Just going through the API, its using json/AJAX to get data from a certain file. The only security it has is to check the request origin and blocks if its not 'voter.iebc.or.ke', I don't think its sufficient security because if you can be able to spoof the origin header you can make a script that can allow you to get the entire voter register by looping through id numbers, and even have the ability to filter based on constituency polling station e.t.c. I don't know but am sure this kind of information could be worth something to someone On Tue, Jan 15, 2013 at 11:40 AM, Odhiambo Washington <odhiambo@gmail.com>wrote:
Why is this so much of an issue now? We've had M-Pesa registers with all this data. We've got security desks where we fill in all this data. Is this just to bash the IEBC or is because of the way the data is publicly available online? Well, I guess we have to live with it for now, so guys, start preparing for a steep increase in fraud cases!
On Mon, Jan 14, 2013 at 4:55 PM, Njiri John <njirijohn@gmail.com> wrote:
Information Security cannot be taken for granted. This was a security hole. i agree they could have used maybe the date of birth in addition to the id no. Guys... consider someone picking that data (your name and ID no) making a fake ID , buying a sim card ,registering it and use it to conduct crime using it. Remember for Sim registration you just require a photo copy.
Njiri John
On Mon, Jan 14, 2013 at 4:23 PM, Kivuva <Kivuva@transworldafrica.com>wrote:
A creative fraudster and con-artist can do a lot with combination of Name+IDnumber. We don't need to list those risks here for it to be a possibility.
On 13 January 2013 12:09, John Doe Smith Kamau KipNg'etich Jones < skunkworks.ku@gmail.com> wrote:
Using this app: https://play.google.com/store/apps/details?id=com.maseve.iebcchecker
.... ID numbers like '123456', '1234567', '12345678', '123456789' are apparently valid IDs, hehehehehehehe
On Sunday, January 13, 2013, Jimmy Thuo <jimmy.thuo@gmail.com> wrote:
Alibis really...maybe thats the day you were watching a movie at home alone.
On 13 Jan 2013 10:11, <dhikims@gmail.com> wrote:
IEBC should have put another level of security. I just changed one
number and got my cousins details. Its not so secure, coz I can easily impersonate her with these details.
Sent from my BlackBerry® smartphone provided by Airtel Kenya
-----Original Message----- From: Odhiambo Washington <odhiambo@gmail.com> Sender: skunkworks-bounces@lists.my.co.ke Date: Sun, 13 Jan 2013 10:06:14 To: Skunkworks Mailing List<skunkworks@lists.my.co.ke> Reply-To: Skunkworks Mailing List <skunkworks@lists.my.co.ke> Subject: Re: [Skunkworks] IEBC Online Voter verification flaws
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke _______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- ______________________ Mwendwa Kivuva For Business Development Transworld Computer Channels Cel: 0722402248 twitter.com/lordmwesh www.transworldAfrica.com | Fluent in computing kenya.or.ke | The Kenya we know
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ I can't hear you -- I'm using the scrambler.
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke