Did Little Bobby Tables migrate to Sweden?
Posted by Jonas Elfström Thu, 23 Sep 2010 20:36:00 GMT
As you may have heard, we've had a very close election here in Sweden. Today the Swedish Election Authority published the hand written votes. While scanning through them I happened to notice
R;13;Hallands län;80;Halmstad;01;Halmstads västra valkrets;0904;Söndrum 4;pwn DROP TABLE VALJ;1
The second to last field1 is the actual text on the ballot2. Could it be that Little Bobby Tables is all grown up and has migrated to Sweden? Well, it's probably just a joke but even so it brings questions since an SQL-injection on election data would be very serious.
Someone even tried to get some JavaScript in there:
R;14;Västra Götalands län;80;Göteborg;03;Göteborg, Centrum;0722;Centrum, Övre Johanneberg;(Script src=http://hittepa.webs.com/x.txt);1
I'm pleased to see that they published the list as text and not HTML. This hacker/joker voter seems to think3 they "censored" his vote/script. I'm not so sure about that, a more reasonable explanation is that they couldn't enter brackets, quotation marks, and so on.
There are also a couple of URL:s to online retailers and three votes on a conspiracy friendly site. I chose not to link to any of those.
This time the pen and paper scripting attack failed. Let's hope it stays that way.
PS. Someone noticed that there are no votes from Stockholm in there right now (2010-09-24). I asked the Swedish Election Authority about this and it turns out that The County Administrative Board (Länsstyrelsen) gets two months to register all the handwritten votes. There's a good chance that those will bring more attempts like the ones above. DS.
EDIT 2010-09-24
Links:
Aftonbladet DN SvD Expressen SVT - all in Swedish.
Slashdot BBC Wired
1The name of the party, not a name of a person.
2Almost all Swedish voters use the preprinted ballots but you are allowed to write your own by hand.
3The site disappeared after this post was published.
Okay, now Sweden is my second favourite country after Iceland :)
Cheers,
Ruben
That’s really a great idea, will try this in Germany, too. Luckily, this XKCD strip is one of the fewer ones that I actually (think I) do understand.
@Uwe: I suppose you haven’t been to an election in Germany yet. There are no write-in votes here. If a ballot contains any kind of commentary it will be considered invalid and merely counted as such. I wouldn’t bet on being able to achieve any integer overflows either considering that the ballots are counted manually. ;-)
I would recommend that you place your vote on a real party instead.
@Name
There ist one exception:
If there is an election of the mayor, you are allowed to write the name of the person you want to become mayor on the ballot, if you don’t agree with the prewritten choices on it.
That is awesome.
Kind of reminds me of this story: https://www.sysedata.no/nyheter/edvin-tables#english.
Making assuptions of lack of security often creates funny situations :)
@ name: in some of germany’s federal states you can propose your own candidate if it’s a mayoral election in a small commune
@ topic: gogo gadget javascript
@yaw
you could also start a party and try to get on the ballot. You need about 2000 signatures in one Bundesland … As far as I know der no juristic restrictions on the party name ;)
@Name: Elections for mayors, at least in Germany’s federal state of Baden-Wuerttemberg allow voters to put a handwritten name on the ballot. So this idea is applicable in Germany as well.
Haha, that’s about the only good thing this election has brought us.
However, unless you possess the ability to time travel (kudos if you do), I’d say that now should probably be 2010-09-24 and not 2010-10-24.
So I should have voted for “Myself;1000000” to get a million votes?
Why cast 1 vote when you could cast 10 :)
@Martin Thanks! Corrected.
Haha, candidate called Kalle Anka got 178 handwritten votes, which is quite a lot in a situation where 800 votes made a difference between majority and minority:-)
@finnjävel igen “Kalle Anka” is the name of donald duck in sweden ;D but your name sounds scandinavian..u probably know that already ^^
@yaw and others: Thank you for correcting me, I did not know that. So, @Uwe, good luck with your project :)
This is big news here in Sweden and totally blown out of proportion.
http://www.aftonbladet.se/nyheter/valet2010/article7844634.ab
http://www.svd.se/nyheter/politik/valet2010/forsokte-hacka-valet-med-rostsedlar_5394833.svd
http://www.expressen.se/nyheter/val2010/1.2149620/forsokte-hacka-valet-med-rostsedlar
Same thing in the Finnish IT press: http://www.mikropc.net/kaikki_uutiset/article506116.ece http://www.tietoviikko.fi/kehittaja/article506196.ece
http://www.dn.se/nyheter/valet2010/forsokte-hacka-valet-med-rostsedlar-1.1176677
Argh. Someone should recall their “utgivningsbevis”. This is so stupid.
http://bit.ly/by6uDd
If those findings show anything, than that: your swedish voting software seems to be secure in terms of Web Application Security. Be proud!
I occasionally code SQL to interface with customer data-bases. It had never occurred to me that the syntax of the overall SQL statement could be short-circuited in this way. Now that I think of it, it is rather obvious. One thing I do before accepting a character field is run it against a routine to double quote marks–this may prevent the attack. Does anyone know?
(Naturally, quote marks & special characters in a numeric field trigger an edit error right away.)
@Lurker111 There are a lot of good advice on how to prevent SQL injection on Wikipedia.
Lurker….character encoding might just work
The Swedish Election Authority actually got back to you? Kudos!
Yes they did. They actually answered in a couple of hours.
Are there any legal implications with votes trying to mess up the voting system? I guess, there authorities are not too happy with these attempts but as nothing happened and the votes are anonymous, there is nothing, they can do :) And at first, I thought that “hittepa” was an attempt to write “http”, hehe.
Haha wicked!
Haha, nice idea, will start a party and try to get on the ballot. A win with predefined margin is guaranteed :)
I wonder if little Bobby Tables is planning to migrate to the US as the 2012 presidential election is just a few months away. HA!