Research shows gap in House, Senate candidates' website security

Nearly 30 percent of House of Representatives candidates have significant security issues in their websites compared to less than 5 percent of Senate candidates, according to new research.

Nearly 30 percent of House of Representatives candidates have significant security issues in their websites compared to less than 5 percent of Senate candidates, according to new research. The disparity underscores the challenge that smaller, resource-strapped campaigns have in making themselves less vulnerable to hacking.

About 3 in 10 House candidate websites scanned by election-security expert Joshua Franklin and his research team were not using important security protocols for routing data or had a major certificate issue. The scans, most of which took place in June, covered the websites of more than 500 House candidates and nearly 100 Senate candidates.

“The House has significantly more candidates running and that provides more opportunities for security errors,” Franklin told CyberScoop. He presented his findings at the DEF CON conference in Las Vegas. The major political parties’ Senate candidates also tend to be more experienced on the campaign trail and have bigger staffs for those statewide races.

A majority of candidates received good grades overall, with 55 percent of House candidates and 81 percent of Senate candidates receiving an A grade for website security, meaning they had trusted digital certificates and no known vulnerabilities in their security protocols.

Voter registration web applications also earned strong marks, with 70 percent receiving an A or higher.

The findings come amid warnings from U.S. officials that Russia will continue to interfere in U.S. elections. In advance of the 2016 presidential election, Russian hackers probed the IT systems of 21 states, including Illinois, where they breached a voter registration database.

The IT security resources of campaigns vary greatly – big Senate campaigns are generally better equipped to fight off hackers than House candidates in sparsely-populated districts. To try to fill the void, tech companies like Alphabet Inc. are offering candidates free cybersecurity services.

A domain slips through the cracks

Special Counsel Robert Mueller’s June indictment of 12 Russian military officers for hacking Democratic organizations during the 2016 presidential campaign brought an eerie realization for Franklin. The indictment revealed that the Russian hackers had used a domain that mimicked a prominent donation platform in an apparent effort to steal log-in credentials from Democratic operatives.  Franklin’s research team came across the domain in 2016 but did not realize it was malicious.

“It goes to show you how hard detection actually is,” Franklin told DEF CON attendees.

The sprawling research project includes the tedious and ongoing task of contacting all of those with vulnerable websites. Franklin urged political organizations to set up a direct line for vulnerability disclosure if they don’t have one. “Responsible [vulnerability] disclosure is very important in the field of elections,” he said.

Franklin’s presentation was one of several election-security-related discussions at DEF CON. A “voting village” at the conference, where white-hat hackers could tinker with voting equipment, was a high-profile test of government officials’ ability to collaborate with security researchers.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure