Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An 11-Year-Old Changed the Results of Florida's Presidential Vote at DEFCON

buzzfeednews.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: An 11-Year-Old Changed the Results of Florida's Presidential Vote at DEFCON

#21

Post by humantiy »

TL;DR from the title. 11 year old uses sql injection to change the election results on a voting machine at defcon.

In reading the headline I was expecting they would explain it within the first few paragraphs but instead buried what the kid did in the last 5 sentences of the article.

Like most of us though still alarms me that these machines are in use and have some easily exploitable vulnerabilities but as mentioned by one of the vendors in the article some/most of these exploits require physical access to the voting machine. Not to take way from the exploits but it would be pretty obvious if someone was doing this (plugging a device into the voting machine) on election day.

Re: An 11-Year-Old Changed the Results of Florida's Presidential Vote at DEFCON

#22

Post by em3rgent0rdr »

humantiy wrote: post #21

TL;DR from the title. 11 year old uses sql injection to change the election results on a voting machine at defcon. In reading the headline I was expecting they would explain it within the first few paragraphs but instead buried what the kid did in the last 5 sentences of the article. Like most of us though still alarms me that these machines are in use and have some easily exploitable vulnerabilities but as mentioned…

> "it would be pretty obvious if someone was doing this (plugging a device into the voting machine) on election day."

Poll workers (or someone posing as a poll worker) could easily do this and it wouldn't be noticed as suspicious because poll workers are naturally assumed to be allowed to interact with the poll machines.

"What are you doing there?"

"Oh, just updating the firmware to protect against a new zero-day threat."

Re: An 11-Year-Old Changed the Results of Florida's Presidential Vote at DEFCON

#23

Post by em3rgent0rdr »

amerine wrote: post #2

lol, anyone in the trenches of computering thinks electronic voting is terrible. I don’t even trust electronic vote tabulation.

Unless if done right with end-to-end verifiable manner with auditable paper trail. [1]

[1] https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy...

Re: An 11-Year-Old Changed the Results of Florida's Presidential Vote at DEFCON

#24

Post by happytoexplain »

floren wrote: post #6

I've noticed now it's become almost accepted knowledge among the general public that Russia literally hacked election machines and changed votes. Even this article appears to present that view in the first couple paragraphs before finally stating otherwise halfway through.

This is tricky, because it's a very easy thing to convince oneself of, given the desire to do so. From my experience, I don't think that particular misinterpretation of the interference is unusually prevalent. In fact, it might even be less prevalent than "normal", considering how these things usually go. My pessimistic side expected far more calls of "Russia changed the votes!" than there are. What I've actually seen in news and conversations a surprising amount of the time is a more accurate definition of the scope of what did happen and what we don't know.

Re: An 11-Year-Old Changed the Results of Florida's Presidential Vote at DEFCON

#25

Post by jrnichols »

1023bytes wrote: post #17
floren wrote: post #6

I've noticed now it's become almost accepted knowledge among the general public that Russia literally hacked election machines and changed votes. Even this article appears to present that view in the first couple paragraphs before finally stating otherwise halfway through.

I really don't understand what the media is trying to accomplish by pushing this narrative. This fear mongering will create distrust in elections and the election results, undermining democracy.

I haven't seen that, in fact it's been the opposite. I've met more people that want to get out and vote, not because they believe in the system or trust it, but because they hate Trump with a seething passion.

They also believe that Russia literally hacked into voting registers and changed votes too. They are confused with the Russia/DNC hack connection, though, but evidence to the contrary has not convinced them otherwise. So they think "voting can easily be hacked, but I hate Trump, so I need to make sure that I vote."

Re: An 11-Year-Old Changed the Results of Florida's Presidential Vote at DEFCON

#26

Post by burnallofit »

jeffreybezos wrote: post #5

The headline is a bit sensationalist. There was a SQL backed lab setup with loaded results from Secretary of States websites, for kids to attempt SQL injection attacks.

Source? I believe you, just would like to see for myself.

Re: An 11-Year-Old Changed the Results of Florida's Presidential Vote at DEFCON

#27

Post by humantiy »

em3rgent0rdr wrote: post #22
humantiy wrote: post #21

TL;DR from the title. 11 year old uses sql injection to change the election results on a voting machine at defcon. In reading the headline I was expecting they would explain it within the first few paragraphs but instead buried what the kid did in the last 5 sentences of the article. Like most of us though still alarms me that these machines are in use and have some easily exploitable vulnerabilities but as mentioned…

> "it would be pretty obvious if someone was doing this (plugging a device into the voting machine) on election day." Poll workers (or someone posing as a poll worker) could easily do this and it wouldn't be noticed as suspicious because poll workers are naturally assumed to be allowed to interact with the poll machines. "What are you doing there?" "Oh, just updating the firmware to protect against a new zero-day thr…

Interact sure, but on election day no way would they be 'updating the firmware'. From my own personal experience there is always more than one person watching or hands-on the polling machines. I'm sure some places are probably more lax than my experience.

There is also variance in where you vote what machine they might have. My location has always been a scantron type and only one device per voting location. You'd have to know ahead of time what device is used where and have the correct exploit handy. Still in my scenario going to be hard to pull off an exploit while people are waiting to enter their ballots into the machine.

Not saying it couldn't be done but I'd say it is out there for a probable attack. They do make for good headlines and of course are something no one wants to see tampered with. I'm glad the one's in my district still have a paper trail, which has been used in the past to verify votes by hand when the election was close.

Post reply on HN