Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cylance Discloses Voting Machine Vulnerability

blog.cylance.com

Post reply on HN
Print view View original

21–30 of 127 posts

Re: Cylance Discloses Voting Machine Vulnerability

#21

Post by Shank »

revelation wrote: post #8
Shank wrote: post #2

I worked as an election judge in the 2012 general election in Arapahoe County, Colorado. We had these exact machines. What isn't pictured is the physical security performed with them. Typically, tamper seals that are identifiable as broken are placed on all access doors (including the power switch, data load slots, etc), access panels, and openings on the device. All seals were verified in tact before and after the e…

The machines are sent back to a central point, without getting a report at the individual polling stations? I think I see the problem.

Results were printed out from the machines and posted outside the actual vote center after the election (Colorado law requires publishing the results of all electronic votes). If you were to visit a vote center after the polls closed, you'd see a tally report per machine on the window, visible for anyone to see.

The machines themselves were sent back and dumped. I don't actually remember if we printed 2 copies of everything (such as a copy for someone to tally up too).

Re: Cylance Discloses Voting Machine Vulnerability

#22

Post by Shank »

gergles wrote: post #12
Shank wrote: post #2

I worked as an election judge in the 2012 general election in Arapahoe County, Colorado. We had these exact machines. What isn't pictured is the physical security performed with them. Typically, tamper seals that are identifiable as broken are placed on all access doors (including the power switch, data load slots, etc), access panels, and openings on the device. All seals were verified in tact before and after the e…

> It's preposterous to think that election judges aren't actively verifying seals during election day and making sure nobody is tampering with them. I've been an election worker around the country and have never been in a jurisdiction that did seal checks during the election - only once at the beginning and once at the end. Granted, I've never been in a jurisdiction using DREs, but still. I agree physical security is…

I have no experience with non-DRE seal checking. Our seals had the machine serial numbers on them, with watermarks, etc. If a seal was mysteriously broken, it was in our best interest to take it out of service anyway, because suddenly the legitimate votes on that machine come into question.

Re: Cylance Discloses Voting Machine Vulnerability

#23

Post by empath75 »

alexandercrohde wrote: post #11

I think it's high time we start taking these concerns seriously. If state actors can accomplish stuxnet, then hacking a voting system seems well within the realm of technical possibility. Fortunately, there are pretty simple policies we can enact to prevent fraud and give faith in elections (both in America, as well as other countries). If you care, I'd perhaps start at https://www.verifiedvoting.org/

They don't even need to throw the election. Two or three machines with absurd results in favor of Clinton or Trump would be enough to push the county into civil unrest.

Re: Cylance Discloses Voting Machine Vulnerability

#24

Post by empath75 »

Shank wrote: post #14
seanwilson wrote: post #13

Is there any way you can prevent hacks like this that require physical access? I guess cryptographically signing the updates, adding tamper proof seals and requiring multiple people to approve updates would help. The general mantra however is that once a hacker has physical access to your machine all bets are off. Also, what happens if there's a random hardware/software glitch where incrementing one vote actually inc…

We definitely have seals, but for technical solutions, look at how Apple secures their devices. Signed firmware updates, public key crypto, and a well thought chain of trust solve these issues. The problem is that the actual poll creation is done on a per county basis. I don't know how you would do this in such a way that every random county an precinct in America could have signing keys, firmware updates, etc., just…

The real problem is that the people buying and making these systems don't really care about security, either out of incompetence or malice.

Re: Cylance Discloses Voting Machine Vulnerability

#25

Post by pmoriarty »

wybiral wrote: post #20
motardo wrote: post #16

Earlier quoted context omitted.

Yes. With paper ballots, cheating is at least detectable because there is literally a paper trail. With touch screens, maybe the results are correct, maybe the machine miscounted. There is no way to really know.

There are digital records more than just a tally. Sure, maybe it's possible (with physical access) to destroyed or altered them, but the same holds for paper.

It's much harder to undetectably destroy or alter large numbers of paper records than it is to do the same to digital records.

It's also sometimes possible to do this to digital records without ever being physically present in their vicinity. Once again, this is much harder with paper.

