Securing Elections

Minimalist · Apr 21, 2018

Elections serve two purposes. The first, and obvious, purpose is to accurately choose the winner. But the second is equally important: to convince the loser. To the extent that an election system is not transparently and auditably accurate, it fails in that second purpose. Our election systems are failing, and we need to fix them.

Today, we conduct our elections on computers. Our registration lists are in computer databases. We vote on computerized voting machines. And our tabulation and reporting is done on computers. We do this for a lot of good reasons, but a side effect is that elections now have all the insecurities inherent in computers. The only way to reliably protect elections from both malice and accident is to use something that is not hackable or unreliable at scale; the best way to do that is to back up as much of the system as possible with paper.
Click to expand...

https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html

mood · May 31, 2018

N.Y. State, DHS to practice to protect election process
May 31, 2018
https://www.scmagazine.com/ny-state-dhs-to-practice-to-protect-election-process/article/769936/

New York State, in conjunction with the federal government, plans to hold drills during the weeks preceding the primary elections to help prevent any cyber intrusion into the electoral process.

The regional tabletop exercises will cover all of New York's county election jurisdictions and while basically, similar each will take into consideration local needs. The scenarios covered include manipulation of the election process through social media, dealing with a ransomware attack and the possible exploitation of board of election computer networks.

“These exercises in partnership with state and federal agencies will provide the needed training to identify and address potential incidents of cybersecurity when it comes to our electoral process,” said Lieutenant Governor Kathy Hochul in a statement.
Click to expand...

mood · Aug 1, 2018

Microsoft AccountGuard Service Offers Protection for Political and Election Orgs
August 1, 2018
https://www.bleepingcomputer.com/ne...s-protection-for-political-and-election-orgs/

Microsoft has launched a pilot program aimed at providing cybersecurity protection for political campaigns and election authorities.

The pilot program —named AccountGuard— was launched at the end of July, Bleeping Computer has learned, and was set in motion for the 2018 US midterm elections.
Only political and election entities can sign up for protection
Microsoft is now running a website where participants in the 2018 US midterm elections can sign up for this increased protection.

With AccountGuard added to their account, Microsoft is providing custom notifications, but also "reactive remediation support through standard channel" and "prescriptive best-practice security guidance" to proactively prevent incidents.
Part of Microsoft's Defending Democracy Program
AccountGuard is a project of the Microsoft Defending Democracy Program, an initiative that Microsoft launched in mid-April to safeguard electoral processes.
Click to expand...

mood · Aug 10, 2018

US officials hope hackers at Defcon find more voting machine problems
August 10, 2018
https://www.cnet.com/news/us-officials-hope-hackers-at-defcon-find-more-voting-machine-problems/

Hackers at the Defcon cybersecurity conference in Las Vegas on Friday took on voting machines again, after showing how easy it was to break into election machines at last year's gathering. This time around, officials from the US Department of Homeland Security were on hand to learn directly from hackers who find problems with election security.

"It concerns us that many states still don't have concrete plans to upgrade their voting systems, and 14 states are struggling to replace outdated voting machines that lack paper trails before the next presidential election," Pence said.

Despite the voting machine vulnerabilities being exposed in Defcon, it's not clear whether the exercise will be able to help with the midterm elections in November. Braun said Defcon's report on the voting machines will publish in September, giving election officials two months to fix all the reported security issues.
Click to expand...

Krusty · Aug 11, 2018

In November, Americans will go to the polls to vote in the crucial mid-term elections. But as intelligence chiefs in the country continue to warn of Russian interference, there is great concern about how vulnerable the US voting infrastructure could be to cyber-attack.

At the Def Con hacking conference in Las Vegas, our North America technology reporter Dave Lee met some children who were competing to hack replicas of the websites that will be used to show official voting results in November.
Click to expand...

Video:

https://www.bbc.co.uk/news/av/technology-45154497/hacking-the-us-mid-terms-it-s-child-s-play

ronjor · Aug 12, 2018

Kids are amazing.

