Securing Elections

guest · Dec 1, 2019

Russian-Owned Company Attempted Cyberattack On Ohio’s Election Site On Voting Day
November 30, 2019
https://www.inquisitr.com/5770626/russian-company-ohio-election-cyberattack/

A Russian-owned company attempted what was described as a clumsy cyberattack on the state of Ohio’s election website on voting day, a top state official has revealed.

Ohio Secretary of State Frank LaRose announced this week that the unnamed company tried to carry out a “relatively unsophisticated” attack on November 5, the same day that people across the state were taking to the polls. As The Associated Press reported, the attack originated in Panama but was traced back to the Russian company.
LaRose noted that election results and election machines in Ohio are not connected to the internet, keeping them safe from cyberattacks.
Click to expand...

Krusty · Dec 1, 2019

ACT Government hacks expose lack of 'basic cyber hygiene' in territory's online security: expert

wo hacking attacks on the ACT Government, one involving the personal details of government employees, show a "lack of awareness", a security expert has warned, saying smaller governments are a potential target for criminals.

ACT Government data was accessed by outside actors twice in less than six months during 2018.

In one incident, hackers accessed the ACT Government Directory, containing corporate contact information for thousands of public servants.

Some contact cards included personal details, like mobile phone numbers.

The ACT Government has since introduced two-step authentication across its networks in response, a step some experts suggest should have been taken some time ago.

The attacks left Nigel Phair, the head of UNSW Canberra's cyber unit, questioning the digital security of smaller governments like the ACT's.

"I don't think there's any awareness at all," he said.

"I think if you ask the average person at those organisations, they'd say 'we're not a bank, why would anyone want to hack us?'"
Click to expand...

https://www.abc.net.au/news/2019-12-02/cyber-security-act-government-hack-awareness/11755394

guest · Dec 3, 2019

Graham says he's '1,000 percent confident' Russia, not Ukraine, hacked DNC
December 3, 2019
https://thehill.com/homenews/senate...-confident-russia-hacked-dnc-it-wasnt-ukraine

Sen. Lindsey Graham (R-S.C.) on Tuesday said he's "1,000 percent confident" Russia was responsible for hacking the Democratic National Committee (DNC) as part of an effort to interfere in the 2016 election, dismissing the theory that Ukraine played a role in the breach.

"It was the Russians. I'm 1,000 percent confident that the hack of the DNC was by Russian operatives, no one else," Graham told reporters on Capitol Hill.
"I have no evidence [Ukraine] did. Russia stole the emails, not the Ukraine," he added.
Intelligence officials have also reportedly briefed senators that Russia engaged in an effort to frame Kyiv for its election interference.
Click to expand...

guest · Dec 6, 2019

Electoral hackers facing security blitz
December 6, 2019
https://www.9news.com.au/national/e...ty-blitz/dd4a5c43-a411-4db6-a8bf-56ba3a96330c

Federal police and national intelligence agencies could monitor state and territory elections next year to ensure they aren't hacked or hijacked by fake news.

An electoral integrity task force has so far overseen the NSW and federal elections and will turn its attention to future polls, a parliamentary committee heard on Friday.
"We've started to consider what the future may well look like and members of the board have been engaging with state electoral commissions about what support can be provided for state elections," Mr Pope said.
Click to expand...

guest · Dec 6, 2019

mood said: ↑

Facebook reveals preparations for UK election
October 21, 2019
https://www.bbc.co.uk/news/technology-50128055

Facebook: Helping to Protect the 2020 US Elections
Click to expand...

Facebook's plans to label state media are complicated — and delayed
December 6, 2019
https://edition.cnn.com/2019/12/06/media/facebook-state-media-al-jazeera/index.html

Social media companies are feeling their way in the dark, and sometimes fumbling their way through new efforts to fight misinformation on their platforms as they roll out rules that are meant to increase transparency.
These efforts include labeling state-funded and state-controlled media — news organizations that are wholly or in part managed or funded by state governments.

