Slashdot Mirror
11-Year-Old Changes Election Results On Florida's Website: Defcon 2018 (pbs.org)
UnknowingFool writes: At this year's DEFCON, a group of 50 children aged 8 to 16 participated in a hack of 13 imitation election websites. One 11-year-old boy changed the voting results in 10 minutes. A 11 year-old-girl was also able to change the voting results in 30 minutes. Overall, more than 30 of the 50 children were able to hack the websites in some form. The so-called "DEFCON Voting Machine Hacking Village" allowed kids the chance to manipulate vote tallies, party names, candidate names and vote count totals. The 11-year-old girl was able to triple the number of votes found on the website in under 15 minutes.
The National Association of Secretaries of State said in a statement that it is "ready to work with civic-minded members of the DEFCON community wanting to become part of a proactive team effort to secure our elections." But the organization expressed skepticism over the hackers' abilities to access the actual state websites. "It would be extremely difficult to replicate these systems since many states utilize unique networks and custom-built databases with new and updated security protocols," it read. "While it is undeniable websites are vulnerable to hackers, election night reporting websites are only used to publish preliminary, unofficial results for the public and the media. The sites are not connected to vote counting equipment and could never change actual election results."
The National Association of Secretaries of State said in a statement that it is "ready to work with civic-minded members of the DEFCON community wanting to become part of a proactive team effort to secure our elections." But the organization expressed skepticism over the hackers' abilities to access the actual state websites. "It would be extremely difficult to replicate these systems since many states utilize unique networks and custom-built databases with new and updated security protocols," it read. "While it is undeniable websites are vulnerable to hackers, election night reporting websites are only used to publish preliminary, unofficial results for the public and the media. The sites are not connected to vote counting equipment and could never change actual election results."
should actually be:
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
Something like Bill Gates winning a House of Representatives seat for which he didn't stand with 100% of the vote. Until something that visible occurs, this will remain a phony war.
”The 11-year-old girl was able to triple the number of votes found on the website in under 15 minutes.”
At last we know who to blame regarding the elephants in Africa!
#DeleteChrome
Certainly impressive hacking skills, but how can anyone know that the "replica" of the Florida election site is identical to the real site. They need to be able to hack into the real site.
"One 11-year-old boy changed the voting results in 10 minutes. A 11 year-old-girl was also able to change the voting results in 30 minutes".
But is he Russian?
That's all that matters.
I am sure that there are many other solipsists out there.
OR.... hack an election with the paper audit trail type voting machines, then challenge the result. The recount of the paper trail vs the machine will show the fraudulent nature of the machine count.
If you look at the current state of voting machine, you'll been dismayed. Pennsylvania still has paperless voting machines, it still cannot verify the election result and its not the only state to get unexpected voting results.
https://www.buzzfeednews.com/article/kevincollier/the-voting-machines-in-pennsylvanias-18th-dont-leave-a
The only fix for that is to show how the paper trail reveals the fraud, then block the use of these Fisher Price voting machines in court so trustable paper voting can be used.
How about you do your f*cking job and secure our elections, or you get fired and/or imprisoned?
"They need to be able to hack into the real site"
https://www.reuters.com/article/us-usa-election-security/u-s-senator-says-russians-have-penetrated-florida-election-systems-tampa-bay-times-idUSKBN1KU003
I've calculated my velocity with such exquisite precision that I have no idea where I am.
https://xkcd.com/2030/
Minors are taking suffrage into their own hands, I see.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Apparently manipulation what is being reported on election night isn't a big deal? What if for example seeing "Candidate A declared a projected winner by all stations" causes people planning to vote for the opponent to simply stay home thinking the election has already been decided?
Hacking the displayed info is a legit issue. Its a sign that the rest of the infrastructure is likely to be similarly poorly defended. One-off systems — like tabulation and voter registration — are inherently more fragile than mass-market systems that have had hundreds millions of hours worth of real world deployment to work the bugs out.
If they can't secure the most basic stuff, the stuff that everybody knows how to secure because its all common building blocks that have been vetted in hundreds of thousands of other systems, then we should not have any confidence that the more esoteric stuff is secured.
And that's just assuming human error. When you start seeing malicious efforts by the people running the systems, it gets much worse. For example, Russians secretly bought the company handling Maryland's elections systems software.
Imagine what insiders like that could do. They don't even have to hack the vote themselves, just "accidentally" leave in security vulnerabilities that the GRU hackers come along and exploit separately.
11 year old changes election results! ... er no, news about results posted to a website ... er, no, not an actual website, a fake one ...
Sheesh. I can always count on /.
Why is our sexist bias such that young women are not competitive in this sort of activity?
So much slower than the young men! Sad!!
They don't really. Without some kind of conspiracy, they have no practical way to get to the polls. That mom with 6 kids on welfare would need to find a babysitter. That homeless guy would need to hitchhike to the polls, and then once he got there jump through all the residency and voter registration hoops. Illegal immigrants: also not registered to vote, generally. Gangbangers were generally against Clinton because she called them "superpreditors" in 1996.
If you don't believe me, try being an election judge. You will see first hand how these people really don't vote at all.
The response from The National Association of Secretaries of State was:
"While it is undeniable websites are vulnerable to hackers, election night reporting websites are only used to publish preliminary, unofficial results for the public and the media. The sites are not connected to vote counting equipment and could never change actual election results."
