Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DEF CON report on vulnerabilities in US election infrastructure [pdf]

defcon.org

Post reply on HN
Print view View original

71–80 of 145 posts

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#71

Post by jiveturkey »

texuf wrote: post #3

The conclusion: Over the last 26 years, DEF CON, and for the last two years, the Voting Village, have operated under two core principles: 1. It is important to derive facts through reason and inquiry rather than blind faith. 2. When we discover new facts, it’s important we share this information with the general public so individuals can decide how best to use the information. We did not make these principles up ours…

> 2. Remote Attacks Proven: ​Despite insistence the fact that machines are “air gapped” from the Internet protects against all remote attacks, both DEF CON 25 and 26 found exploits to hack machines remotely, requiring physical access to the machine.

Did you leave out a word?

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#72

Post by mmaunder »

mattferderer wrote: post #34
rotten wrote: post #10

There are a lot of words in this document. What we need is some infographics that boil it down into something people without the time to read and parse all of those findings can understand easily. A map showing vulnerable states, some pictures showing how easy it is to circumvent a particular system. Something that shows what percentage of machines are vulnerable and an easy way to know if the machines in my district…

I would also like to see some things have more details, such as the 11 yr old hacking a mock up of the Florida election website. Was this a true representation of what Florida used or a learning tool with flaws built into it? I feel I could spend well over a week going through trying to learn more about each point made. I've also heard some people claim that a lot of these voting machines are no longer used.

It was a learning tool with built in flaws and the kids were coached.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#73

Post by mulmen »

Klover wrote: post #2

I was surprised to read that this remote vulnerability is possible in 23 states. I thought that the United States prides itself on its democracy? How come voting machines are possible in a democracy?

You're conflating the American idea of democracy with voting. They're only tangentially related. We have one of (maybe the) lowest voter turnout rate and institutionalized voter disenfranchisement is as popular as baseball.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#74

Post by sbov »

gumby wrote: post #56
carrja99 wrote: post #47

Earlier quoted context omitted.

I totally made it up, but it's not far. For example, here in MO they put a ballot initiative titled "Right to Farm" on the ballot and advertised it as "we're protecting your right to farm! Standing up for the small family farmers!" when in reality it keeps people from having standing to sue a factory farm when runoff from a pig farm pollutes their land.

After California Prop 8 (vote for gay marriage! Where "yes" meant "prohibit it" and "no" meant "don't prohibit it") California adopted a measure where the AG has to verify that ballot measure titles are neutral.

The name of the prop actually wasn't confusing.

Initially it was called "California Marriage Protection Act", which is pretty common for anti-gay-marriage acts.

Later it was called "Eliminate Rights of Same Sex Couples to Marry". Which is 100% obvious.

Only people who lazily called it the "gay marriage prop" were confused.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#75

Post by zackmorris »

kadendogthing wrote: post #44

From the "Next Steps" section in the report: >Congress Must Fund Election Security:​ National defense is not the role of state and local government. Further, no state or local government will ever be able to raise enough capital to defend itself from a determined nation state. Thus, having codified the basic security standards developed by local election officials above, Congress must finance the implementation of th…

I was just going to post that. I'm concerned that since election security is not (just) a technological problem, that very little will be done to improve it in the foreseeable future.

I'm from Idaho which is currently conservative by close to a 2/3 majority, but remember growing up that we had many liberal elected officials like Cecil Andrus and Frank Church. From my perspective, democrats are working to improve election security while republicans are not.

Is this simply a partisan issue? Does anyone from more liberal states have examples of democrats opposing election security?

If so - then how do we work to improve election security when our elected officials refuse to? If not - then how do we accomplish reforms within the republican party or make election reforms into political capital that it might be willing to trade for?

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#77

Post by hvdhh7 »

Klover wrote: post #2

I was surprised to read that this remote vulnerability is possible in 23 states. I thought that the United States prides itself on its democracy? How come voting machines are possible in a democracy?

This isn't a remote vulnerability, btw. The attach involves picking the lock a and inserting a device to a parallel port.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#78

Post by failrate »

logfromblammo wrote: post #61
failrate wrote: post #54

Earlier quoted context omitted.

Yes, electronic voting machines are the problem. That is what this article is about.

And I'm saying they can never not be a problem. The usage requirements make them 100% incompatible with election security. They are broken by design, and utterly unfixable. The specifics of the known exploits are therefore somewhat irrelevant, because there will always be some means of compromising them. So the only way forward would be to treat every last one of them as permanently untrusted hardware. While there ma…

I didnt get the impression that anyone on this thread thought differently. Even without the theoretical impossibility of the task, the implementations we are seeing are amateur comedy, at best.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#79

Post by michaelmrose »

crankylinuxuser wrote: post #11
texuf wrote: post #3

The conclusion: Over the last 26 years, DEF CON, and for the last two years, the Voting Village, have operated under two core principles: 1. It is important to derive facts through reason and inquiry rather than blind faith. 2. When we discover new facts, it’s important we share this information with the general public so individuals can decide how best to use the information. We did not make these principles up ours…

Ok. So, those are powerful findings of fact. From this, what has been done thus far regarding: State election boards State House/Senate committees on elections Local election judges and boards Federal House/Senate committees on elections I would assume that these allegations must be verified. However, since all the procedures and observations are being made in the open, they should be relatively easy to confirm. But,…

Nothing there was a measure to spend money improving security of voting systems but Republican's defeated it. Meanwhile one of the largest manufacturer of voting machines openly came out for bringing in the votes for the Republicans and at least one developer has openly asserted that he was asked to enable fudging the vote.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#80

Post by acranox »

ragebol wrote: post #7
texuf wrote: post #3

The conclusion: Over the last 26 years, DEF CON, and for the last two years, the Voting Village, have operated under two core principles: 1. It is important to derive facts through reason and inquiry rather than blind faith. 2. When we discover new facts, it’s important we share this information with the general public so individuals can decide how best to use the information. We did not make these principles up ours…

> it takes about six minutes to vote Why does voting take 6 minutes? I think I used a voting machine maybe once in my life (in the Netherlands and apparently young enough to not have used those more often). Casting a vote on paper is usually checking a box with a red pencil, takes maybe a minute of dealing with the huge sheet of paper with all the candidates. Just curious.

After Florida 2000, a lot of us take our sweet time double, and triple checking that we're marking the right box, and, in the case of paper ballots, very carefully filling in the box fully, but not too full.
Post reply on HN