In October, the company said it would label publications that are "wholly or partially under the editorial control of their government as state-controlled media."
Facebook was due to start labeling an initial list of publications in November. It missed that target, and a spokesperson told CNN Business only that it is "coming soon." Facebook did not explain the delay.
"We committed to labeling these pages and will begin doing so soon," a spokesperson said on Friday.
Click to expand...

guest · Dec 6, 2019

Deadline looming for Ohio’s county elections boards to complete new state security requirements for 2020
December 6, 2019
https://www.cleveland.com/open/2019...new-state-security-requirements-for-2020.html

While Ohio’s 88 county boards of elections are at various stages of completing a mandatory pre-election security check-list, Ohio Secretary of State Frank LaRose said Friday that he’s confident Ohio will have a secure 2020 election.

Counties are required, among other things, to install a device that can automatically detect hacking attempts, and to conduct criminal background checks on elections workers who hold sensitive jobs. LaRose’s office, which oversees state elections, set a Jan. 31 deadline to get everything done.
LaRose’s office emphasized that 52 of Ohio’s 88 counties are at least half done completing the security check-list. But that means 36 aren’t.

LaRose told reporters afterward that his office has the ability to enforce compliance with the security requirements, including dismissing elections board members in extreme cases. His office couldn’t immediately provide details on which counties were most behind.
Click to expand...

guest · Dec 6, 2019

Research: Email remains a weak link in U.S. election infrastructure
December 5, 2019
https://www.valimail.com/email-in-election-infrastructure/

As we head into the 2020 election season in the United States, a key component of the U.S. election infrastructure remains vulnerable to attack. Only 5% of the country’s largest counties are protecting their election officials from impersonation, according to an analysis by Valimail. The rest are vulnerable to impersonation, meaning their domains could become the unwitting vectors for cyberattacks and misinformation campaigns.

An August 2019 report from Valimail noted that most presidential candidates’ campaigns are not protected from email impersonation. And our earlier report found a similar situation across the thousands of domains used by state and local governments. This new report takes a closer look at those domains specifically used by the largest counties for election matters.
Read the report below, or download the PDF version of our election security report.
Click to expand...

Why this matters
The lack of DMARC enforcement at the state and local levels is of course not the only vulnerability in U.S. election infrastructure. However, it is a very serious one.
It does not require a stretch to imagine attackers impersonating election officials via spoofed domains in order to spread disinformation, conduct voter misdirection or vote-suppression campaigns, or even to inject malware into government networks.
Click to expand...

guest · Dec 8, 2019

France finds evidence of Russian hackers interfering in Macron’s campaign
December 8, 2019
https://112.international/politics/...rs-interfering-in-macrons-campaign-46329.html

In France, Google IT experts found evidence of the intervention of two groups of Russian hackers in the election campaign of Emmanuel Macron. It is reported by Le Monde.

According to the newspaper, the attack of Russian cyber pirates at Macron’s headquarters was carried out in 2017, a few months before the start of the elections in France, while the accident became known in May of that year. As a result of the attackers' actions, the content of the two letters became public immediately before the second round of the presidential election. In total, 9 gigabytes of various documents from Macron's headquarters mail spreaded on the Internet.

A group of hackers associated with Russian intelligence. We are talking about the groups APT28 (also known as Fancy Bear) and Sandworm.
Sandworm focused on the party members of the future French president. The goal of the hackers was to destabilize the presidential election.
Click to expand...

guest · Dec 9, 2019

RNC, DNC bank on Duo authentication ahead 2020 election
December 9, 2019
https://www.cyberscoop.com/rnc-cybersecurity-2fa-social-media-speaphishing/

The Republican National Committee is relying on authentication tools and careful social media behavior in order to avoid a devastating data breach like the kind that derailed its democratic counterparts in 2016.
Even if a user’s password credentials are stolen, an extra layer of authentication can ensure that only the legitimate account holder could access his or her communications.

