netsecurity database

Checked internet based voting system from a german's bank marketing campaign after complaints from one of our customers.

Found the system to use session cookie and temporary IP-Block in database but widely open for misuse by voting over proxies or tor-network. During tests worldwide proxies and tor-exit nodes were already under heavy use for this kind of 'vote-for-yourself-and-get-money'. That might explain the last 'winner' having registered a few days before but winning the voting-competition.

Tried to inform/advise responsible contact listed on page - taken from domain whois - with no real result.

Tools used for testing were:

vidalia bundle from tor project page
and
proxymizer

notifier to bank company (in native german):