Slashdot Mirror
Should We Ignore the South Carolina Election Hacking Story? (securityledger.com)
chicksdaddy provides five (or more) "good" reasons why we should ignore the South Carolina election hacking story that was reported yesterday. According to yesterday's reports, South Carolina's voter-registration system was hit with nearly 150,000 hack attempts on election day. Slashdot reader chicksdaddy writes from an opinion piece via The Security Ledger: What should we make of the latest reports from WSJ, The Hill, etc. that South Carolina's election systems were bombarded with 150,000 hacking attempts? Not much, argues Security Ledger in a news analysis that argues there are lots of good reasons to ignore this story, if not the very real problem of election hacking. The stories were based on this report from The South Carolina Election Commission. The key phrase in that report is "attempts to penetrate," Security Ledger notes. Information security professionals would refer to that by more mundane terms like "port scans" or probes. These are kind of the "dog bites man" stories of the cyber beat -- common (here's one from 2012 US News & World Report) but ill informed. "The kinds of undifferentiated scans that the report is talking about are the internet equivalent of people driving slowly past your house." While some of those 150,000 attempts may well be attempts to hack South Carolina's elections systems, many are undifferentiated, while some may be legitimate, if misdirected. Whatever the case, they're background noise on the internet and hardly unique to South Carolina's voter registration systems. They're certainly not evidence of sophisticated, nation-state efforts to crack the U.S. election system by Russia, China or anyone else, Security Ledger argues. "The problem with lumping all these 'hacking attempts' in the same breath as you talk about sophisticated and targeted attacks on the Clinton Campaign, the DCCC, and successful penetration of some state election boards is that it dramatically distorts the nature and scope of the threat to the U.S. election system which -- again -- is very real." The election story is one "that demands thoughtful and pointed reporting that can explore (and explode) efforts by foreign actors to subvert the U.S. vote and thus its democracy," the piece goes on to argue. "That's especially true in an environment in which regulators and elected officials seem strangely incurious about such incidents and disinclined to investigate them."
I pretty much just assume that any computer attached to the internet is being tested by hackers all the time. Why should election computers be any different?
SJW: Someone who has run out of real oppression, and has to fake it.
The public-facing srvers I'm reponsible for are port-scanned thousends of times a day in addition to the SSH access attempts, but these are all so common that only a fool falls victim to this sort of thing, the basic protections are fairly elementary and catch most if not all such common garbage.
If you want news from today, you have to come back tomorrow.
Hell, we don't even have to investigate. An election has never been hacked, and cases of attacks are so few and far between that it doesn't make sense to even try to figure out how often this happens.
Perfectly willing to claim Trump was elected from vote hacking, utterly unwilling to investigate or question any votes - and in fact attempts to block those seeking to investigate voter hacking.
It is absurd to claim with as loose as protocol is around most voting systems, that there is not widespread voter fraud ongoing - probably "benefitting" both parties and screwing honest voters over with rigged elections across the country.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
If it's such a "very real problem," then why has not one single media outlet actually explained how the election was "hacked?" We hear "Russians" twenty times a day, but no one actually points a single compromised voting system, nor any research that show Clinton would have won if hadn't been circulated. This, from a media that has become otherwise quite good at explaining things like quantum teleportation and CRISPR/CAS9 to the general population - but somehow lots of hand-waving about the "hacked election."
Sorry for being painfully naive, but no, the election hacking thing, whether it be in SC or elsewhere is a Big Fucking Deal. We need to have confidence in the election results or no elected representative (note the use of the word "representative" and not "leader") can have the confidence of the people that he/she is legitimate.
To reduce crime, make fewer things against the law.
The only burglar that pounds on your door 150,000 times is the meth-ed out one that's going to end up on "America's Dumbest Criminal's" or some other reality show. Likewise, good hackers do not advertise their presence like that. If this was a serious attack it would have begun months ago and with slow targeted scans that aren't going to draw attention and/or spearphishing. 150,000 "attacks" is not enough to even qualify as a DoS. This is common portscan activity and the sysadmin is either showboating for his bosses or just looked at his firewall logs for the first time. I'd be willing to be port 22 gets hit on my FIOS connection gets hit 150,000 times some days (I'm looking at you PRC)... I have no idea because it's blocked and not logged because it's noise and I know it.
