Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cylance Discloses Voting Machine Vulnerability

blog.cylance.com

Post reply on HN
Print view View original

31–40 of 127 posts

Re: Cylance Discloses Voting Machine Vulnerability

#31

Post by gregmac »

wybiral wrote: post #20
motardo wrote: post #16

Earlier quoted context omitted.

Yes. With paper ballots, cheating is at least detectable because there is literally a paper trail. With touch screens, maybe the results are correct, maybe the machine miscounted. There is no way to really know.

There are digital records more than just a tally. Sure, maybe it's possible (with physical access) to destroyed or altered them, but the same holds for paper.

If the tapering is part of the software, the digital records mean nothing. I don't get why these things get used at all.

Re: Cylance Discloses Voting Machine Vulnerability

#32

Post by code_duck »

rsobers wrote: post #29
top_post wrote: post #10

"The decision to announce the research findings was intended to encourage increased sales and revenue for Q4 2016."

Ugh.

not sure are aware, but the actual quote is "The decision to announce the research findings was intended to encourage remediation of the vulnerabilities prior to Election Day".

Re: Cylance Discloses Voting Machine Vulnerability

#34

Post by code_duck »

alexandercrohde wrote: post #11

I think it's high time we start taking these concerns seriously. If state actors can accomplish stuxnet, then hacking a voting system seems well within the realm of technical possibility. Fortunately, there are pretty simple policies we can enact to prevent fraud and give faith in elections (both in America, as well as other countries). If you care, I'd perhaps start at https://www.verifiedvoting.org/

The disturbing thing is that Stuxnet is more sophisticated than what it would take to control most voting machines. I think NSA type agencies for many countries and corporate espionage departments complete more complicated tasks every day.

Re: Cylance Discloses Voting Machine Vulnerability

#35

Post by code_duck »

empath75 wrote: post #23
alexandercrohde wrote: post #11

I think it's high time we start taking these concerns seriously. If state actors can accomplish stuxnet, then hacking a voting system seems well within the realm of technical possibility. Fortunately, there are pretty simple policies we can enact to prevent fraud and give faith in elections (both in America, as well as other countries). If you care, I'd perhaps start at https://www.verifiedvoting.org/

They don't even need to throw the election. Two or three machines with absurd results in favor of Clinton or Trump would be enough to push the county into civil unrest.

but so far the country as a whole has shown almost no interest in the insecurity of electronic voting machines.

Re: Cylance Discloses Voting Machine Vulnerability

#37

Post by peterarmstrong »

Dear America,

This all sounds complicated and insecure.

Why can you not just do paper voting with simple ballots, like in Canada?

Yes, you have 10x the people, but just get 10x the human counters and scrutineers. Counting is parallelizable.

We run elections and get accurate, verifiable results in the same day.

Ours aren't as nasty as yours are, and we still have better anti-fraud than you do, since every paper ballot can be counted, as many times as needed. And since the thing which is counted is the same physical thing which can be audited, we can always verify the results if anything goes wrong.

You've had some problems with your ballots 16 years ago, and we're not sure why you haven't fixed this by now. After all, you've gotten people to the moon and robots to Mars--surely you'd want a fair, verifiable presidential election? (Especially when one of the two candidates is, frankly, terrifying to all your friends around the world.)

Love, Canada

Re: Cylance Discloses Voting Machine Vulnerability

#38

Post by DSMan195276 »

kijin wrote: post #30
seanwilson wrote: post #15

Earlier quoted context omitted.

Seems like a decent place to apply formal verification as well to show the machines are bug free. Voting machines are critically high impact if they have bugs and (famous last words) the complexity of the software seems low.

The counting app itself might be low-complexity, but I'm pretty sure the app runs on some kind of off-the-shelf OS with hundreds of millions of lines of code and at least a few known vulnerabilities. A somewhat outdated version of Windows is a common choice, as is some random non-LTS version of Ubuntu. I don't think OpenBSD is particularly popular among self-serve kiosk manufacturers.

I think it's worth adding that if it doesn't use some off-the-shelf OS, then the complexity of the software just jumped a few levels because you're talking about writing a lot more lower-level components to make it work. Using an off-the-shelf OS is almost definitely the better way to go unless there's some obvious reason that it won't work (Like architecture issues). I would also add that the choice of OS matters a lot less then configuration - If you do your configuration carefully and strip down the active components in the system, then you can make any of them secure enough for this task. And if you do a poor job of it, then even OpenBSD isn't going to save you.

That said, while I do agree the voting software should be open-source in principle, I'm not really as concerned with hackable bugs in that software that can only be exploited through physical means. If they have physical access to the machine like in this video then you're already shot - ideally you have preventive measures that will make it obvious when physical access has occurred. If you don't physically secure the machine, then it doesn't really matter how good the code is.

Re: Cylance Discloses Voting Machine Vulnerability

#39

Post by JumpCrisscross »

gergles wrote: post #12
Shank wrote: post #2

I worked as an election judge in the 2012 general election in Arapahoe County, Colorado. We had these exact machines. What isn't pictured is the physical security performed with them. Typically, tamper seals that are identifiable as broken are placed on all access doors (including the power switch, data load slots, etc), access panels, and openings on the device. All seals were verified in tact before and after the e…

> It's preposterous to think that election judges aren't actively verifying seals during election day and making sure nobody is tampering with them. I've been an election worker around the country and have never been in a jurisdiction that did seal checks during the election - only once at the beginning and once at the end. Granted, I've never been in a jurisdiction using DREs, but still. I agree physical security is…

I have been an election worker. We were asked to sign the attestation envelopes in advance.

I trust further checks were conducted higher up. But at our level, protocol was ignored.

Re: Cylance Discloses Voting Machine Vulnerability

#40

Post by slim »

Shank wrote: post #2

I worked as an election judge in the 2012 general election in Arapahoe County, Colorado. We had these exact machines. What isn't pictured is the physical security performed with them. Typically, tamper seals that are identifiable as broken are placed on all access doors (including the power switch, data load slots, etc), access panels, and openings on the device. All seals were verified in tact before and after the e…

You mean I could void all the votes simply by tampering with the seal? Seams like an easy attack
Post reply on HN