Slashdot Mirror
Should We Ignore the South Carolina Election Hacking Story? (securityledger.com)
chicksdaddy provides five (or more) "good" reasons why we should ignore the South Carolina election hacking story that was reported yesterday. According to yesterday's reports, South Carolina's voter-registration system was hit with nearly 150,000 hack attempts on election day. Slashdot reader chicksdaddy writes from an opinion piece via The Security Ledger: What should we make of the latest reports from WSJ, The Hill, etc. that South Carolina's election systems were bombarded with 150,000 hacking attempts? Not much, argues Security Ledger in a news analysis that argues there are lots of good reasons to ignore this story, if not the very real problem of election hacking. The stories were based on this report from The South Carolina Election Commission. The key phrase in that report is "attempts to penetrate," Security Ledger notes. Information security professionals would refer to that by more mundane terms like "port scans" or probes. These are kind of the "dog bites man" stories of the cyber beat -- common (here's one from 2012 US News & World Report) but ill informed. "The kinds of undifferentiated scans that the report is talking about are the internet equivalent of people driving slowly past your house." While some of those 150,000 attempts may well be attempts to hack South Carolina's elections systems, many are undifferentiated, while some may be legitimate, if misdirected. Whatever the case, they're background noise on the internet and hardly unique to South Carolina's voter registration systems. They're certainly not evidence of sophisticated, nation-state efforts to crack the U.S. election system by Russia, China or anyone else, Security Ledger argues. "The problem with lumping all these 'hacking attempts' in the same breath as you talk about sophisticated and targeted attacks on the Clinton Campaign, the DCCC, and successful penetration of some state election boards is that it dramatically distorts the nature and scope of the threat to the U.S. election system which -- again -- is very real." The election story is one "that demands thoughtful and pointed reporting that can explore (and explode) efforts by foreign actors to subvert the U.S. vote and thus its democracy," the piece goes on to argue. "That's especially true in an environment in which regulators and elected officials seem strangely incurious about such incidents and disinclined to investigate them."
I pretty much just assume that any computer attached to the internet is being tested by hackers all the time. Why should election computers be any different?
SJW: Someone who has run out of real oppression, and has to fake it.
The public-facing srvers I'm reponsible for are port-scanned thousends of times a day in addition to the SSH access attempts, but these are all so common that only a fool falls victim to this sort of thing, the basic protections are fairly elementary and catch most if not all such common garbage.
If you want news from today, you have to come back tomorrow.
breaking news:
Russia Russia Russia
in other news:
Russia Russia Russia
Hell, we don't even have to investigate. An election has never been hacked, and cases of attacks are so few and far between that it doesn't make sense to even try to figure out how often this happens.
Perfectly willing to claim Trump was elected from vote hacking, utterly unwilling to investigate or question any votes - and in fact attempts to block those seeking to investigate voter hacking.
It is absurd to claim with as loose as protocol is around most voting systems, that there is not widespread voter fraud ongoing - probably "benefitting" both parties and screwing honest voters over with rigged elections across the country.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Oh wait, we had a hysterical freakout and thought Obama was planning a coup.
No wait, wait, that was just the people who think Operation Jade Dragon is going to send them to the FEMA camps.
Via: Wall Street Journal
Oh never mind. Carry on, nothing to see here.
It's not like the Wall Street Journal, Bloomberg, Washington Post, New York Times, and media in China have noted that 39 US states were hacked.
Oh.
Wait.
Paper mail-in ballots with non-networked optical scanners and audit trails. Only tech that works. Or use paper and pencil with same day registration.
-- Tigger warning: This post may contain tiggers! --
If it's such a "very real problem," then why has not one single media outlet actually explained how the election was "hacked?" We hear "Russians" twenty times a day, but no one actually points a single compromised voting system, nor any research that show Clinton would have won if hadn't been circulated. This, from a media that has become otherwise quite good at explaining things like quantum teleportation and CRISPR/CAS9 to the general population - but somehow lots of hand-waving about the "hacked election."
Sorry for being painfully naive, but no, the election hacking thing, whether it be in SC or elsewhere is a Big Fucking Deal. We need to have confidence in the election results or no elected representative (note the use of the word "representative" and not "leader") can have the confidence of the people that he/she is legitimate.
To reduce crime, make fewer things against the law.
Perfectly willing to claim Trump was elected from vote hacking, utterly unwilling to investigate or question any votes - and in fact attempts to block those seeking to investigate voter hacking.
Perfectly willing to ignore that the actual hacking that Democrats are concerned about was related to breaking into email accounts for Democrats, not elections computers (except that one time you have a freakout over one in Georgia), utterly unwilling to admit that Trump's claim of five million illegals voters was bullshit, and in fact, downplays the exaggerated hysterical nature of the GOP noise brigade.