Re: Cylance Discloses Voting Machine Vulnerability

#26

Post by erichurkman »

Shank wrote: post #14
seanwilson wrote: post #13

Is there any way you can prevent hacks like this that require physical access? I guess cryptographically signing the updates, adding tamper proof seals and requiring multiple people to approve updates would help. The general mantra however is that once a hacker has physical access to your machine all bets are off. Also, what happens if there's a random hardware/software glitch where incrementing one vote actually inc…

We definitely have seals, but for technical solutions, look at how Apple secures their devices. Signed firmware updates, public key crypto, and a well thought chain of trust solve these issues. The problem is that the actual poll creation is done on a per county basis. I don't know how you would do this in such a way that every random county an precinct in America could have signing keys, firmware updates, etc., just…

The software/firmware would have its own signing keys. Counties would not have access to it. Counties could only load their specific voting profiles, which would be published similar to certificate transparency logs. The voting machines could display a signature of the ballot data in structured format for public auditing, that way each voter could check the signature (QR code, short generated phrase, etc) against a public record (newspaper, website, fliers printed in advance, etc).

Re: Cylance Discloses Voting Machine Vulnerability

#27

Post by azernik »

Shank wrote: post #21
revelation wrote: post #8

Earlier quoted context omitted.

The machines are sent back to a central point, without getting a report at the individual polling stations? I think I see the problem.

Results were printed out from the machines and posted outside the actual vote center after the election (Colorado law requires publishing the results of all electronic votes). If you were to visit a vote center after the polls closed, you'd see a tally report per machine on the window, visible for anyone to see. The machines themselves were sent back and dumped. I don't actually remember if we printed 2 copies of eve…

In CA (Alameda County), we print out two copies - one to be posted publicly, and one to be returned to the central collection center. The collection center gets the paper printout of results, the memory card, and a printout of the system logs.

Re: Cylance Discloses Voting Machine Vulnerability

#28

Post by azernik »

Shank wrote: post #22
gergles wrote: post #12

Earlier quoted context omitted.

> It's preposterous to think that election judges aren't actively verifying seals during election day and making sure nobody is tampering with them. I've been an election worker around the country and have never been in a jurisdiction that did seal checks during the election - only once at the beginning and once at the end. Granted, I've never been in a jurisdiction using DREs, but still. I agree physical security is…

I have no experience with non-DRE seal checking. Our seals had the machine serial numbers on them, with watermarks, etc. If a seal was mysteriously broken, it was in our best interest to take it out of service anyway, because suddenly the legitimate votes on that machine come into question.

In Alameda County, CA we use what look superficially to be the same machines, and have similar physical security measures - there are seals on all access points (e.g. on the cover protecting the power switch), and whenever we access one of them we save the seal's tag, log its ID, and log the ID of the replacement. At the end of the day you end up with basically a series of tags on a form that show chain of custody (the two people - always more than one - that handle the machine with a seal removed have to sign off on each change of tag).

EDIT: Note that we use these machines with an optional paper-printout add-on, and they're a non-default option mostly used to increase ballot accessibility - most people vote on paper ballots that are fed into a scanner on-site, so the scanner results can be cross-checked against the physical ballots in case of a disputed result.

Re: Cylance Discloses Voting Machine Vulnerability

#30

Post by kijin »

seanwilson wrote: post #15
godelski wrote: post #9

Really what it seems is that we need more audits on machines. If democracy is to be a pivotal part of our election process we need to release the source code of these machines to ensure that we find and solve problems.

Seems like a decent place to apply formal verification as well to show the machines are bug free. Voting machines are critically high impact if they have bugs and (famous last words) the complexity of the software seems low.

The counting app itself might be low-complexity, but I'm pretty sure the app runs on some kind of off-the-shelf OS with hundreds of millions of lines of code and at least a few known vulnerabilities.

A somewhat outdated version of Windows is a common choice, as is some random non-LTS version of Ubuntu. I don't think OpenBSD is particularly popular among self-serve kiosk manufacturers.

Post reply on HN