Voter Fraud via the Presidential Commission.
5 out of 6 people enjoy Russian Roulette & 6 out of 7 Dwarfs are not Happy
More like man inhales story...
I ran a basic web server for awhile at home a few years ago just for amusement on a Linux box running apache. It served up ONE static page that said something like "this is the only page on this server" and that was it. I got "attacked" thousands of times a week by the script kiddies running the IIS exploit attempt scripts, port scans and all sorts of things that I found a little bit amusing.
Surely, during an election, ANY computer on the net associated with anything to do with voting would be a primary target of all the hackers out there trying to make a name for themselves....Oh Look at me! I broke in and disrupted the election!
The fact is, this is not unusual..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Plus voter ID, clear ballot boxes and indelible ink marks on voters thumbs to prevent double voting. The UN has a set of best practices.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
By the partizan electoral officials that control them. Heck, the Diabold machine was even found to have and "Adjust Votes" option on the menu, no need for any actual hacking.
It amazes me that Americans put up with this grossly dubious system.
I am sure that the Australian election was not hacked. I was one of the scrutineers who watched while every paper ballot (at a particular booth) was tallied. And then forwarded those subtotals on to the candidate themselves. No fuss. No court cases. Just transparency.
And bank robbers complain about bank vault having locks, too.
Perfectly willing to ignore that the actual hacking that Democrats are concerned about was related to breaking into email accounts for Democrats, not elections computers ...
Nobody on the R side is ignoring that. But what the Ds are trying to distract everybody from is that the alleged "Russian hacking" consists of exposing what the major Ds were actually saying to each other (about how they cheated Sanders out of a legitimate primary run, what contempt they had for the voters and how they lied to them, and so on).
If the Russians were really behind those leaks, and they did swing the election, it seems to me that the people involved deserve both a close encounter of the law-enforcement kind AND a Pulitzer Prize.
It is absurd to ignore how the GOP has been found by numerous courts to have deliberately targeted selected mechanisms of ID because the opposing voting base uses them, ...
It's not absurd if: ... when the GOP is found by numerous courts to have engaged in ... gerrymandering ...
- the opposing voting base uses them because they're easy to fake, AND
- the not-so-easy-to-fake alternatives are both easy to obtain (by any QUALIFIED voter) and free.
Gerrymadering is a two-team sport. If you don't believe the Ds also play a good game, take a look at California, just for starters.
Also: "... found by numerous courts ..." cuts no ice when egregiously left-wing and activist judges are one of the grievances of both the Rs and the voters for them.
But thank you for playing straight-man. B-)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Is that Voter ID really free of charge or is it free after you pay a fee to get a certified copy of your birth certificate which is required in order to get your free ID? Paying money for anything in order to vote has a bad history in this country, as do literacy tests (hey, you should be able to read, else how can you cast an informed vote!), etc. You can always make an argument why there should be some test or other extra-constitutional requirement to vote -- they've all been tried in the past.
Try to hack the voting system 150000 times and it's a statistic...
Try to do it once and you're likely a Trump voter.
Mit der Dummheit kämpfen Götter selbst vergebens
... I've been a firewall jockey and the logs were fraught (new word of the day) with attempts to penetrate.
Particularly interesting were the pokes at RDP (standard port 3389).
I used RDP a lot back then but I went to the registry and changed the port to the last four digits of our firm's phone number as a mnemonic.
So,
mstsc /v:joemcnamara.trandoninc.com:8192
gets Joe to his desktop.
Another common attack point was FTP.
It little behooves the best of us to comment on the rest of us.
Hackers are most likely among the "slave labor" sent from NK to Russia in exchange for missile tech.
I am the unwilling control for my Origin.
I've done support for security software, and you'd be amazed how many people, admins in this case, have no idea just how many port scanners and other such bots are out there looking for possible entry points into your system.
I had a special box set up to be outside our firewalls, but isolated from the company network just in case, that I used to keep an eye on some of the traffic and to generate logs I could show people. I know that sounds like something for marketing, but it wasn't. Some people are a bit paranoid, or just don't really understand what's going on out there and panic when they can suddenly see what used to be invisible to them. Especially if they put the security software in what I liked to call paranoid mode.
