US voting machines are vulnerable to hackers

[TidaLWaveZ]

4 minutes ago, kaiju_wars said:

Yes, but were as (at least right now, I can't talk about the future).  Clinton with her stance on Russia will most likely start a world war, Trump's won't.

 

As an American I constantly hear people complaining about sexism and misogyny within America, like every other nation is way ahead of us.  This is just not the case, just look at Russia. If Hillary wins the presidency and barks at Putin, his response will not be pretty.

[BiscuitMassacre]

1 hour ago, stconquest said:

 

You people?  Do you mean rational people that are not sucking Trump's cock?  You are fucking wrong

Just nocticed this. Its rational to not value life?

[mark_cameron]

On 11/7/2016 at 8:51 AM, tlink said:

Cylance has disclosed a hack that shows how vulnerable US election voting machines are. This hack has previously been theorized but this is the first time we can actually see it in action, on an actual voting machine used in the 2008 election. For me personally this just shows again why voting machines are a bad idea, but i already know loads of people are going to disagree on this.

 

tom scott did a great piece for computerphile on why electronic voting is a bad idea. remember that this is just my and tom's perspective on the issue and do research and think about it yourself before pulling a conclusion from this.

 

for a lot of people this election is one of the foulest they experienced, with reports even saying that the 2 main candidates are the least liked candidates ever. it feels like one giant mud throwing contest. some people have even said that voter fraud caused Bernie Sanders to lose the race to presidential candidate for the Democrats with this as source: http://www.electoralsystemincrisis.org/

 

in an article from cylance they describe the hack in detail and give some references to older researches on these specific machines

 

they also described their proposals on how to protect voting machines against this type of voter fraud

the specific hack requires the attacker to have an PCMCIA card, this card is then used to reflash the firmware on the voting machine in a very simple manner that can be done in under 10 minutes easily. 

Voter machines are under the care of local election officials in the USA. Which are local volunteers including persons from both major political parties.

 

In order to properly cause a fraud would need to involve multiple persons and given the amount of legal scrutiny from an independent judiciary I find it highly unlikely of widespread voter fraud.

 

Donald Trump's comments on this were a disgrace.

 

I say this as a British person - not American person.

 

I am also mindful that Russian intelligence has been actively seeking ways to infilitrate the US election system electronically. At state level.

 

They also were recently denied access by US states to access - voting areas as 'observers'.

 

It was obvious what they were doing - one only has to see what RussiaToday in the UK is up to (sanctioned by OFCOM for reporting 'news' with absolutely no evidence to back it up).

 

https://www.theguardian.com/media/2015/sep/21/rt-sanctioned-over-series-of-misleading-articles-by-media-watchdog

 

 

I would say to American's. Do not allow hostile foreign actors (agencies)to undermine your democracy. I do not think US democracy is perfect. It is however - democratic and far better than some countries.

 

The US justice department should be leading the fight against voting fraud. Including technical attempts to hack election equipment. Americans should focus on the election (despite the mud slinging) and make their choice.

 

The same for Canadians or any other 'friendly' democratic state.

 

There is a lot of things going on in eastern Europe right now. Interference in the US election is just one thread in the bigger picture at the moment.

[Mooshi]

I can see a Clinton victory with this rigging. At least under Trump, congress would actually stop stupidity from going through. 

[mark_cameron]

1 hour ago, kaiju_wars said:

Yes, but were as (at least right now, I can't talk about the future).  Clinton with her stance on Russia will most likely start a world war, Trump's won't.

 

It was Theodore Roosevelt that said: 'speak softly and weld a big stick'

[tlink]

17 minutes ago, mark_cameron said:

Voter machines are under the care of local election officials in the USA. Which are local volunteers including persons from both major political parties.

 

In order to properly cause a fraud would need to involve multiple persons and given the amount of legal scrutiny from an independent judiciary I find it highly unlikely of widespread voter fraud.

 

Donald Trump's comments on this were a disgrace.

 

I say this as a British person - not American person.

