Fellow networking/programming people: want to see something terrifying from Georgia?

[Recursion]

Link to tweet

Let's focus in on that photo just a little bit:



2011.

The web server hasn't been updated or patched since 2011. Since the year Kemp took over as Secretary of State.

[MontanaMama]

1. Damn it.

Seriously? This is dereliction of duty. Wonder how many states have this issue?

[SWBTATTReg]

2. Just because this is on there, doesn't mean that updates haven't been applied...perhaps ...

the money wasn't there to change the copyright notice. It does require either a code change or table edit change to implement, which of course, cost money.

[Recursion]

6. The patches change the copyright notice for licensing reasons

And Apache is about as "corporate" as an open source project gets: they make sure they dot their i's with that stuff.

[BumRushDaShow]

9. That's not how it works.

When you update versions, the version numbers change on the screen. You can do a query on the version too and get it. And Apache is open source and "free". No $$$ involved. The labor to do the maintenance on it would obviously have a cost but that should be something included in a maintenance contract with either outside techs and/or included in the duties of the state's IT staff if they handle or oversee it.

The only other issue here might be whatever software application the system is using that probably bundled that version of Apache and whether that system was even updated and/or could even run on the newer web server implementations without some major modification.

[SWBTATTReg]

15. The software I worked on had to have the copyright notice changed. Just because in Apache ...

it doesn't need to be changed or edited doesn't mean that for 100% of all software, that it doesn't need to be changed. It depends on the software and I didn't know enough about Apache nor was the information provided in the orig. post to determine this.

[BumRushDaShow]

19. Unless it is some type of in-house/home-grown/DIY code

most organizations "publicly" copyright their work and follow traditional code change versioning (i.e., denoting "major" / "minor" ).

To me, this appears to literally be a stock Apache install at the level that probably came bundled with the system they bought (the same version that eventually spawned Tomcat too). Quite a few things come bundled with web servers (whether they are enabled or not) and really, for a system that is to be used by some government entity that may end up with parts that are public-facing, there really needs to be some kind of schedule of maintenance on it.

[lapfog_1]

3. apache security issues

From the Apache project home page:

Apache httpd 2.2 is End-of-Life since December 2017 and should not be used. This page only lists security issues that occurred before the End-of-Life. Subsequent issues may have affected 2.2 but will not be investigated or listed here. Users are advised to upgrade to the currently supported released version to address known issues.


https://httpd.apache.org/security/vulnerabilities_22.html

[MattP]

4. Judge should have forced paper ballots on them

Courts have been horrible in voter cases saying yes you're horrible but it's ok

[BumRushDaShow]

5. Apache is up to v2.4.37

And even v 2.2.x is already at end of life for patches as of 2017.

https://httpd.apache.org/



They can't really do anything with that now. It would probably require a whole new parallel install and then transition to the new version (after major UAT, etc).

[Recursion]

7. Even RedHat deprecated 2.2 with their last release

If you're moving slower than RedHat, you're moving too slowly.

[BumRushDaShow]

14. Bwah!

Yeah, 2.2 is old!

I remember briefly running RH 6.0 (had been running 5.1 - various versions including for Sparc and Alpha) with 2.2 and decided to just go back to my SuSE (now OpenSuSE) on my desktop. Of course now RH is gonna be owned by IBM. Guess it was a matter of time.

[Quackers]

31. Here's a list of version releases and updates.

Version Initial release Latest release
1.3 1998-06-06[49] 2010-02-03 (1.3.42)[50]
2.0 2002-04-06[51] 2013-07-10 (2.0.65)[52]
2.2 2005-12-01[53] 2017-07-11 (2.2.34)[54]
2.4 2012-02-21[55] 2018-10-23 (2.4.37)[56]

The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich and freely available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.[57][58][59]

Apache 2.4 dropped support for BeOS, TPF and even older platforms.[8]

[BumRushDaShow]

37. "Apache 2.4 dropped support for BeOS"

I remember Be operating system (at least the free version). Had been out during the period when I was fooling around with the various pre-windoze 95 OSes that came out in the '90s, and that also included OS/2.

Feeling old now...

[2naSalit]

8. THis needs to be known by more than just us.

What a sham, and this is obviously intentional.

[Recursion]

11. Vickery's well known in the security world

He's got 20K followers, and they include a lot of tech CIOs and CTOs.

[2naSalit]

13. Good to know

All I can do, at this point is meditate on what it would be like to have a solid takeover in Congress.