I hate to say it, but that sure sounds like they just issued a challenge.
http://www.geoffreylandis.com
"While it is undeniable websites are vulnerable to hackers, election night reporting websites are only used to publish preliminary, unofficial results for the public and the media. The sites are not connected to vote counting equipment and could never change actual election results." https://www.nass.org/node/1511
You're forgetting West Virginia that is allowing online voting with your smartphone. https://www.wired.com/story/sm...
Of course there is no need for machine voting. Time that is required to count the votes is relatively short, even if it takes a day. Computers should only be used to verify the human performed count.
The opposite works slightly better: humans used to verify the machine-performed count.
It works better because if there is a flaw, I would want to see humans in the loop doing the final count.
http://www.geoffreylandis.com
That's just not true in the US. Here a typical ballot may consistent of a hundred different races. Ballot initiatives, sheriff's races, county commissioners, mayor, treasurer, judges, state reps, etc. It adds up. Hand counting each and every one of those is infeasible. The solution is two fold:
...
No, you missed a third solution: don't put so much stuff on the ballot.
Having a hundred different things on the ballot does not make democracy more democratic, it makes democracy work less effectively. Voters aren't paid; there is zero chance that any substantial fraction will do the work required to analyze a hundred different races.
Ballots with a hundred issues and races is the voting equivalent of micromanagement.
http://www.geoffreylandis.com
While it is undeniable websites are vulnerable to hackers, election night reporting websites are only used to publish preliminary, unofficial results for the public and the media. The sites are not connected to vote counting equipment and could never change actual election results.
While the preliminary results are by definition not final and not official, they do matter. What people *think* the results are can lead to riots. If the preliminary results are radically different than the final results, people lose confidence in the election process. If results (accurate or not) are published prior to the polls closing, people supporting the "winning" candidate may opt not to vote at the last minute, whereas those in support of the "losing" candidate may rush to the polls. If one wanted candidate A to win, they could hack the web server, and publish early results indicating that candidate B was winning, thus encouraging the desired turnout prior to polls closing.
If the polls don't close until 8, they often publish preliminary results before the polls close.
No, news media could publish exit poll results, but actual voting results--even preliminary results--aren't released until polls close. (And reputable news sources don't even publish exit poll results until the polls close.).
But... if you can hack into the election website, it doesn't matter that the people running the website don't release results until the polls close, because they're not running the website. So you could publish anything you want any time you want.
http://www.geoffreylandis.com
Disclosure: My Wife was/is part of the organization team so Im posting as AC for this one. The whole thing was a publicity stunt and you shouldn't believe too much of what you read
They kids did not use any type of SQL injection, it was part of the propaganda plan but too complex in execution for the kids. The only way to make it work was an obvious setup which they wanted to try and keep away from. The SD cards (which are normally locked away in the cabinet and not accessible) were similar in structure to a normal voting machine but everything was in plain text instead of hashed. The only things that was actually done by any kids without it being a setup were HTML element changes, which some were given training on beforehand. This HTML changes were done on a simplified replica of a site that displayed voting results from manual input, nothing at all to do with voting machines.
Simply put here were no hacks on voting machines (that element was sensibly pulled because it was just pure fraud) and no hacks on websites. The whole thing is just for publicity
No, news media could publish exit poll results, but actual voting results--even preliminary results--aren't released until polls close. (And reputable news sources don't even publish exit poll results until the polls close.).
All news media publish results as soon as they are available, and for national elections in the US that usually means three hours before the west coast polls close, and 6 hours before Hawaii's.
I recall hearing exit poll results in the early afternoon here on the west coast, but certainly by 5PM the news is full of them. In case you're going to try handwaving away that as just "exit polls", then remember that exit polls are considered significant enough that some people will cry "fraud" if the exit polls show their candidate winning but the actual result doesn't match.
As for your claim, I'll point you to Dixville Notch (a somewhat less unhappily named town compared to Dismal Nitch, WA), where:
So, 12:01AM Eastern time on election day, the first election results are published. Yet no "reputable" news source would do such a thing.
I'm sorry we are talking about different things.
In your example, you state that Dixville Notch publishes their results immediately after their polls close. That is echoing exactly what I said. They don't publish "preliminary" results before the polls close; they wait until the polls close and publish their results.
Other polls in other places may still be open, yes.
http://www.geoffreylandis.com
That is echoing exactly what I said. They don't publish "preliminary" results before the polls close; they wait until the polls close and publish their results.
They wait until THEIR polls close, yes. But the polls for almost every other place in their state, and in every other state in the Union, are still open. You said "the polls", not "their polls", and "the polls" are still open for the same election everywhere else.
Other polls in other places may still be open, yes.
Then "the polls" are not closed. It's the same damn election, voting for the same damn people. Trying to differentiate that THEIR polls are closed so it is just fine to publish the results when all the other polls are still open is ignoring the problem.
Oh, by the way, in the state of Oregon, where we have a special provision for super-majority on taxation measures that are on an other-than-regular election ballot, it is STANDARD PRACTICE for the election offices to publish preliminary results. Not the vote tally itself, but the percentage of returned ballots. That is of direct assistance to proposal supporters, because if the turnout is lagging it tells them their proposal cannot possibly pass. That's a call to get out more votes for them. In this case, the election results are not just votes yea and nay, but also percentage of registered voters. "We received 30% of the possible ballots" is a preliminary result.
A perfect illustration of people who despite all evidence to the contrary. begger the imagination.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Fake news. Misleading title, bullshit story that doesn't really mean what they pretend it does to get clicks. Things have kinda slid downhill around here.