 

I am also mindful that Russian intelligence has been actively seeking ways to infilitrate the US election system electronically. At state level.

 

They also were recently denied access by US states to access - voting areas as 'observers'.

 

It was obvious what they were doing - one only has to see what RussiaToday in the UK is up to (sanctioned by OFCOM for reporting 'news' with absolutely no evidence to back it up).

 

https://www.theguardian.com/media/2015/sep/21/rt-sanctioned-over-series-of-misleading-articles-by-media-watchdog

 

 

I would say to American's. Do not allow hostile foreign actors (agencies)to undermine your democracy. I do not think US democracy is perfect. It is however - democratic and far better than some countries.

 

The US justice department should be leading the fight against voting fraud. Including technical attempts to hack election equipment. Americans should focus on the election (despite the mud slinging) and make their choice.

 

The same for Canadians or any other 'friendly' democratic state.

 

There is a lot of things going on in eastern Europe right now. Interference in the US election is just one thread in the bigger picture at the moment.

there is a suply line that can be infected on every level. im talking, manufacturers of the equipment they use to install the first firmware. the machines themselves, the software manufacturer, the distribution platform for the software, machines, and equipment. than the actual placce itself the machines and software are at risk. the slot to insert the card is locked, but that really isn't going to stop anyone who truely wants to hack these things. most locks used by governments are laughable anyways, i for example picked the locks on my server cabinet within minutes. what is the reason for e-voting anyways? what does it provide that paper ballots do not provide? ease of counting? why would you risk democracy for something as arbitrary as that? democracy is one of the fundamentals most western cultures are build upon. its astronomically hard to influence an election with paper ballots that are counted with >4 people in the room for every location. influencing an electronic ellection at every location is 4 times easier because it takes 1 corrupted person that breaks into the machine, maybe 2, but not 4.

[BiscuitMassacre]

Just now, mark_cameron said:

It was Theodore Roosevelt that said: 'speak softly and weld a big stick'

One of my favorite statements, but I don't know what you are trying to say.

[mark_cameron]

9 minutes ago, tlink said:

there is a suply line that can be infected on every level. im talking, manufacturers of the equipment they use to install the first firmware. the machines themselves, the software manufacturer, the distribution platform for the software, machines, and equipment. than the actual placce itself the machines and software are at risk. the slot to insert the card is locked, but that really isn't going to stop anyone who truely wants to hack these things. most locks used by governments are laughable anyways, i for example picked the locks on my server cabinet within minutes. what is the reason for e-voting anyways? what does it provide that paper ballots do not provide? ease of counting? why would you risk democracy for something as arbitrary as that? democracy is one of the fundamentals most western cultures are build upon. its astronomically hard to influence an election with paper ballots that are counted with >4 people in the room for every location. influencing an electronic ellection at every location is 4 times easier because it takes 1 corrupted person that breaks into the machine, maybe 2, but not 4.

Paper based ballots can be as easily rigged as electronic.

 

Its up to the electoral officials and civil servants including domestic security agencies including the judiciary to ensure that attempts to unduely influence the electoral system - DO NOT SUCCEED.

 

For information. The US is not alone in Russian goverment attacks on the election system.

 

Russia tried to attack the British general election last year

 

http://www.independent.co.uk/news/uk/home-news/russian-hackers-tried-to-disrupt-uk-general-election-security-sources-say-a7329406.html

 

The UK is now to spend £1.9 BILLION (about US$2.25 billion) on cyber security as a result of constant Russian probing and attacks on the UK.

 

The group known as Fancy Bears planned to target every Whitehall server, including the Home Office, Foreign Office and Ministry of Defence, and every major TV broadcaster, including the BBC, Channel 4 and Sky, but was thwarted by GCHQ.

The agency, which is responsible for all the security services’ communications surveillance, managed to discover the plot in time after analysing a successful attack on French broadcaster TV5Monde in April last year

[tlink]

3 minutes ago, mark_cameron said:

Paper based ballots can be as easily rigged as electronic.

thats what im trying to discuss here, but you don't really give an explanation or counter argument to why you think that.

