The Tech That Fought Back: How I Turned My Rejected ShmooCon Talk into a Democracy Saving Research Project for the 2024 U.S. Election

The Tech That Fought Back: How I Turned My Rejected ShmooCon Talk into a Democracy Saving Research Project for the 2024 U.S. Election

Speakers: Andrew Schoka

Conference: ShmooCon

YouTube: https://www.youtube.com/watch?v=5YHcw-qj094

Overview

In this compelling ShmooCon talk, Andrew Schoka presents a stark look into the precarious cybersecurity posture of political campaign and party websites across the United States, particularly at the state and local levels. What began as a rejected talk proposal evolved into a critical research project aimed at safeguarding the integrity of the 2024 U.S. election. Schoka highlights how prevalent, yet often overlooked, vulnerabilities in these digital infrastructures pose significant risks, not to the vote count itself, but to the operational continuity and public trust in democratic processes.

Schoka's research uncovers a systemic problem rooted in the cyclical nature of campaign technology, leading to "Frankensteined" website deployments that expose sensitive personal data and lack fundamental protections against common cyber threats. The talk meticulously details how attackers, even with low technical sophistication, could exploit these weaknesses to disrupt campaigns, spread misinformation, or compromise individuals involved in political activities. This issue is not partisan; the speaker found no statistical difference in vulnerability rates between Republican and Democratic party sites.

The talk transcends mere problem identification, pivoting to a crucial discussion on actionable solutions and the challenges of implementing them within the political sphere. Schoka emphasizes the necessity of building trust, engaging with campaigns where they are, and collaborating with established non-profits to deliver vital cybersecurity resources. His work serves as a powerful call to action for the cybersecurity community, urging professionals to leverage their expertise to bolster the digital defenses of democratic institutions, underscoring the profound impact that seemingly minor technical oversights can have on the democratic process.

Background

▶ Watch: Initial problem: recycled, vulnerable political websites (2:00)

The genesis of this research project stemmed from Andrew Schoka's initial observation of a pervasive, yet unaddressed, vulnerability landscape within political campaign websites. His early attempts to present these findings were met with rejection, primarily due to a perceived lack of focus on solutions. This feedback catalyzed a shift in his approach, transforming a technical curiosity into a mission-driven research endeavor aimed at practical impact.

The fundamental problem identified by Schoka lies in the lifecycle of political campaign websites. These sites are often built on tech stacks that are recycled every two to four years, resulting in what he terms "Frankensteined deployments." Campaigns frequently layer new platforms and services on top of existing, often outdated, infrastructures without proper decommissioning or security review. This creates a patchwork of technologies that are difficult to manage and inherently insecure. A common pattern Schoka noticed was the widespread listing of phone numbers, email addresses, and other personal information directly on these websites.

To systematically investigate this, Schoka developed methods to identify and collect political campaign websites at scale. He initially scoured public records of political party and campaign spending, where websites are often registered as part of funding disclosures. Another key strategy involved traversing national party websites to find links to their state and county party affiliates. As he delved deeper into state and local races, the websites became increasingly disparate and less professionally managed. Utilizing named entity recognition techniques, Schoka expanded his reach, growing his initial dataset from approximately 3,000 websites to an impressive 50,000 to 60,000 domains, mail servers, and associated online properties. This extensive data collection formed the foundation for his subsequent technical analysis and vulnerability identification.

Key Findings

▶ Watch: Introducing Hookshot: the custom scraping tool (4:00)

Andrew Schoka's research illuminated two primary categories of systemic vulnerabilities plaguing political campaign websites: widespread personal data exposure and a critical lack of fundamental cybersecurity protections.

Firstly, the investigation revealed an alarming prevalence of private account exposure. Schoka discovered that tens of thousands of websites were inadvertently publishing sensitive information such as private email addresses, phone numbers, home addresses, and other personal details. This exposure wasn't limited to direct listings; it also extended to data embedded in attachments or linked through various third-party applications integrated into the sites. A classic example cited was Cloudflare's email obfuscation service, a JavaScript applet designed to hide email addresses from bots. However, Schoka demonstrated that this "security through obscurity" measure is easily defeated, as the original email address remains discoverable within the HTML source code. More concerning were the artifacts left behind by "sandwiched deployments," where old website platforms or widgets (like Google Drive files or Wix endpoints) continued to host data even after new site designs were implemented, creating forgotten data repositories.

Crucially, Schoka found no statistically significant difference in the ratio of exposed private accounts or the rate at which those accounts had been compromised in data breaches between Republican and Democratic party websites. This indicated a bipartisan, systemic issue rather than a partisan one. Furthermore, by correlating exposed email addresses with leaked data from his extensive hoard of hack/breach information, he found instances of extremely weak, politically themed passwords (e.g., "Maga 2024") being used on accounts associated with these websites. This combination of widespread data exposure and poor password hygiene means that an attacker with minimal technical skill could collect information, correlate it to a campaign, and potentially gain access to associated accounts.

