A leaked database containing the voting records of millions of Mexican voters has been discovered by a security researcher. Chris Vickery, who works for MacKeeper, said he first spotted the Mexican voters’ roll—containing the records of 87 million voters in Mexico—on April 14. Vickery told Ars that he found the database with Shodan, a search engine that can find pretty much anything connected to the Internet. “The search term that returned this database was just ‘port:27017’ (the default MongoDB port),” Vickery said. “There really was nothing special about the search terms. It was just a stroke of luck that I saw it and followed up.” He added that the database was not accessible over HTTP: “You had to use a MongoDB client, but all you needed was the IP address. There was nothing protecting it at all.”
The database has since been taken down, however it took Vickery a while to alert Mexican authorities of its existence, he told the BBC. After mentioning the leak during a talk at Harvard University, he was approached by a Mexican person, who helped to authenticate the data.
A journalist, who also happened to be at the talk, helped Vickery to inform the Mexican National Electoral Institute about the database leak. The institute has issued a statement (in Spanish) in which it said that the data had been hosted on Amazon Web Services (AWS).
“A copy of the electoral register has been found in a file storage site of the US company Amazon,” according to the BBC’s translation of the org’s statement. “An internal investigation has been launched and the case has been reported to the special prosecutor for electoral crimes.”
Full Article: Millions of Mexican voter records leaked to Amazon’s cloud, says infosec expert | Ars Technica UK.