website in 2016. In his affidavit, Lamb said the server appears to have been compromised in December 2014, using an unpatched vulnerability called “Shellshock” that had been publicly revealed and widely reported three months earlier. Only recently was Lamb able to examine the server for evidence of tampering. The FBI had a mirror image of the server, which had been made in March 2017, but state officials fought to prevent the plaintiffs from obtaining it to examine. Logan made the discovery by chance when he visited the Center for Election Systems website to learn more about their role in programming voting machines for Georgia.Īfter the POLITICO story published in June 2017, the plaintiffs filed their lawsuit and sought to obtain the server for evidence supporting their contention that Georgia’s election systems are not secure and could have been tampered with in the 2016 election.īut officials at Kennesaw wiped the server clean shortly after the plaintiffs filed their suit.

#Shellshock live 2 hacked software

That server was already known to have security issues.Īs POLITICO first reported, months before the 2016 election, Lamb discovered that the KSU server was improperly secured so that anyone could access sensitive election data stored on it, and it also had an unpatched vulnerability in so-called Drupal software the server used, which would have allowed attackers to take control of the server and alter or delete data on it, or to post malware that could have infected the computers of election officials accessing the server. The Center for Election Systems at Kennesaw State University, which was responsible for programming all of the voting machines in Georgia before every election, owned and operated the server in question. Kemp served as secretary of state at the time of the 2016 election, before being elected governor in 2018.

Georgia’s secretary of state, Brad Raffensperger, did not respond immediately to a request for comment. But if the server was compromised, it could have been a vehicle to distribute malware to any county election worker who connected to it. Instead, it delivered these files to counties physically. The state has insisted, however, that it never distributed files to program voting machines through the server.

#Shellshock live 2 hacked registration

Georgia used the server to distribute critical election and voter registration files to counties throughout the state. And the public deserves to know,” she said. Now we know that it was a very real risk, but what we don’t know is just how bad did it get. 'hat Logan’s findings show us … is that vulnerabilities were not just hypothetical as the state had been claiming. attempt at accountability by the secretary of state, and the entire programming of elections was outsourced,” said Marilyn Marks, executive director of the Coalition for Good Governance, one of the groups behind the lawsuit. “It creates a very dark cloud over all of the previous elections because as we know there was no way to audit them, there was no.

Lamb declined to speak with POLITICO due to a court order, but one of the groups behind the case said his findings paint a disturbing picture about the state of elections in Georgia. The allegation about the server, first reported by The Associated Press, were contained in an affidavit from Lamb filed Thursday in Atlanta federal court as part of the lawsuit. Lamb, who is an expert witness for the plaintiffs, uncovered the anomalies in an investigation for the plaintiffs. The Georgia server in question has been at the heart of a 2018 lawsuit brought by election integrity activists seeking to bar Georgia from using its paperless voting machines.

Georgia has already been at the center of questions about voter security, due to the fact that the state has used insecure paperless voting machines since 2002.Īdditionally, Georgia counties were among those that Russian hackers targeted in 2016 when they breached some state websites and probed others for vulnerabilities that would have given them access to voter registration databases and other election data and systems.