Having those logs and current stats available made it much easier to calm people down and get them to put their settings on a more reasonable and functional threshold.
I have some sympathy for these guys, but the ones that set their antivirus software updates to every 3 minutes for 6000 machines and then freak when their network starts coughing up hairballs and then yells at us, well, they don't deserve any sympathy.
No more than the ones that move their swap file to a ramdisk.
Then of course there's the crashing email servers because some exec or whatever set his work email to forward to his personal email, and his personal email to forward to his work email. Then after saturating the thing with an infinite expanding email loop they somehow think it's being caused by our software.
(Yeah, all these things are real, and far more common than you might expect.)
But just because I think those types don't deserve sympathy for their creation of their own problems due to stupidity, it doesn't mean I won't be nice to them and help them as efficiently as I can.
Is that Voter ID really free of charge or is it free after you pay a fee to get a certified copy of your birth certificate which is required in order to get your free ID?
You mean the part where you don't pay a fee and even with the existing ID that's available so you can get your free ID? You can find lots of democrat and progressive talking points against free ID, using existing forms of ID which you're already required to use for everything from voting in your local primary(including entrance), to buying a pack of smokes, booze, or any type of government benefits for.
Can you make any valid argument where not having voter ID enhances and benefits democracy, democratic votes in any way shape or form? Can you make any valid argument as to how with such a huge problem with illegals, that not having voter ID benefits the state?
Om, nomnomnom...
Voter ID is clearly racist. Unless it's the Democrats voting in their own internal elections, in which case voter ID is essential to prevent unauthorized people from voting.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
He's pretty good. Plays a mean game of chess too.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Of all the states where someone might be trying to (undetectably) swing the result of an election through hacking, who in their right mind would pick South Carolina where Trump was already expected to win within the range of the 15 point margin he did?
Yes, we should ignore this story for desperately grasping at straws to the point of extinguishing critical thinking.
My web and email server is hit by >15,000 attempts per minute. Fail2Ban, iptables recipes, a variety of DNS hardening, and a pile of other tools make this livable. And mail scanning helps also. Reverse DNS etc. also help.
And this has been going on for more than decade. My logs from 1998 show steady attempts, and sometime around 2001 attacks picked up.
So far as I can tell my servers haven't been compromised since 1998, and I still harbor a grudge against the the kids from Atlanta. I would punch every one of then in the face. Right now. Twice. Each.
deleting the extra space after periods so i can stay relevant, yeah.
You mean the thing that is actually a discriminatory burden?
These court cases are crap and I'm sick of this argument that people are just incapable of getting an ID somehow. Everyone should have an ID. Here's a list of reasons why, provided by the NYC government:
http://www.nyc.gov/html/id/htm...
People object no matter how easy the local government makes it. People objected even when they were sending mobile voter ID vans into neighborhoods to make it easy. If those vans were giving out free phones people would have waited on lines for hours.
Voters are supposed to be adults. Treat them accordingly.
Even if you provide the ID free of charge.
Thanks in no small part to the States failing to provide the ID free of charge. Like in Pennsylvania
I bet if you needed a photo ID to collect social security benefits the person named in that lawsuit would have had one for 20 years.
There are other reasons this post and many of the comments (what a surprise) are basically invalid; they ignore the structural protections of SC voting procedures.
Echo the comments about hundreds of daily port scans. Use an enterprise-class firewall like UTM and see how often your IPs are probed to get an idea of what is really going on.
SC requires people to be registered 30 days prior to an election. Computers used for the elections are not connected to the Internet. Printed materials and data are prepared and distributed in advance of election day. There are multiple layers of redundant and differing methods of validating a voter each step of the way.
Is it possible for someone to vote who is not entitled to vote? Of course. Is it possible to compromise the system? Of course. Is it probable this could happen? Only if certain key people in multiple position work as a team and are not detected.
A much more probably location of fraud is North Carolina given they are prohibited from checking photo ID (which is a basic requirement for everyday life in the US - don't blow that racist lie at me unless you are willing to admit you want to discriminate against people) and same-day registration. When I worked elections there, it was also legal for a person to vote in a precinct other than the one in which they lived. The problem with that is their legal right to vote cannot be verified.
