Nineteen platforms used by courts and governments in the United States carried critical vulnerabilities that allowed threat actors to tamper with the stored information.
This means highly sensitive information, such as voter data, medical information, and similar, was available for anyone with even rudimentary coding skills, who could have added, changed, or completely removed, the information stored in these platforms.
The warning comes from software developer and cybersecurity researcher Jason Parker, who recently analyzed the platforms used by hundreds of courts, government agencies, police departments, and other critical public organizations, and in an in-depth analysis posted on his blog, noted the platforms failed “at the most fundamental level of cybersecurity.”
No evidence of abuse
The 19 platforms that carried critical vulnerabilities are Inmate Management, Court Case Management Plus, CMS360, CaseLook, eFiling, GovQA, EZ-Filing (v3 and v4), Officer Profile Portal, C-Track, GovQA, Voter Cancellation, and a handful of in-house built platforms. The majority of the flaws revolve around weak permission controls, it was said. Other notable mentions include poor user input validation processes, and flawed authentication processes.
“If a voter’s registration can be canceled with little effort and confidential legal filings can be accessed by unauthorized users, what does it mean for the integrity of these systems?” Parker questioned.
The silver lining here is that there is no evidence of these flaws being exploited in the wild. Still, vendors need to step up and fix the bugs immediately, something customers should demand, as well, Parker stressed. Vendors should also actively engage in pentesting, software audits, employee training, and more. Multi-factor authentication (MFA) should be omnipresent in these platforms, he believes.
“This series of disclosures is a wake-up call to all organizations that manage sensitive public data,” Parker wrote. “If they fail to act quickly, the consequences could be devastating—not just for the institutions themselves but for the individuals whose privacy they are sworn to protect.”
Via Ars Technica