Since March of this year, the RNC has paid just over $1,000 per month to Duo, according to FEC filings. The RNC started using Duo in 2016, just days before the election. And it’s not just email account access the RNC is trying to protect — the RNC uses multiple layers of authentication to protect other user accounts, both personal and professional, too, according to Mike Gilding, the deputy director of information technology at the RNC.

The DNC and other political entities such as the National Republican Congressional Committee also are using Duo to protect their infrastructure, FEC records show.

“If you have not started using 2FA you are severely, severely vulnerable,” Gilding said while speaking on a panel last week hosted by the International Republican Institute in Washington, D.C.
Republicans are using Duo in conjunction with other security tools, Gilding added, as part of an effort to avoid a single point of failure.
Click to expand...

guest · Dec 9, 2019

Cybercriminals Lend Tactics and Skills to Political Meddlers
December 9, 2019
https://www.bleepingcomputer.com/ne...end-tactics-and-skills-to-political-meddlers/

Disinformation campaigns for political purposes are deeply rooted in cybercriminal endeavors, with threat actors relying on actions specific to financially-motivated attacks to attain their goals.

An investigation from Advanced Intelligence (AdvIntel) and Nime Mile Security Group (NMSG) researchers shows that cybercriminals can successfully adapt their methods for "intrusive social actions into the U.S. environments."
Cybercriminals tactics
What soon became clear to the researchers was that the contractors applied their cybercriminal knowledge to politically motivated campaigns.

Applied to an abstract scenario the researchers proposed to the cybercriminals they interacted with, the cost of a political influencing operation can be less than $100,000, excluding the intrusion and physical actions, which would greatly add to the complexity of the campaign.
Click to expand...

AdvIntel: DarkWeb Politics. Cybercrime & Meddling Threat Landscape

guest · Dec 16, 2019

Firm Analyzes China, Russia-based Supply Chain Risks of Electronic Voting Machines
December 16, 2019
https://www.securityweek.com/firm-a...supply-chain-risks-electronic-voting-machines

To date, almost all known examples of supply chain abuse have been software-based, with hackers abusing the software supply chain to gain access to larger or more prized targets.
Hardware-based supply chain attacks have been more sparse -- but are potentially more harmful to the organizations that might use compromised hardware components

Interos has now investigated the depth of the hardware supply chain, looking specifically at one brand of electronic voting machine. Although the 2020 elections are top-of-mind for many security experts, the findings are probably indicative of many different hardware systems sold by U.S. and other western vendors.
One of the three main voting systems was selected, but not named in the Interos report, obtained by SecurityWeek. The firm analyzed three levels of the supply chain: Tier 1 being the suppliers of components to the vendor, Tier 2 being suppliers to the Tier 1 supplier, and Tier 3 being suppliers to Tier 2.

On the Interos study, founder and CEO Jennifer Bisceglie, summarized, "Our study shows links previously not understood between America's voting infrastructure and countries with a proven aptitude and desire to target elections and the democratic process. [...]"
Click to expand...

Interos: Interos study of Widely-Used Voting Machine finds 1 in 5 components from China-based companies

guest · Dec 24, 2019

As Georgia rolls out new voting machines for 2020, worries about election security persist
December 23, 2019
https://www.stamfordadvocate.com/ne...olls-out-new-voting-machines-for-14928470.php

Richard DeMillo, a professor of computing at the Georgia Institute of Technology, said he was worried as he visited polling places in a county north of Atlanta.

Georgia is preparing to roll out 30,000 of the machines in every polling place for its presidential primary in March, replacing a paperless electronic voting system that a federal judge declared insecure and unreliable.
But election security experts said the state's newest voting machines also remain vulnerable to potential intrusions or malfunctions - and some view the paper records they produce as insufficient if a verified audit of the vote is needed.

