Slashdot Mirror
No, a Teen Did Not Hack a State Election (propublica.org)
Headlines from Def Con, a hacking conference held this month in Las Vegas, might have left some thinking that infiltrating state election websites and affecting the 2018 midterm results would be child's play. Articles reported that teenage hackers at the event were able to "crash the upcoming midterm elections" and that it had taken "an 11-year-old hacker just 10 minutes to change election results." A first-person account by a 17-year-old in Politico Magazine described how he shut down a website that would tally votes in November, "bringing the election to a screeching halt." But now, elections experts are raising concerns that misunderstandings about the event -- many of them stoked by its organizers -- have left people with a distorted sense of its implications. From a report: In a website published before r00tz Asylum, the youth section of Def Con, organizers indicated that students would attempt to hack exact duplicates of state election websites, referring to them as "replicas" or "exact clones." (The language was scaled back after the conference to simply say "clones.") Instead, students were working with look-alikes created for the event that had vulnerabilities they were coached to find. Organizers provided them with cheat sheets, and adults walked the students through the challenges they would encounter. Josh Franklin, an elections expert formerly at the National Institute of Standards and Technology and a speaker at Def Con, called the websites "fake." "When I learned that they were not using exact copies and pains hadn't been taken to more properly replicate the underlying infrastructure, I was definitely saddened," Franklin said. Franklin and David Becker, the executive director of the Center for Election Innovation & Research, also pointed out that while state election websites report voting results, they do not actually tabulate votes. This information is kept separately and would not be affected if hackers got into sites that display vote totals.
Linux geeks and programmers on Slashdot, we known damn well they hacked the website, not the voting machine and we also know damn well that any voting machine without a paper audit trail, reports whatever the votes the Russian hacker says it should report.
Stop the PR effort against auditability, and help get the last of the states still using non-auditable voting machines to get their shit together.
There should *not* be a single voting machine now that cannot be audited, yet Florida and Pennsylvania, both swing states, both running large number of DRE machines without paper audit trails. How the f**k is that even legal, they could never comply with a recount, because they could only recount what the voting machine says it recorded as the vote, not the actual voters vote.
It's not a good thing, to pretend there is no problem here and sweep it under the rug, block the use of the paperless voting machines and use the emergency paper voting backup. Because the vote is worth far more than the Grocery you bought at Walmart and received a *paper* receipt for.
Sometimes people feel so strongly about a cause, for example the dangers of electronic voting, that they think its ok to distort information or even outright lie for that cause. Its becoming very common - and I think its always wrong.
While the organizers of the event themselves stoked the misunderstanding, everything about it smelled like a kids hacking competition with an election theme rather than a real thing. Even if you assumed that the headliner child was some sort of once in a lifetime super genius, it certainly wouldn't have been the case for the majority of the participants to succeed, which did occur.
If the real thing were so trivial so that an 11 year old could casually do it, then one of the *huge* number of veteran security researchers would have found those problems for real in the real sites.
XML is like violence. If it doesn't solve the problem, use more.
You mean an 11-year-old boy and 11-year-old girl didn't just hack all-der-voting-machines with their mad-crazy l33t hacking skills alone?!?
You lied to me AGAIN, media! DAMN YOUR HOUSE OF LIES!
SJW: Someone who has run out of real oppression, and has to fake it.
Yeh sure, the election wasn't hacked, those hacked emails were all nothingburgers and Slashdot wasn't deluged with a bunch of "Texas Houswives" suddenly concerned about "Bengazi".
Also computers never get hacked, even modern ones, Windows XP used in these old voting machines without paper trials has stood the test of time. No need to add any kind of paper trail, or test their security, since mother time has tested it for you!
Also Russian asbestos is totally tasty and edible and should be used as a filler in nothingburgers!
As I commented in another thread on election security, unless you have run an actual election, you probably don't appreciate the sheer scale of what's involved in securing an election. I am an election officer in Virginia. Let me shed some light on the subject.
An election is a massively live event involving hundreds of millions of individuals spread out over 7 time zones (don't forget Guam) and an entire continent-sized geographic area.
51 independent elections are held, each with their own rules of procedure, equipment, and personnel, with the exception of some common rules for federal elections.
Within these 51 elections there are thousands of individual voting precincts where the actual votes are counted. Each one of those 51 x 000s precincts are under the complete supervision and control of volunteers. No politician or government worker ever administers the casting of a vote. This is done by your neighbors, a veritable small army of people.
A voter can only vote in the same physical place where they are a resident. You cannot vote remotely.
Before you can cast your vote, in most states you must prove your identity and residency. In all states, this process is entirely disconnected from the actual casting of a ballot.
Except in two states that allow mail-in voting (shame on them), your vote is completely private. No one can force you to vote against your conscience. No one can force you to prove how you voted.
The threat surface of such an undertaking is massive. There is the possibility of fraud in registering voters. There is possible fraud in selecting and configuring equipment. There is possible fraud in authentication. There is possible fraud in training (or lack thereof). There is possible fraud in counting. There is possible fraud in administration and reporting. And on and on.
There is no "this one thing" that can defeat an election. To successfully throw an election is a non-trivial task of monumental proportions. Of course that doesn't stop people from trying.
The gold standard preventative tools we use to secure a vote are:
- Contemporaneous, independent protocols recording the votes, such as scanned paper ballots, hourly running call logs of the number of voters voting, and duplicate end-of-day reports placed under court custody
- 100% Chain-of-custody controls of equipment
- Black-box testing
- Training, training, training
- Aggressive de-duplication and data cleansing.
Anyone who tells you that some 11 year-old can "throw" an election with a hack on some copy of a reporting web site is just trying to sell you something or gain some internet fame.
"We receive as friendly that which agrees with, we resist with dislike that which opposes us" - Faraday
Only exist in film.
Avantgarde Hebrew science fiction
...Headlines from Def Con, a hacking conference held this month in Las Vegas, might have left some thinking ...
... but all the articles I read on the topic left me with the impression that it was a duplicate copy of the election system, not the real, live election system itself.
I don't think you quite grasp the degree to which how many Americans have literally no voice in things.
Gerrymandering only impacts House elections and state assembly and other local elections, gerrymandering has no impact on Senate or Presidential races, where state electoral votes are assigned based on the state-wide totals each candidate receives.
Your willingness to declare your vote meaningless in all elections is interesting, I suspect it is you that doesn't quite grasp how the election process works.
Ken
I knew as soon as I heard the story that it was 100% pure, uncut bullshit. That much was obvious. I figured the "exact copy" of the website was the HTML code your computer downloads when visiting the site, and that THAT's what he allegedly changed, which is a bit like claiming someone can hack your car and open the doors because he can open the doors on HIS car, which happens to be the same kind as your car, and oh, we forgot to mention the doors were already unlocked... or something like that. In any case, even if for not precisely the right reasons, I was right about the fact that the story was total bullshit.
HOWEVER... I can't help but wonder if this is going to turn into a zombie-lie, you know, a fake, bullshit story that people go on citing over and over again either in stupid, pointless verbal arguments or in substantiate, meaningful, important debates on matters of policy, and that the dolts who are convinced that an 11 year old hacked into the voting system of a US state... will keep spouting this debunked claim over and over again. I'm sure in some circles, it will. Anything, for some people, that serves the point of their argument, they'll insist is "valid" even when it plainly ISN'T.
Our reign has gone on long enough. Indeed. Summon the meteors.