Minimalist · Aug 13, 2018

Voting Hacks Prompt Push Back from Election Officials, Vendors

LAS VEGAS – DEF CON 26, building on its work in hacking ballot machines last year, saw three days of probing into various aspects of the end-to-end voting infrastructure in place in the U.S., including a voter registration database and election reporting websites. Several vulnerabilities and exploits came to the fore – prompting push-back from a voting machine vendor and secretaries of state, just as the U.S. prepares for the midterm elections.
Click to expand...

https://threatpost.com/def-con-2018-voting-hacks-prompt-push-back-from-election-officials-vendors/

mood · Aug 14, 2018

Election systems should be considered critical infrastructure
August 13, 2018
https://www.helpnetsecurity.com/2018/08/13/election-systems-critical-infrastructure/

93 percent of security professionals are concerned about cyber-attacks targeting election infrastructure and data, and 81 percent believe cyber criminals will target election data as it is transmitted by machines, software and hardware applications, from local polling stations to central aggregation points, a recent study by Venafi has revealed.

“Security professionals clearly think that machine-to-machine communication in the electoral process is a high value asset for attackers targeting election results,” said Kevin Bocek, vice president of security strategy and threat intelligence for Venafi.

“This is just one reason why governments around the world need to make the security of all encrypted, machine-to-machine communication their top concern.”
Click to expand...

mood · Aug 15, 2018

McAfee offers state election officials a year of free cloud security tools
August 15, 2018
https://www.cyberscoop.com/mcafee-election-security-cloud-tools/?category_news=technology

McAfee is offering free security services to election offices in all 50 states, the company announced on Wednesday, in order to protect voter data stored in the cloud.

The product, McAfee Skyhigh Security Cloud, provides monitoring and threat detection tools for cloud software-as-a-service products (such as Microsoft Office 365, Box, Amazon Web Services and others), which are widely used by enterprises including state election offices.

“We believe the McAfee Cloud for Secure Elections Program will fill a foundational security requirement for cloud by protecting against intrusion from those who aim to tamper with the United States elections,” said Ken Kartsen, McAfee’s vice president of public sector sales, in a press release.
Click to expand...

mood · Aug 16, 2018

36 states are using this hacking detection sensor to protect the midterm elections
Albert sensors can detect hacking attempts and alert the government agencies quickly.
August 16, 2018
https://www.cnet.com/news/36-states...tion-sensor-to-protect-the-midterm-elections/

The US is beefing up voter system security in preparation for the 2018 elections.

Most US states have employed Albert sensors, a technology that could detect hacking attempts and send alerts to federal and state government agencies, Reuters reported.

Jeanette Manfra, a top cybersecurity official at the Department of Homeland Security, [...]
"Pretty much anything is going to have some vulnerability that somebody is going to try to exploit," Manfra said during the interview.
Click to expand...

xxJackxx · Aug 17, 2018

Here's a thought. Go back to paper ballots and we don't have to worry about other countries messing with the results. Or any domestic fraud. With computers.

Trooper · Aug 17, 2018

xxJackxx said: ↑

Here's a thought. Go back to paper ballots and we don't have to worry about other countries messing with the results. Or any domestic fraud. With computers.
Click to expand...

Agreed. This whole thing is complete nonsense.

mood · Aug 21, 2018

New bill would require paper ballots to secure election results
The bill, submitted by nine senators on Tuesday, would also mandate election audits.
August 21, 2018
https://www.cnet.com/news/new-bill-would-require-paper-ballots-to-secure-election-results/

The Russians can't hack paper.

On Tuesday, nine Senators introduced a bill that would require state and local governments to use paper ballots in an effort to secure elections from hackers. The bill would also require rigorous audits for all federal elections to ensure that results match the votes.

Using paper ballots will also save money, even when the costs of manpower to tally the votes is included, Wyden's office said. "We believe paper ballots would be significantly less expensive than purchasing new insecure voting machines," Wyden's office said in an email.
Click to expand...

mood · Aug 22, 2018

DNC calls FBI after appearing to thwart hack of its voter database
August 22, 2018
https://edition.cnn.com/2018/08/22/politics/democratic-national-committee-voter-database/index.html

The Democratic National Committee contacted the FBI on Tuesday after it detected what it believes was the beginning of a sophisticated attempt to hack into its voter database, a Democratic source tells CNN.