"They seem to be structurally unable to confront the fact that the voting system in Georgia is at risk," DeMillo, a vocal critic of the Georgia's approach to election security, said of state officials.
Click to expand...

hawki · Dec 25, 2019

"U.S. CyberCom contemplates information warfare to counter Russian interference in the 2020 election

Military cyber officials are developing information warfare tactics that could be deployed against senior Russian officials and oligarchs if Moscow tries to interfere in the 2020 U.S. elections through hacking election systems or sowing widespread discord, according to current and former U.S. officials...

The idea would be to show that the target’s sensitive, personal data could be hit if the interference did not stop, though officials declined to be more specific..."

https://www.washingtonpost.com/nati...bb246e-20e8-11ea-bed5-880264cc91a9_story.html

guest · Dec 27, 2019

Connecticut Receives $5 Million for Election Cybersecurity
December 27, 2019
https://www.securitymagazine.com/ar...receives-5-million-for-election-cybersecurity

Connecticut Secretary of the State Denise Merrill says the state will receive about $5 million in federal funds to help protect the 2020 elections from cyberattacks.

According to a news report, Merrill says the money is Connecticut’s share of a $425 million federal fund approved by Congress to enhance the integrity of electoral systems all across the country. Merrill says it will be used for cybersecurity for Connecticut’s unique election system of 169 independent towns and give voters the confidence that their ballots are secure.

“Without that faith in elections, we will really have a problem in 2020. Because I don’t need to tell you people are already suspicious of everything. And so we want to make sure that we can do everything we can to make sure this is the smoothest election we’ve ever had,” Merrill say
Click to expand...

guest · Dec 27, 2019

Spotify to pause political advertising in early 2020
Twitter also banned political ads in October
December 27, 2019
https://www.cbc.ca/news/technology/spotify-pause-political-advertising-early-2020-1.5409352

Spotify said on Friday it would pause selling political advertisements on its music streaming platform in early 2020.
The move, which was first reported by Ad Age, comes as campaigns for the U.S. presidential election in November 2020 heat up.

Online platforms including Facebook and Alphabet Inc.'s Google are under growing pressure to police misinformation on their platforms and stop carrying political ads that contain false or misleading claims.

"At this point in time, we do not yet have the necessary level of robustness in our processes, systems and tools to responsibly validate and review this content," a Spotify spokesperson said in a statement.
"We will reassess this decision as we continue to evolve our capabilities."
Click to expand...

guest · Dec 30, 2019

mood said: ↑

Feds to test North Carolina election computers for hacking
June 5, 2019
https://abcnews.go.com/Technology/w...-carolina-election-computers-hacking-63516380
Click to expand...

Feds: No evidence hackers disrupted North Carolina voting
December 30, 2019
https://www.dailymail.co.uk/wires/a...-hackers-disrupted-North-Carolina-voting.html

A federal investigation didn´t turn up any evidence that cyber attacks were responsible for computer errors that disrupted voting in a North Carolina county in 2016, according to a report issued Monday.

The U.S. Department of Homeland Security´s report said it didn´t identify any malware or remote access to the Durham County Board of Elections systems that it analyzed.
Federal investigators "did not conclusively identify any threat actor activity," but they did identify aspects of county cyber security that could be improved, according to the report.

The analysis of Durham County laptops was the first known federal investigation of equipment that malfunctioned during the 2016 election, when Russian hackers infiltrated several states.
Click to expand...

guest · Jan 1, 2020

Last Pennsylvania county picks new voting system in time for 2020
December 31, 2019
https://statescoop.com/pennsylvania-county-picks-new-voting-system-paper-ballots/

The last holdout of Pennsylvania’s 67 counties finally selected new voting machines that produce physical trails of individual ballots, completing the process of phasing out the commonwealth’s mostly paper-free election technology in time for the 2020 presidential election.
The new system, manufactured by the Clear Ballot Group, will replace the county’s current inventory of all-digital machines, which do not produce any verifiable, physical record of how votes were cast.

