Misconfigurations on software are just there to be found, to then be patched or exploited.
And here, a misconfiguration in 'Elector', an app used by Israeli Prime Minister Benjamin Netanyahu and his Likud party, has exposed data of 6,453,254 registered eligible voters in the country.
Reported by several Israeli's news agencies, it was suggested that the exposed data included the full names, identity card numbers, addresses, gender, the phone numbers and other personal details of some of them, as well as whether they are registered members of the various parties.
The report noted that the Elector app was used to communicate with voters using text messages, and managing the data about voters and voting stations. The app was part of Likud's ways of managing its campaign.
The misconfigured app here made it possible for anyone to view and download all of the data without any special technical requirement or hack.
What people needed to do, was to only right-clicking on the Elector app's home page and choosing "view source" to reveal the original code of the internet page.
And this code revealed a link to get־admins־users page, where all of the administrators' usernames and passwords are located, allowing anyone to log in as one of the administrators and have a full access to download the entire registry, including the most up-to-date information available to the Central Elections Committee for all Israeli adult citizens.
Israeli political parties receive personal details of voters before the elections take place. The parties have committed to protect voters' privacy, and said that they won't reproduce the registry, not to provide it to a third party, and to permanently erase all the information once the election is over.
The misconfiguration happened to be found by an anonymous person, obtained by Cybercyber podcast and shared with some local new agencies. The anonymous tipper also provided personal details of some powerful people in Israel obtained from the database.
Upon learning of it, the news agencies informed the National Cyber Directorate, which in turn reported it to the Privacy Protection Authority.
While it is unknown how many people gained access to the data and downloaded it, the application has users in various countries, including the United States, China, Russia and Moldova.
Likud, or officially called the Likud – National Liberal Movement, is a center-right to right-wing political party in Israel.
The secular party was founded in 1973 by Menachem Begin and Ariel Sharon in an alliance with several right-wing parties. The first notable win for Likud was back in the 1977 election, considered the turning point the Israel's political history, marking the first time the left had lost power.
In the past, Likud has been involved in previous information security scandals. The party’s database of its own voters has leaked a number of times to the web.
The party’s primary system was also hacked, allowing any internet user to make changes to it. And in this software misconfiguration, the details of all citizens were leaked, regardless of whether they were affiliated to Likud.
News of the data breach came just weeks before Israelis go to the elections for the third time in under a year.
The developer of the app quickly reconfigured the app, and said that the mishap was a “one-off incident that was immediately dealt with," and that security measures have since been boosted.
The only known leak of a similar magnitude occurred in 2006, when an Interior Ministry employee stole the population registry and leaked a database with data of over 9 million people illegally.