[SWBTATTReg]

10. This points to a common problems w/ users and software...some companies change their ...

software versions so rapidly and oftentimes users are struggling to keep up with the changes. This was one of my top issues w/ IBM and all of its changes it made to software on a constant basis. And IBM isn't / wasn't the only company doing this practice. I know that fixes and the like are required, but the user community is oftentimes struggling to keep up w/ all of the updates.

Something as sensitive as the web server as described in this original post, I don't know. Depending upon the security enacted by the carrier(s) it may or may not be a problem. Perhaps the web server is behind a firewall located at a provider's host site. Too many open ended ?s as to true impact.

[Recursion]

12. There have been over 800 bugs filed against Apache since 2011

And nearly all of them are in-band, i.e., it's a perfectly legal HTTP request that a firewall would let through that compromises the server in some way.

[SWBTATTReg]

16. Only 800? Seems like a rather small number. Again, depends on the software. nt

[BumRushDaShow]

20. Open source was originally intended to have "many eyes" on it

so the code they release and deem as "stable" would have had a better chance of having issues caught before getting that designation vs proprietary systems (like windoze... ).

[Recursion]

24. Well, many thousands of "bugs" were filed, 800+ were serious enough to rate a CVE entry (nt)

[TheBlackAdder]

29. At least they're being fixed, unlike the Open-Source community which is invaded by hackers.

.

The fallacy is the open-source is better, yet their development communities are taken over by nation state actors and hackers. People thing that open-source is safer because people review it. It turns out, that besides academia, doing it, most reviews are by hackers.

Many companies are using the Spring framework, which is rife with security exposures, and it's last fix was in 2017.

.

[Recursion]

32. Apache is open-source.

And it has a significantly better security record than its closed-source competitors.

[TheBlackAdder]

34. Yeah, but years ago IBM look over the funding and lead on it, much like they did with Linux.

[Afromania]

17. yikes.

[uponit7771]

18. omfg

[greymattermom]

21. I'm a precinct manager in Georgia 6.

The machines are ancient, so nothing surprises me. But we are careful to report the correct number of voters, and the machines won't be out of my sight until I take the final counts to the county. Georgia has no party affiliation when you register, so it's hard to guess outcomes. We are being told to prepare for a possible run off (I hope not, I won't be in the country that day.) Republicans are running against Nancy Pelosi, and that's getting old around here. Jon Ossoff wasn't Nancy Pelosi, and neither is Lucy McBath. They are even suggesting that local candidates like Sally Harrell are somehow the image of Nancy Pelosi. That seems really weird to me.

[hueymahl]

38. I share your observations about the Rethugs campaign tactics

Seem like a last ditch effort to scare their base into coming out.

Thanks for your work at the precincts!

[CCExile]

22. If Georgia is like Texas

Republicans refuse to offer good pay for technical support. Many years ago in Austin, TX a job with the state paid a full third less than the City of Austin for the same work. That did not attract the best and brightest. Their tech managers were the worst.

[Roy Rolling]

23. Whatever the details . . .

Politicians should not be making decisions about complex online computer security. Not having competent and unbiased network pprofessionals overseeing these agencies is a BIG problem.

[usaf-vet]

25. We have all heard the saying "if it ain't broke don't fix it"

Well maybe, considering it's GA, the voting system ain't broke it's doing exactly what the republicans want it to do.

Stealing votes?
Allowing remote access?
Allowing remote access for altering the final tallies?
Keeping suppressed voter suppressed via a DIY patch?

One more extended message.

IGNORE THE POLLS.... YOU GET OUT AND VOTE!

[TheBlackAdder]

28. Yep. Working as intended and designed.

[TheBlackAdder]

26. Guaranteed, if there is SSL being used, it's the weak TLS1.0 standard.

[knightmaar]

27. And Heartbleed?

[Recursion]

33. If it's bundled, it's too old to have heartbleed. Small favors

But the entire protocol stack of TLS1 suffers from design problems.

[33taw]

30. After working in IT for nearly 30 years - I ask for PAPER BALLOTS!!

This may be difficult in some locations, but I always ask and have been accommodated.

[33taw]

35. Without know their server structure, we cannot verify that voter data is on this server.

We can only determine that the server delivering this message may not have had Apache patches since 2011.

[FakeNoose]

36. Malfeasance - Brian Kemp needs to be retired immediately

Best of luck to Stacey Abrams and all Georgia Democrats!