3Sep 22 7:08 PM · 1d ago · 2 comments · 1 source · development 3 of 4
A commenter disclosed that Ohio's voter registration database is still running on Visual FoxPro and has TOTP-based MFA that can be bypassed by directly opening the underlying database files, illustrating the real-world security implications of the revival.
“One of the "certified" (wrong terminology) Board of Elections voter registration databases for Ohio is written in VFP and has TOTP 'MFA' to comply with a Secretary of State mandate. You can just open the database files directly.”
EvanAnderson
boredjohnnyFoxDev Studio creatormikestewSecurity researcher, former FoxPro developerMicrosoftFoxPro publisher (discontinued 2007)
The whole story articlespostscommentsthe bright band is this development · numbered dots are the others · click one to jump
Thanks, this is the most useful comment here. FoxDev reads the DBC the same way VFP does, so today it inherits the hole exactly. The runtime is actually the one place it can be fixed. I would put in a hash of the stored procedure text into the built executable and refuse to run a container whose procs don't match. Adding it to the list. Would you…
One of the "certified" (wrong terminology) Board of Elections voter registration databases for Ohio is written in VFP and has TOTP 'MFA' to comply with a Secretary of State mandate.You can just open the database files directly.I hang my head.