The Clear Ballot Group system chosen by Dauphin County is one of seven platforms the state approved over the course of this and last year, with counties having until Tuesday to pick one.
And though the purchase price has not been disclosed, according to the Harrisburg Patriot-News [...]
Click to expand...

guest · Jan 4, 2020

Election contractor drawing a second look
January 4, 2020
http://www.personcountylife.com/stories/election-contractor-drawing-a-second-look,25239

A voting software company the N.C. State Board of Elections certified earlier this year wants approval for a last-minute technology update. But some board members are asking whether the company, Election Systems and Security, should have been certified in the first place.
ES&S defends its technology, citing a post-election audit in Warren County, New Jersey, where all ballots in the sample matched the original recorded votes with “100% accuracy.”

“Counties have been asking us for certainty on voting systems for over two years, through several iterations of this board, and we owe them that certainty,” he said.
Click to expand...

guest · Jan 8, 2020

The Cybersecurity 202: Voting machines touted as secure option are actually vulnerable to hacking, study finds
January 8, 2020
https://www.washingtonpost.com/news...hacking-study-finds/5e14cc6e602ff125ce5bd747/

The study marks the first major independent review of the machines called ballot-marking devices, or BMDs, which at least 18 percent of the country's districts will use as their default voting machines in November. The results are a major blow for voting machine companies and election officials, who have touted BMDs as a secure option in the wake of Russia’s 2016 efforts to compromise U.S. election infrastructure.

“The implication of our study is that it’s extremely unsafe [to use BMDs], especially in close elections,” Alex Halderman, a University of Michigan computer science professor and one of seven authors of the study, said in an interview.
People who use BMDs cast their votes using a computer touch screen, but the machine spits out a paper record of those votes. That is usually used to tally the results and can be saved for audits that ensure votes were tallied correctly.

But only a handful of people who vote on BMDs are likely to check that their votes were recorded accurately, the researchers found [...]
“There's been a lot of discussion in the election security community about whether BMD verification works as a defense against hacking, but nobody really had any hard numbers,” Halderman told me. “Now, for the first time, we have an experimental data point and, unfortunately, the results confirm some of our worst fears.”
Click to expand...

Study: "Can Voters Detect Malicious Manipulation of Ballot Marking Devices?"
(PDF - 2.35 MB): https://jhalderm.com/pub/papers/bmd-verifiability-sp20.pdf

guest · Jan 10, 2020

Voting Machine Firm CEOs Open to Greater Federal Oversight
Congress Wants Security Vulnerabilities Addressed to Thwart Foreign Interference
January 10, 2020
https://www.databreachtoday.com/voting-machine-firm-ceos-open-to-greater-federal-oversight-a-13599

The CEOs of the three largest voting machine manufacturers testified before a U.S. Congressional committee on Thursday that they would be open to greater federal oversight of their equipment to help ensure the security of voting data in upcoming elections, including the 2020 presidential contest.

The hearing apparently was the first time these CEOs testified about their companies' practices and issues ranging from cybersecurity to the use of foreign-made components in their devices.
The three companies - Election Systems and Software, Dominion Voting Systems and Hart InterCivic - have close to 350,000 voting machines deployed across the U.S. and represent more the 80 percent of the country's voting machines, according to NBC News.
Asking for Oversight
The House Administration Committee hearing focused on the current state of voting machine security as well as concerns about the companies' transparency.
Click to expand...

guest · Jan 10, 2020

Russian hackers are still going to be a huge problem for 2020 elections
January 10, 2020
https://mashable.com/article/russian-hackers-2020-elections/

Don’t call it a comeback. Russian hackers have been preparing for the 2020 elections for years —and the U.S. still isn’t ready.