[mark_cameron]

2 minutes ago, tlink said:

thats what im trying to discuss here, but you don't really give an explanation or counter argument to why you think that.

The weak link is people.

 

People who adminster the electronic system. People who adminster the paper ballots (boxes).

 

People are the weak link.

 

But also the potential strength.

 

What is needed is strength in depth. Layers of people at local and federal level overseeing each other.

 

Its that that makes it more difficult to rig the election or hack it. People.

[tlink]

Just now, mark_cameron said:

The weak link is people.

 

People who adminster the electronic system. People who adminster the paper ballots (boxes).

 

People are the weak link.

yes thats exactly the problem, how does a machine solve this problem when this just means that more people in separate situations worked on it? there are way more people working on said machines than the few people that are there with the box. imagine it like this, you don't get your own ballot anymore but just have to draw a line after the president you want to elect. then those 4 people will count the lines. thats essentially what electronic voting is. you give everyone unattended access to the voting box. now ofcourse this is a gross simplification in my favour but you get my point. we all have access to eachothers votes physically while nobody watches us, while with a ballot box we only give 4 people access over our ballet box not even necessarily in private but recorded via a live feed. how is that just as safe?

[mark_cameron]

15 minutes ago, BiscuitMassacre said:

One of my favorite statements, but I don't know what you are trying to say.

I'm saying.

 

Don't let Russia's government try and muddy the waters in regard to your US election.

[tlink]

7 minutes ago, mark_cameron said:

But also the potential strength.

 

What is needed is strength in depth. Layers of people at local and federal level overseeing each other.

 

Its that that makes it more difficult to rig the election or hack it. People.

those are not layers of strength, but layers of obscurity. if you want people overseeing eachother than just have the ballot counting and ballot insertion live on a webcam while the actual voting is done in a booth. security by obscurity was never a good idea.

[kirashi]

Given enough time and physical access to any system one could theoretically hack/modify/falsify machine code. This is not new.

 

Even the output of a system using data encryption is vulnerable, unless EVERY SINGLE PIECE of hardware was properly linked in a chain of trust.

You might not be able to see or edit the data, but if the receipt printer isn't protected, then it should be assumed that any data sent to it for printing is compromised.

 

Sure, this sounds paranoid, but when absolute scrutiny and security is required for a system to be effective, it should be assumed that the system is guilty until proven innocent. Otherwise, what's the point in even voting in the first place?

[mark_cameron]

On 11/7/2016 at 4:38 PM, tlink said:

those are not layers of strength, but layers of obscurity. if you want people overseeing eachother than just have the ballot counting and ballot insertion live on a webcam while the actual voting is done in a booth. security by obscurity was never a good idea.

Its not obscurity.

 

You can find out who the local election officials are. All voting is secret ballot anyway.

 

Lets not get obsessively paranoid.

On 11/7/2016 at 4:41 PM, kirashi said:

Given enough time and physical access to any system one could theoretically hack/modify/falsify machine code. This is not new.

 

Even the output of a system using data encryption is vulnerable, unless EVERY SINGLE PIECE of hardware was properly linked in a chain of trust.

You might not be able to see or edit the data, but if the receipt printer isn't protected, then it should be assumed that any data sent to it for printing is compromised.

 

When absolute scrutiny and security is required for a system to be effective, it should be assumed that the system is guilty until proven innocent.

Agree.

 

Constant vigilance. Is the only response.

 

People and infrastructure.

 

[tlink]

3 minutes ago, mark_cameron said:

Its not obscurity.

 

You can find out who the local election officials are. All voting is secret ballot anyway.

 

Lets not get obsessively paranoid.

its obscurity in the sense that more different administrations play a role in the process. its like having the components for the presidents car split up over multiple people for security, you just moved the problem to 4 possible breaking points instead of the 1 breaking point. if one of those people fuck up the parts than the president is dead.

