11-Year-Old Changes Election Results On Florida's Website: Defcon 2018 (pbs.org)

UnknowingFool writes: At this year's DEFCON, a group of 50 children aged 8 to 16 participated in a hack of 13 imitation election websites. One 11-year-old boy changed the voting results in 10 minutes. A 11 year-old-girl was also able to change the voting results in 30 minutes. Overall, more than 30 of the 50 children were able to hack the websites in some form. The so-called "DEFCON Voting Machine Hacking Village" allowed kids the chance to manipulate vote tallies, party names, candidate names and vote count totals. The 11-year-old girl was able to triple the number of votes found on the website in under 15 minutes.

The National Association of Secretaries of State said in a statement that it is "ready to work with civic-minded members of the DEFCON community wanting to become part of a proactive team effort to secure our elections." But the organization expressed skepticism over the hackers' abilities to access the actual state websites. "It would be extremely difficult to replicate these systems since many states utilize unique networks and custom-built databases with new and updated security protocols," it read. "While it is undeniable websites are vulnerable to hackers, election night reporting websites are only used to publish preliminary, unofficial results for the public and the media. The sites are not connected to vote counting equipment and could never change actual election results."

Comments

Misleading Title

[_Sharp'r_]

11-Year-Old Changes Election Results On Florida's Website: Defcon 2018

should actually be:

11-Year-Old Changes Numbers Displayed On Faked Replica HTML Page Setup to be Changed by Kids: Defcon 2018

Re:Misleading Title

[Tunefix]

Apparently they used simple techniques such as SQL-injection, and swapping accessible SD-cards on the poll-book-machines.
Also, on the SD-cards pulled from the machines, they found usernames and passwords in plaintext.

Re:Misleading Title

[Anonymous Coward]

Likely it is something like that. However, there is NO reason at all, none, not a single reason in the universe, to have any form of automated vote counting. To have electronic voting. To have mechanized voting. I mean, what the flying fuck.... you get a card, you mark an X on it, and you're done.

Here we have representatives from each party, at each voting site, counting the vote together. And we have up to 6 or 7 legitimate parties, even in Federal elections! There is no benefit for mechanized or electronic voting, or counting. None. Nada.

If someone is going to blather on about "counting", ffs. It's not that hard, at all. We have all those parties, and we get counts an hour after polls close.

Some things do NOT need to be improved. Ever!

And the cost to democracy is waaaaaay, way too high.

Re:Misleading Title

[AmiMoJo]

Which is normally how security demos work, because hacking the real site would be illegal.

The point here is that those sites are vulnerable to literal script kiddie attacks. While the government tries to hand wave it away as just an attack on a site showing preliminary results and correctly points out that such a site would not be used to make the official determination of who won, that's missing the point.

These days such a hack would spawn a brand new QAnon-style conspiracy theory, pushed on social media by the same people did the hack. It would further erode trust in the electoral system, which leads to lower turnout next time. It makes the whole process look like some dictatorship doing a bad job of rigging the votes.

Re: Misleading Title

[Luckyo]

The sad part of this narrative is that you take something that is factually correct and should be used to beat the guilty party into submission to paint an innocent party.

Yes, what was done to police force in UK is fucking horrifying. But it wasn't the media that did it. At most, it is complicit, but the main act was by someone else. It was the government, driven by anti-Western ideologues that its university are now producing. Read the 1998 McPherson report. It literally states that it has found no evidence for any systemic racism in Metropolitan police service or Crown Prosecution Service. And then goes to conclude that both of those parties were institutionally racist. It literally took the innocent people, concluded that it had no evidence of their wrongdoing, and then publicly hanged them for the crimes that they had no evidence for.

After this, police were utterly horrified of even the mentioning of the word racist toward them, and for a good reason. And it had nothing to do with "jews" or "media" at that point. It had everything to do with McPherson's witch hunt and government's will to go with it.

And this witch hunt has continued ever since, since the progressive movement with its ultimate goal of destruction of Western civilization took this decision and used it in media among other places to terrorize both the police and prosecution services in UK ever since.

So put blame on correct people. Your target for blame should be McPherson and his progressive cronies first and foremost, and people in government who haven't touched the report itself, and instead simply read the conclusions and took them for granted.

Re: Misleading Title

[omnichad]

I think you'll find that stupidity is a fully bipartisan thing.

We need a visible and unambiguous hack to occur

[Bruce66423]

Something like Bill Gates winning a House of Representatives seat for which he didn't stand with 100% of the vote. Until something that visible occurs, this will remain a phony war.

Re:We need a visible and unambiguous hack to occur

[Opportunist]

And why would I do that when I could make Senator A president, become a billionaire in the process and get perpetual legal immunity? It sure beats being hunted down by every three-letter-agency in the US for showing that the emperor has no clothes and then spending the rest of my life in the worst kind of prison in an attempt to not only have the world forget me but also to send a message to everyone who'd dare to repeat my stunt.

Re:We need a visible and unambiguous hack to occur

[Buchenskjoll]

Why don't all American hackers get together to hack the election and get some ridiculous clown elected as president to prove how vulnerable the election system is?

Hey..., wait... did you already do that?

Finally

[93 Escort Wagon]

”The 11-year-old girl was able to triple the number of votes found on the website in under 15 minutes.”

At last we know who to blame regarding the elephants in Africa!

Damn, now they have 11-year-old sleepers!

[Archtech]

"One 11-year-old boy changed the voting results in 10 minutes. A 11 year-old-girl was also able to change the voting results in 30 minutes".

But is he Russian?

That's all that matters.

Re:Damn, now they have 11-year-old sleepers!

[c]

But is he Russian?

That's all that matters.

Nonsense. What matters is that the boy and the girl both got the same pay for the hack.

Hack an election with paper trail

[Anonymous Coward]

OR.... hack an election with the paper audit trail type voting machines, then challenge the result. The recount of the paper trail vs the machine will show the fraudulent nature of the machine count.

If you look at the current state of voting machine, you'll been dismayed. Pennsylvania still has paperless voting machines, it still cannot verify the election result and its not the only state to get unexpected voting results.

https://www.buzzfeednews.com/article/kevincollier/the-voting-machines-in-pennsylvanias-18th-dont-leave-a

The only fix for that is to show how the paper trail reveals the fraud, then block the use of these Fisher Price voting machines in court so trustable paper voting can be used.

Re:A Replica ?

[sjames]

Contributing to the delinquency of a minor, such as encouraging them to hack the real page, would be a crime. Suggestions?

Mission Accomplished

[hyades1]

"They need to be able to hack into the real site"

https://www.reuters.com/article/us-usa-election-security/u-s-senator-says-russians-have-penetrated-florida-election-systems-tampa-bay-times-idUSKBN1KU003

Relevant

[NicknameUnavailable]

https://xkcd.com/2030/

Re:Relevant

[ftobin]

Also relevant: https://xkcd.com/932/

Short sighted

[misnohmer]

Apparently manipulation what is being reported on election night isn't a big deal? What if for example seeing "Candidate A declared a projected winner by all stations" causes people planning to vote for the opponent to simply stay home thinking the election has already been decided?

quite a summary

[cascadingstylesheet]

11 year old changes election results! ... er no, news about results posted to a website ... er, no, not an actual website, a fake one ...

Sheesh. I can always count on /.