Vote fraud is theft of representation from those who have the right to vote. Last year there was complaining that precincts with less than 50% white population in NC had further to travel to vote than white voters. The average difference was something like 1 mile. The reality is buildings appropriate for voting, with parking and ADA-compliant structure, must be rented and staffed. They do not magically appear in the calculated geographic center of a population. NC also has early voting. 10 years ago this was available for a month before election day.
It's very easy to find some statistical "hindrance" or "threat" to voting integrity. It's quite another to find a valid one.
Come right here.. get your nothing burger... compliments of CNN, etc.
These court cases are crap and I'm sick of this argument that people are just incapable of getting an ID somehow.
Yes, yes, ignore the actual documented problems that were substantiated in a court of law. This is the biggest issue with the legitimacy of your argument, you rail and rant at the concerns, instead of solving them.
I said this to Mashiki, but you should realize it as well, a little contrition is what you need, not obstreperousness.
I didn't ignore them. I say they are anecdotal crap that liberal judges buy into.
Everyone should have an ID.
Then make it an obligation for the state to provide it, even if the Governor of the State has to walk around in EVERY single neighborhood with a camera and a printer.
No. Adults who want to vote have to go and get an ID. No one has to go hand it to them. If they can make it to the polls they can make it to get an ID.
Here's a list of reasons why, provided by the NYC government:
Yes, yes, there are good reasons to have ID. Which is why the City of New York set up a Municipal ID program, thank you for appreciating them.
I do appreciate it. The mayor is not however walking door to door. People still have to take action
If those vans were giving out free phones people would have waited on lines for hours.
Yes, yes, there were protests over providing people with phones too.
Irrelevant comment
Voters are supposed to be adults. Treat them accordingly.
Yes, yes, blame the voter, a common attitude, except the state's legitimacy only exists with the provision of the vote. Treat it accordingly.
Also irrelevant
I bet if you needed a photo ID to collect social security benefits the person named in that lawsuit would have had one for 20 years.
I bet if Social Security started doing photo ID, there'd be massive protests and objections about the mark of the beast.
More irrelevance.
Voter ID is a solution in search of a problem. We have no evidence of rampant voter fraud, yet are told we need to implement voter ID.
Well, we don't know if there's evidence of rampant voter fraud. Mainly democrat states are blocking the government from trying to determine how much fraud there actually is. But let's go with the extrapolated report from earlier in the year. Which figures that somewhere between 4m and 6m people voted illegally. That includes everything from voting twice, to non-citizens.
The real reason behind voter ID laws is for Republicans to make it harder for people who tend to vote Democratic to vote at all.
So let's run with that. The reason democrats are for amnesty of illegals, is to make sure they always win by subverting democracy.
Om, nomnomnom...
You mean the thing that is actually a discriminatory burden?
You mean where half of those cases have been tossed out, and in two others the legalese was adjusted to come into compliance with the courts ruling making voter ID a defacto requirement.
You mean the arguments that actually persuade a court of law, that the point out the discriminatory intent that is quite apparent from the actual statements of the legislators who enacted the law with the specific desire to disenfranchise voters? From legislators, who if your contentions are correct, were not lawfully elected in the first place, thus rendering their position suspect.
You mean those same arguments which successfully won as well? Want to continue running with that line of thought or would you like to try something else?
Yes, I can. You forgot to ask it to be done though.
Apparently you couldn't, or can't. You missed the question mark in the original sentence.
Yes, I can also do this. Of course, since you neglected to ask for any argument to be actually presented, so I don't feel any obligation to do so, and I won't until you address the question of what to do when the state legislature is found to have engaged in discriminatory intent in its passage of the laws. You instead resist any addressing of that concern at all, revealing at best, your own complicity in it.
Seems to me you don't have any actual point in showing this, because if you did. You'd already know that several of those other cases were tossed, or the laws were modified and/or rewritten in order to be in compliance with the courts issues with the laws in the first place. So where and what are those benefits in having someone who's illegally having the right to vote? Besides that they're subverting democracy itself. Something that democrats have a pro-amnesty hardon and policy for.
FYI, using rarely used words for the sake of using them doesn't make you look smart either.
Om, nomnomnom...
But they never have a hard time showing up to vote -- allegedly multiple times according to some reports. If the tables were turned and these poor souls were tending to vote for Republicans, we'd see this vulnerability closed instantly by the blue side of the force.