Logo of Phnom Penh Post newspaper Phnom Penh Post - NEC shrugs off database hack



NEC shrugs off database hack

Content image - Phnom Penh Post
NEC member Rong Chhun speaks to the press about candidate lists for the upcoming commune elections yesterday in Phnom Penh. Pha Lina

NEC shrugs off database hack

Officials and foreign donors yesterday sought to play down concerns over the security of the National Election Committee’s voter list, after anonymous leaker “Thleay” released a video appearing to show manipulation of the database and the NEC confirmed it had been hacked.

The European Union and Japanese government have been major donors to the voter registration process, which saw 7.6 million of the more than 9 million eligible voters registered last year. The ambassador to Cambodia said the technical flaw had been corrected by experts.

The voting list is hugely politically sensitive after opposition parties claimed the 2013 election was stolen by the ruling CPP and ahead of commune elections in June and national elections in 2018.

“Thleay”, which means “leaks” in Khmer, last week released a YouTube video showing what appeared to be the hacking of the NEC’s online database of voters and alteration of one of the entries. The hacker can be seen changing Prime Minister Hun Sen’s name on the list to “Piseth Pilika” – a provocative reference to the late dancer and alleged mistress of the premier.

The hack was apparently conducted using an “SQL injection” that took advantage of vulnerabilities in an online form that allows users to look up their voter information. By exploiting the vulnerability, attackers were able to run their own queries and alter database entries.

NEC spokesman Hang Puthea said the body had detected the hack before the Khmer New Year celebrations and maintained the hacker was only able to change details on the webpage, not the actual list, which is maintained offline.

“We already have [security] measures so the hacker could not go in deep into the list,” he said. “The source of the voter list is in a safe place and has no internet linked to it.”

Asked if authorities were investigating the breach, Puthea declined to comment. Chea Pov, director of the National Police’s cybercrime department, also declined to comment.

The creation of a new voter list, as part of wider electoral reforms, was part of the political deal struck by the two major political parties in the aftermath of the 2013 national elections, when the opposition CNRP contested the result that gave a narrow victory to the CPP.

George Edgar, EU ambassador to Cambodia, said the main voter registration system was separate to the online database, which was only a copy of the offline database.

“We understand that when they became aware of information on the hacking risk, the NEC closed the voter register website,” he said via email. “It has since been reactivated, and restored as a new copy from the original vote register.”

Cybersecurity expert Niklas Femerstrand told The Post that SQL injections were a critical vulnerability in web applications, and noted that even if the main database was offline, the same intrusion could be used to manipulate it if the main list was maintained on the same internal network.

“For this reason it is strongly recommended the NEC considers the database server as fully compromised taking necessary action to reinstall it from scratch,” he said in a message.

Yesterday, the NEC also said it would hand out paper notifications over the next month to each voter informing them of their polling station, but stressed that the notes weren’t a replacement for the ID cards required to cast a ballot.

Meng Sopheary, the opposition Cambodia National Rescue Party’s head of election affairs, expressed concerns that the process of handing out the notifications – which will involve commune councillors, a majority of whom come from the CPP – could be used to improperly campaign among voters.

However, Tep Nytha, secretary-general of the NEC, said election committees consisting of NEC officials, commune councillors and observers would oversee the process, thereby preventing any politicking prior to the two-week campaign period starting May 20.

MOST VIEWED

  • Would you like fries with that? US burger chain makes Phnom Penh debut

    California-based The Habit Burger Grill restaurant chain is all set to serve up a delicious array of charbroiled burgers and sides at its newest international location in the centre of Phnom Penh. The Habit is “renowned for its award-winning Charburgers grilled over an open flame,

  • Banteay Meanchey flood victims receive aid

    Prime Minister Hun Sen on Wednesday provided aid to more than 10,000 families affected by flooding in Banteay Meanchey province’s Mongkol Borei district and offered his condolences to the 18 victims who drowned in the province over the past week. He said flooding had occured in

  • PM urges caution as Polish man tests positive for Covid

    The Ministry of Health on Wednesday reported that a 47-year-old Polish man tested positive for Covid-19 after arriving in Cambodia on Monday. There are a total of six Covid-19 patients currently in the country, all of whom are being treated at the Khmer-Soviet Friendship Hospital

  • Banteay Meanchey floods kill one more as death toll reaches 15

    As floodwaters start to recede in Pursat, Battambang and Pailin provinces and Phnom Penh, Banteay Meanchey continues to bear the brunt as one more person was killed on Monday, bringing the total number of flood-related deaths to 15 in the province this month. Banteay Meanchey provincial

  • Serving coffee with a side of robots

    The eye-catching glass building surrounded by greenery at the intersection of Streets 371 and 2002 in Phnom Penh’s Sen Sok district is more than just another coffee shop where you can while away a few hours. UrHobby House cafe is filled with robots and characters from

  • Floods prompt evacuations in Kampong Speu

    Rain-induced floods and water flowing from Kampong Speu province have submerged the houses of 1,527 families living close to the Prek Thnot River in Spean Thma, Tien, Kong Noy and Roluos communes in Phnom Penh’s Dangkor district, according to data from local authorities. Spean Thma