 

edit: car not care  

[mark_cameron]

4 minutes ago, tlink said:

its obscurity in the sense that more different administrations play a role in the process. its like having the components for the presidents care split up over multiple people for security, you just moved the problem to 4 possible breaking points instead of the 1 breaking point. if one of those people fuck up the parts than the president is dead.

Decentralisation is what gives the system resilience.

 

Centralisation makes a big election system more prone to compromise.

 

The Russian's could not hack the UK election system as its fully decentralised. So instead they targetted the government and media to create disruption. However constant vigilance meant that it was intercepted by GCHQ and the private media companies.

 

Its always a balancing act. But I fear you're risking throwing the baby out with the bath water. It seems a very American response to things at them moment.

 

https://en.m.wikipedia.org/wiki/Don't_throw_the_baby_out_with_the_bathwater

[tlink]

1 minute ago, mark_cameron said:

Decentralisation is what gives the system resilience.

 

Centralisation makes a big election system more prone to compromise.

 

The Russian's could not hack the UK election system as its fully decentralised. So instead they targetted the government and media to create disruption. However constant vigilance meant that it was intercepted by GCHQ and the private media companies.

 

Its always a balancing act. But I fear you're risking throwing the baby out with the bath water. It seems a very American response to things at them moment.

I'm not even american lol. but this isn't decentraisation, this is centralisation. your centralizing the point of failure into a single machine instead of 4 people. any individual can tamper with the machine, while no individual can tamper with the ballot box without 4 people noticing it. thats the point.

[mark_cameron]

Just now, tlink said:

I'm not even american lol. but this isn't decentraisation, this is centralisation. your centralizing the point of failure into a single machine instead of 4 people. any individual can tamper with the machine, while no individual can tamper with the ballot box without 4 people noticing it. thats the point.

Yes but one of the 4 people can persistently be checking the machine and its firmware for tampering, friend.

[BuckGup]

Sick! It is a brilliant time to be alive. 

[tlink]

4 minutes ago, mark_cameron said:

Yes but one of the 4 people can persistently be checking the machine and its firmware for tampering, friend.

but what is the use for the machine then? why would you need a machine to count the votes then? this is a machine that needs to be checked for tampering regularly, has to be checked before production, after production, after shipping, after installment, after voting. and now we also need to check it while voting is in progress by 1 person who can also be corrupted? honestly that just again seems to be complexity not security. how is this all beneficial over just using paper ballots? 

[captain_to_fire]

7 hours ago, Dan Castellaneta said:

Yeah, too bad Hillary has more potential for that.

Ties with Russia under Hillary? Say goodbye to that.

 

 

[mark_cameron]

2 minutes ago, tlink said:

but what is the use for the machine then? why would you need a machine to count the votes then? this is a machine that needs to be checked for tampering regularly, has to be checked before production, after production, after shipping, after installment, after voting. and now we also need to check it while voting is in progress by 1 person who can also be corrupted? honestly that just again seems to be complexity not security. how is this all beneficial over just using paper ballots? 

Friend, there is no such thing as an invulnerable election system.

 

I think you are over exaggerating the risks. Significantly. Election officials should be keeping an eye on their equipment or they are not doing their job.

[tlink]

Just now, mark_cameron said:

Friend, there is no such thing as an invulnerable election system.

 

I think you are over exaggerating the risks. Significantly. Election officials should be keeping an eye on their equipment or they are not doing their job.

this is not just about the risk, also about the complexity and the machines behind the voting. its literally wasting money in my opinion to solve a problem that never was a problem. the point of democracy is that its process is check able by anyone. when a machine just spits out a number you can't easily prove its fraudulent because you don't have the original inputs anymore.

[BiscuitMassacre]

1 minute ago, hey_yo_ said:

~snip~

Seriously? 

Why don't you find the ones that of Hillary slamming Russia and setting up no fly zones? We can't fight russia, atleast with our ever decreasing military. And her blaming the "russians" on rigging this thing. She is literally using "Likes Russia" as an insult. Sounds like world peace material to me. (facepalm)