Secondly, the research highlighted a severe deficiency in basic web security infrastructure and DDoS protection. Schoka specifically examined the adoption of DMARC (Domain-based Message Authentication, Reporting, and Conformance) for email authentication and the presence of basic DDoS mitigation services, such as those offered by Cloudflare (which even provides a free program for campaigns). His findings indicated a widespread failure to implement these crucial safeguards. This lack of protection presents a significant risk, as Schoka articulated a "nightmare scenario": a website for a swing county in a swing state being taken down or defaced on Election Day. An attacker could easily modify the site to disseminate false information, such as incorrect poll closing times, without needing to "hack" the election itself. The level of technical sophistication and security investment was observed to drop dramatically as one moved from national and state-level campaigns down to local races for school boards or county sheriffs, pointing to a fundamental resourcing problem.

Technical Deep Dive

▶ Watch: Technical vulnerabilities: email obfuscation and old deployments (4:50)

The core of Andrew Schoka's technical investigation relied on a custom-built tool named Hookshot. This open-source utility, available on GitHub, was developed specifically to address the challenge of comprehensively scanning and analyzing tens of thousands of political websites for security vulnerabilities and data exposure. While Schoka candidly described Hookshot as "by no means production quality" and "very much hacked together," he affirmed its effectiveness in its specialized task.

Hookshot's primary function is to scrape a large volume of websites—upwards of 50,000 in Schoka's research—to identify and extract specific types of sensitive information. This includes private email addresses, phone numbers, physical addresses, and other personally identifiable information (PII). The tool is designed to go beyond surface-level content, delving into various data sources:

• Direct HTML content: Parsing the visible text and underlying code of web pages.
• Attachments: Identifying and potentially analyzing linked files (e.g., PDFs, documents) that might contain sensitive data.
• Third-party applications: Recognizing and extracting data from widgets or services embedded within the website but hosted externally. This is particularly relevant for the "sandwiched deployments" phenomenon.

A key capability of Hookshot involves correlating the extracted information with existing threat intelligence sources. Schoka specifically mentioned comparing findings against public databases like Have I Been Pwned, which tracks data breaches, and other Infrasec threat intelligence sources. This correlation allows for the identification of exposed accounts whose credentials may already be compromised, significantly escalating the risk profile of the affected campaigns.

The talk detailed specific technical vulnerabilities Hookshot was designed to detect:

• Cloudflare's email obfuscation: This common technique uses JavaScript to dynamically render email addresses on a webpage, aiming to prevent automated bots from scraping them. In the HTML source, the email appears as an obfuscated string. Hookshot (or any sufficiently capable scraper) can easily reverse this obfuscation by either executing the JavaScript or by reverse-engineering the obfuscation algorithm from the source code, revealing the cleartext email address. Schoka characterized this as a "classic example of security through obscurity."
• Sandwiched deployments and residual data: Campaigns frequently replace or update their website platforms without fully migrating or decommissioning older services. This leads to new platforms being "sandwiched" on top of older ones. Hookshot identifies artifacts like old Google Drive files or Wix endpoints that were previously used to store or display data. Even if these links are no longer prominently featured on the new site, they often remain active and publicly accessible, serving as forgotten repositories of sensitive information that can be easily discovered.
• Lack of DMARC implementation: Hookshot also assesses the presence and configuration of DMARC records for a domain. DMARC is an email authentication protocol designed to protect against email spoofing, phishing, and other unauthorized use of email domains. Its absence makes campaigns vulnerable to email-based attacks that impersonate their official communications.
• Absence of DDoS protection: The tool also checks for the implementation of basic DDoS protection services, such as those provided by Cloudflare. The lack of such protection leaves campaign websites susceptible to denial-of-service attacks, which can render them inaccessible to voters, especially during critical periods like Election Day.

By leveraging Hookshot's capabilities, Schoka was able to paint a comprehensive picture of the systemic security weaknesses prevalent across the U.S. political landscape, providing empirical evidence for the risks posed by these digital shortcomings.

Demo / Proof of Concept

▶ Watch: Second risk: lack of basic DDoS protection (7:00)

While the talk did not feature a live, interactive demonstration in the traditional sense, Andrew Schoka presented compelling evidence and visualizations of his findings, effectively serving as a proof of concept for the vulnerabilities he identified. He displayed screenshots of actual campaign websites, illustrating the "Frankensteined deployments" and the visible artifacts of old, insecure integrations. These screenshots highlighted how various third-party widgets and remnants of previous platforms inadvertently exposed data.

Schoka explicitly mentioned and showed examples of Cloudflare's email obfuscation being easily circumvented, demonstrating how an email address that appears obfuscated to a casual browser is readily available in cleartext within the HTML source. He also referred to visual representations of his data, using arbitrary colors to differentiate between findings but emphasizing that the statistical outcomes (ratios of exposed accounts, breach rates) were remarkably similar across different political affiliations. The existence and capabilities of his Hookshot tool, publicly available on GitHub, further serve as a functional proof of concept, allowing others to replicate his methodology and verify the extent of these vulnerabilities. The technical deep dive into Hookshot's functionality, combined with the visual examples, effectively conveyed the nature and impact of the discovered issues.