It is absurd to ignore how the GOP has been found by numerous courts to have deliberately targeted selected mechanisms of ID because the opposing voting base uses them, when the GOP is found by numerous courts to have engaged in excessive gerrymandering that far exceed that in Maryland, when the Republicans in the Arizona Legislature refused to abide by the will of the people for a non-partisan districting Commission, that you are actually concerned with the voters or rigged elections.
Maybe you should think about that, if you want people to believe you have even the slimmest shred of integrity.
Besides, the distict attorney in North Carolina who refused to prosecute a woman who voted for her dead mother was a Republican.
The only burglar that pounds on your door 150,000 times is the meth-ed out one that's going to end up on "America's Dumbest Criminal's" or some other reality show. Likewise, good hackers do not advertise their presence like that. If this was a serious attack it would have begun months ago and with slow targeted scans that aren't going to draw attention and/or spearphishing. 150,000 "attacks" is not enough to even qualify as a DoS. This is common portscan activity and the sysadmin is either showboating for his bosses or just looked at his firewall logs for the first time. I'd be willing to be port 22 gets hit on my FIOS connection gets hit 150,000 times some days (I'm looking at you PRC)... I have no idea because it's blocked and not logged because it's noise and I know it.
Voter Fraud via the Presidential Commission.
5 out of 6 people enjoy Russian Roulette & 6 out of 7 Dwarfs are not Happy
More like man inhales story...
I ran a basic web server for awhile at home a few years ago just for amusement on a Linux box running apache. It served up ONE static page that said something like "this is the only page on this server" and that was it. I got "attacked" thousands of times a week by the script kiddies running the IIS exploit attempt scripts, port scans and all sorts of things that I found a little bit amusing.
Surely, during an election, ANY computer on the net associated with anything to do with voting would be a primary target of all the hackers out there trying to make a name for themselves....Oh Look at me! I broke in and disrupted the election!
The fact is, this is not unusual..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
By the partizan electoral officials that control them. Heck, the Diabold machine was even found to have and "Adjust Votes" option on the menu, no need for any actual hacking.
It amazes me that Americans put up with this grossly dubious system.
I am sure that the Australian election was not hacked. I was one of the scrutineers who watched while every paper ballot (at a particular booth) was tallied. And then forwarded those subtotals on to the candidate themselves. No fuss. No court cases. Just transparency.
Try to hack the voting system 150000 times and it's a statistic...
Try to do it once and you're likely a Trump voter.
Mit der Dummheit kämpfen Götter selbst vergebens
On some of these election rolls systems, they sent crafted emails to named election official leading to plausible Google sites. This clearly isn't the same.
Those real hack attempts were done well before the election, and clearly the specific data was being targetted by Russia. I assume it's someone in the Trump camp wanted it (given the number of interconnects between Russia and Trump's camp), since the data is only useful if you're targetting voting districts.
That data is the *SAME* data Trump is demanding now, complete with how people voted on their absentee ballots (and where primaries are allowed to be voted on, by registered party voters, those party affiliations).
And yes, I am accusing team Trump of replaying to Russias offer for help with a list of stuff they wanted hacked. Followed by a flow of that data back into team Trump's camp.
... I've been a firewall jockey and the logs were fraught (new word of the day) with attempts to penetrate.
Particularly interesting were the pokes at RDP (standard port 3389).
I used RDP a lot back then but I went to the registry and changed the port to the last four digits of our firm's phone number as a mnemonic.
So,
mstsc /v:joemcnamara.trandoninc.com:8192
gets Joe to his desktop.
Another common attack point was FTP.
It little behooves the best of us to comment on the rest of us.
I've lost thousands to these fake hackers, please don't fall for any of them, it's taken me months to find a genuine hacker who will show you proof before payment. Thank you are the bomb ,the work you did on my spouse's accounts was simply phenomenal! and i aint talking about just facebook ;) turns out he shows you valid proof before payment. Hey if you ever need to get into your spouse's account, improve credit points, clear criminal records,tax, protection from spyware or simply have a score to settle or any other issues that need addressing, completely secure and fast!! contact by email..... gmorrison741@gmail.com and i would have dropped his number but i know he would not be happy about that so please do contact him by email good luck.......
Do you want a QUICK and the most INTELLIGENT hack service? Have you been failing your courses in school and want to UPGRADE YOUR SCHOOL SCORES AND GRADES? Then it is your luck day to met the most EFFICIENT, RELIABLE, SWIFT and INTELLIGENT hacker, I will offer the following services: Learn what's makes the clever ones know with just a learnable tips. I can offer services like Already hacked online shopping pins for sale at give away price University grades hack Bank account hacks Control devices remotely hack Email Hacking Facebook Hacking Tricks Gmail Hacking Tricks untraceable IP Verified Paypal Accounts hack Wipe criminal record Paypal, MasterCard hack IP Address IPhone Hacking Tricks KEYLOGGER Twitter Hacking Windows Hacking Tricks YouTube Hacking ,professional Hacking (gmorrison741@gmail.com)
Hackers are most likely among the "slave labor" sent from NK to Russia in exchange for missile tech.
