How Secure is the daftarj.spr.gov.my Website?

UPDATE: 5th March 2008, 15:48 See the screenshot below.





The election is coming soon, and for those of you who are voting, please vote wisely. One thing that catches my attention for a few months now is the http://daftarj.spr.gov.my/ website. This website is pretty straightforward - you key in your IC number, and if you are registered voter, it will display your polling center (basically where you need to poll-lah). The hacker underground in Malaysia have been telling me that the website have some flaws, most notably SQL injection. The website uses Javascript to filter unwanted characters (like spaces, quotes, etc) and sanitize the IC number. Of course if you go to the main page, you won't see the HTML source, you'll get a source page with says "cannot view source". The actual source page is at http://daftarj.spr.gov.my/daftarnewbi.asp. So basically, an attacker can modify the HTML page, and bypass the client-side filter. I will not verify whether this website is vulnerable to direct SQL injection attack, but reports from the underground seem to say so.

Another issue according to others is that the website is also vulnerable to blind SQL injection attack. Again, I have no intention to verify this.

But one thing is for sure - the privacy of registered voters are at risk. This particular website doesn't require authentication to check voting status. You can check your status as many times as you want, consecutively. This means that an attacker can write a script that generate random IC numbers. This is extremely trivial since the format of our IC number is birthdate-statecode-fourdigitcode. A five-line Ruby, Perl or Python script will achieve this - and an attacker can let his script run for days, if not months. And if he's lucky, he'll get you full name, your permanent address, your polling center, and so on. What he's gonna with the data is up to imagination.

So today I tested this manually (no, I don't have any scripts cause I am too lazy at the moment) and one thing that caught my attention is not the results that I got (yes, I can perform checks without any limitation), but rather the "Checking to" counter below the textbox. If I am right, it counts the number of checks performed. What I found is that between my manual checks (less than 7 seconds) the counter increases by 25-30. Does it mean that there are roughly 25 online users checking their voting status at the same time - or has someone written a script and start polling (heh) the database?

OK what if the programmer screwed up and had his additions all wrong - such a simple mistake anyways, right? Well, if the programmer can make a simple mistake...