Defensive Implications

▶ Watch: Systemic resourcing problem in local campaigns (8:00)

Andrew Schoka's research provides critical insights for cybersecurity defenders, particularly those concerned with the integrity of democratic processes. The defensive implications are multifaceted, extending beyond technical fixes to encompass strategic engagement and community involvement.

The paramount challenge identified by Schoka is trust. The politically charged environment means that a cybersecurity provider aligned with one party may struggle to gain the trust of another, effectively alienating half of the potential "customer base." To overcome this, defenders must identify and collaborate with trusted agents—individuals or organizations with established, bipartisan credibility within the political sphere. These trusted intermediaries are crucial for effectively communicating technical risks to campaigns and parties without being perceived as partisan.

Defenders must also meet campaigns where they are. It is insufficient to discuss these risks solely within cybersecurity conferences; the message needs to be delivered directly to campaign staff and volunteers who may lack technical expertise. This means translating complex cybersecurity concepts into tangible risks for their operations, their personal security, and their voters. The focus should always be on the solution, rather than merely admiring the problem. Schoka's personal lesson from his rejected talk was to always present actionable ways to fix the identified issues.

A significant defensive strategy involves partnering with non-profit organizations dedicated to campaign security. Schoka specifically lauded Defending Digital Campaigns (DDC), led by Michael Kaiser, as an "awesome nonprofit" that provides vital resources to campaigns from a trusted, non-partisan position. Collaborating with such entities allows researchers and security professionals to disseminate their findings and recommended solutions through established channels, ensuring the information reaches the right audience and is acted upon. For instance, DDC can convey to a campaign, "Hey look, you've got some account information related to your website that's out there... you should go in and change them," lending credibility and urgency that an individual researcher might not possess.

Furthermore, identifying internal champions within political organizations is essential. Schoka cited his positive interaction with the DNC CISO, Steve, as an example of how finding someone internally who understands the risk and has the authority to effect change can significantly accelerate problem resolution. These champions can advocate for security improvements from within, navigating internal political structures and resource constraints.

Finally, Schoka issued a direct call to action for the cybersecurity community: get involved and help. He emphasized that the vast majority of volunteers at state and local party organizations lack the IT and cybersecurity experience necessary to implement basic protections. Professionals in the field possess invaluable knowledge that can directly impact the security posture of these critical entities. Volunteering time and expertise to help campaigns implement DMARC, deploy DDoS protection (like Cloudflare's free program for campaigns), secure old data artifacts, and enforce stronger password policies can collectively make a substantial difference in protecting the democratic process from low-sophistication, yet high-impact, cyber threats.

Key Takeaways

• Systemic Vulnerabilities: Political campaign websites, particularly at state and local levels, exhibit widespread and bipartisan security deficiencies, including extensive exposure of private personal data and a critical lack of basic DDoS protection and email authentication (DMARC).
• "Frankensteined" Deployments: The cyclical nature of campaign tech leads to recycled and layered website platforms, leaving behind insecure artifacts (e.g., old Google Drive files, Wix endpoints) and making data management and security challenging.
• Low-Sophistication, High-Impact Threats: These vulnerabilities enable attackers with minimal technical skill to exfiltrate sensitive data, compromise accounts with weak passwords (e.g., "Maga 2024"), or disrupt campaign operations through simple DDoS attacks or website defacement, potentially spreading misinformation during critical periods like Election Day.
• The Power of Specialized Tools: Custom-built tools like Hookshot can effectively identify these widespread security issues at scale (scanning 50,000+ websites), correlating exposed data with existing breach intelligence to highlight immediate risks.
• Trust and Solutions are Key: Addressing these problems requires building trust with political organizations, focusing on actionable solutions rather than just problem identification, and leveraging non-partisan entities like Defending Digital Campaigns to disseminate information and resources effectively.
• Call to Action for Cybersecurity Professionals: The cybersecurity community has a crucial role to play in bolstering democratic infrastructure. Volunteering expertise to local campaigns and finding internal champions within organizations can significantly improve their security posture and protect the integrity of elections.

About the Speaker(s)

Andrew Schoka is a cybersecurity researcher with a passion for applying technical expertise to real-world problems, particularly those impacting democratic processes. His journey, as described in this talk, began with a rejected idea that he transformed into a significant research project aimed at safeguarding the 2024 U.S. election. Schoka is the creator of Hookshot, an open-source tool designed to identify security vulnerabilities and data exposure on political campaign websites. His work demonstrates a deep technical understanding of web security, data analysis, and threat intelligence, coupled with a strong commitment to finding practical, bipartisan solutions to systemic cybersecurity challenges within the political landscape. He emphasizes the importance of collaboration, trust-building, and community involvement in addressing these critical issues.