I am the unwilling control for my Origin.
I've done support for security software, and you'd be amazed how many people, admins in this case, have no idea just how many port scanners and other such bots are out there looking for possible entry points into your system.
I had a special box set up to be outside our firewalls, but isolated from the company network just in case, that I used to keep an eye on some of the traffic and to generate logs I could show people. I know that sounds like something for marketing, but it wasn't. Some people are a bit paranoid, or just don't really understand what's going on out there and panic when they can suddenly see what used to be invisible to them. Especially if they put the security software in what I liked to call paranoid mode.
Having those logs and current stats available made it much easier to calm people down and get them to put their settings on a more reasonable and functional threshold.
I have some sympathy for these guys, but the ones that set their antivirus software updates to every 3 minutes for 6000 machines and then freak when their network starts coughing up hairballs and then yells at us, well, they don't deserve any sympathy.
No more than the ones that move their swap file to a ramdisk.
Then of course there's the crashing email servers because some exec or whatever set his work email to forward to his personal email, and his personal email to forward to his work email. Then after saturating the thing with an infinite expanding email loop they somehow think it's being caused by our software.
(Yeah, all these things are real, and far more common than you might expect.)
But just because I think those types don't deserve sympathy for their creation of their own problems due to stupidity, it doesn't mean I won't be nice to them and help them as efficiently as I can.
in court and under oath, that he was ordered by either the contractor or government to subvert the voting machine allowing outside control of the voting results, so why not ignore this as well?
Actually I think you should ignore it. Connecting a voting-machine to the Internet just means that you're not interested in just making it collect votes, you're interested in controlling it remotely, and asking for others to try it.
Of all the states where someone might be trying to (undetectably) swing the result of an election through hacking, who in their right mind would pick South Carolina where Trump was already expected to win within the range of the 15 point margin he did?
Yes, we should ignore this story for desperately grasping at straws to the point of extinguishing critical thinking.
Fake News! SAD!
Why are people making up stories based on what they thought of while drunk the wight before? What happened to news having at least a fraction of fact behind them?
That same American programmer was a registered democrat who had given almost $100K exclusively to democratic candidates.
That's why we never heard of it. The Clintons buried it just like they did Vince Foster and dozens of other people.
My web and email server is hit by >15,000 attempts per minute. Fail2Ban, iptables recipes, a variety of DNS hardening, and a pile of other tools make this livable. And mail scanning helps also. Reverse DNS etc. also help.
And this has been going on for more than decade. My logs from 1998 show steady attempts, and sometime around 2001 attacks picked up.
So far as I can tell my servers haven't been compromised since 1998, and I still harbor a grudge against the the kids from Atlanta. I would punch every one of then in the face. Right now. Twice. Each.
deleting the extra space after periods so i can stay relevant, yeah.
There are other reasons this post and many of the comments (what a surprise) are basically invalid; they ignore the structural protections of SC voting procedures.
Echo the comments about hundreds of daily port scans. Use an enterprise-class firewall like UTM and see how often your IPs are probed to get an idea of what is really going on.
SC requires people to be registered 30 days prior to an election. Computers used for the elections are not connected to the Internet. Printed materials and data are prepared and distributed in advance of election day. There are multiple layers of redundant and differing methods of validating a voter each step of the way.
Is it possible for someone to vote who is not entitled to vote? Of course. Is it possible to compromise the system? Of course. Is it probable this could happen? Only if certain key people in multiple position work as a team and are not detected.
A much more probably location of fraud is North Carolina given they are prohibited from checking photo ID (which is a basic requirement for everyday life in the US - don't blow that racist lie at me unless you are willing to admit you want to discriminate against people) and same-day registration. When I worked elections there, it was also legal for a person to vote in a precinct other than the one in which they lived. The problem with that is their legal right to vote cannot be verified.
Vote fraud is theft of representation from those who have the right to vote. Last year there was complaining that precincts with less than 50% white population in NC had further to travel to vote than white voters. The average difference was something like 1 mile. The reality is buildings appropriate for voting, with parking and ADA-compliant structure, must be rented and staffed. They do not magically appear in the calculated geographic center of a population. NC also has early voting. 10 years ago this was available for a month before election day.
It's very easy to find some statistical "hindrance" or "threat" to voting integrity. It's quite another to find a valid one.
The Daily Mail has zero credibility, which is why Wikipedia editors voted to ban its use as a source.
Come right here.. get your nothing burger... compliments of CNN, etc.