Intelligence officials are warning that foreign interference in the form of disinformation and hacking campaigns are still going to be a major factor in the coming elections. While U.S. companies and government agencies may be smarter after 2016, so are the Russian hackers and trolls.
According to The New York Times, which interviewed experts and officials preparing for foreign interference in 2020, these trolls and hackers have been developing more advanced methods to interfere with U.S. elections.

Even if Russian hackers and trolls don’t successfully pull the aforementioned hacks or disinformation campaigns off, in essence they’ve already won.
Their primary goal is to create chaos. Is this story real? Are the election results valid? Foreign agents are looking to plant uncertainty and doubt in the minds of American voters.
Click to expand...

Minimalist · Jan 12, 2020

Security vulnerabilities in voting machines show America still isn’t ready for the 2020 election

Though researchers discovered a fundamental security flaw in voting machines months ago, the company behind the machines may still be advertising them to states in a way that allows the vulnerability to persist, according to a letter sent to the US Election Assistance Commission and reported by NBC News.
Click to expand...

https://qz.com/1783766/these-voting-machine-security-flaws-threaten-election-2020/

guest · Jan 15, 2020

Cloudflare is giving away its security tools to US political campaigns
January 15, 2020
https://techcrunch.com/2020/01/15/cloudflare-campaigns-security-protections/

Network security giant Cloudflare said it will provide its free security tools and services to U.S. political campaigns, as part of its efforts to secure upcoming elections against cyberattacks and election interference.
The company said its new Cloudflare for Campaigns offering will include distributed denial-of-service attack mitigation, load balancing for campaign websites, a website firewall, and anti-bot protections.

Now the company is offering its security services to 11 of the 17 presidential campaigns, it said, but wants to ensure that its offering is “available to the largest campaigns are also available to smaller campaigns as well.”
The company said it’s working with the non-partisan, non-profit organization Defending Digital Campaigns to provide its services to campaigns.
Click to expand...

Cloudflare: Introducing Cloudflare for Campaigns

guest · Jan 15, 2020

Secretary of State Kim Wyman proposes more safeguards against hackers and ballot tampering
Januaty 15, 2020
https://www.seattletimes.com/seattl...eguards-against-hackers-and-ballot-tampering/

Washington Secretary of State Kim Wyman is proposing new safeguards against ballot tampering and foreign manipulation of elections, as the state’s election administrators brace for attacks.

Wyman is seeking $1.8 million in state money for security in county election offices that would make Washington eligible for another $8.6 million in matching federal funds, according to Wyman’s office. The legislation would also provide stricter penalties and restrictions surrounding the collection of ballots, and provide more thorough postelection audits for race recounts.
In addition, the proposal would eliminate online ballots for military and overseas voters, to reduce the risk of potential malware coming into elections offices.

Wyman said she knows that part of her proposal might not be popular with county elections officials, because it could make their job harder.
Click to expand...

hawki · Jan 17, 2020

"State of Georgia’s Election Systems Feared at Risk in 2020 Vote

(Bloomberg) -- The state of Georgia’s new voting system may be at risk of a cyber-attack leading up to the 2020 election because the state failed to eradicate malware that exposed sensitive data six years ago, a cybersecurity expert said as part of a lawsuit against the state.

A server central to Georgia’s election system was infiltrated and taken over by a hacker in 2014... The server was wiped and taken offline in 2017, but the contract between Georgia and its new vendor, Dominion Voting Systems, indicates old data was “imported” into the new system.

That old data could carry remnants of the “Shellshock” malware used to attack the state in 2014,... Shellshock allowed unauthorized users to access sensitive layers of a network..."

https://www.bnnbloomberg.ca/state-o...systems-feared-at-risk-in-2020-vote-1.1375389

Log in or Sign up

Securing Elections

guest Guest

Krusty Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

hawki Registered Member

Log in or Sign up

Securing Elections

guest Guest

Krusty Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

hawki Registered Member

Useful Searches