The DNC was alerted in the early hours of Tuesday morning by a cloud service provider and a security research firm that a fake login page had been created in an attempt to gather usernames and passwords that would allow access to the party's database, the source said.

"It was very convincing," Murray said, adding that if a person were to see the real login page and the fake login page side-by-side, it would be difficult to tell them apart. "It would have been a very effective attack," he said.
Click to expand...

Rico · Aug 23, 2018

Perhaps silly question, today's paper revealed yet another HACK, by Russia, on the DNC.

The DNC's servers/database are obviously connected to the internet, there in lies the vulnerability! So why not, or it's possible, to "Encrypt" the server. Then it becomes just a matter of sure, you do not give the key to the wrong people.

mood · Aug 23, 2018

Recent DNC Hacking Attempt Was Just a Simulated Phishing Test
August 23, 2018
https://www.bleepingcomputer.com/ne...g-attempt-was-just-a-simulated-phishing-test/

A recent hacking attempt against the Democratic National Committee (DNC) proved to be a false alarm, according to a clarifying statement released by the DNC chief security officer Bob Lord.
Phishing site mimicked VoteBuilder.com login
Lookout told reporters, and later in a blog post, about discovering a phishing page hosted on the infrastructure of DigitalOcean, a US-based hosting provider.
Phishing site was only an unauthorized test
But as investigators looked into the matter, the attempted hack proved to be a test, according to a statement issued by DNC CSO Bob Lord.

"We have continued to investigate the phishing site reported to the DNC yesterday. We along with partners who reported the site, now believe it was built by a third party as part of a simulated phishing test on VoteBuilder," Lord said.
Click to expand...

Rico · Aug 23, 2018

So why is encryption not the answer?

mood · Aug 24, 2018

White House pans Election Security Act
August 24, 2018
https://www.scmagazine.com/white-house-pans-election-security-act/article/790978/

As concerns mount about the security and integrity of the upcoming midterm elections, White House Wednesday blocked the Secure Elections Act, just as the Senate Rules Committee was slated to begin marking it up.

The Department of Homeland Security (DHS) “has all the statutory authority it needs to assist state and local officials to improve the security of existing election infrastructure,” Yahoo News cited White House spokesperson Lindsay Walters as saying.

“The issue of election cybersecurity is very important and more must be done now,” Lankford said in a statement after the White House nixed the bill, adding that “Congressional inaction is unacceptable.”
Click to expand...

Rico · Aug 24, 2018

From: https://techcrunch.com/2016/10/12/what-it-takes-to-secure-the-elections/
"Things like encryption keys, two-factor authentication, and even using a mobile device may be a bridge too far for the elderly or the unskilled.”

Many election machines running XP, perhaps they should be updated, or a linux distro

What I don't understand here, is how the voter would be involved in anyway with encryption. John Q public votes & is vote is encrypted by the machine. Voting by smart device, how's about a voting 'app' that encrypts. To get this futuristic 'app', could require, two party verification, before download.

mood · Aug 25, 2018

Los Angeles County's new 'open source' vote tallying system isn't open source just yet
August 23, 2018
https://statescoop.com/los-angeles-...ote-tallying-system-isnt-open-source-just-yet

The system runs on technology owned by the county, rather than a private vendor, and in what officials say is a first for California, it's an open source platform.

"With security on the minds of elections officials and the public, open source technology has the potential to further modernize election administration, security, and transparency, [...], said in a press release.
Conditional praise from election security experts
Open source software, which allows outside programmers to download code and tinker with it for the purpose of offering improvements or adapting it to their own use, actually has support in the often skittish community of election-security advocates.

For a system to be truly open source, though, the code has to be accessible to other developers [...] The LA County system isn't publicly available

"This is the first time ever a state has certified just a couple parts of a complete voting system. We can't have our elections be publicly trusted if they're run by black-box computers. You can't say 'Trust this machine. [...]"
Click to expand...

Press release (PDF): https://lavote.net/docs/rrcc/news-releases/08212018_SOS-Certified-Tally.pdf

mood · Aug 25, 2018

No, a Teen Did Not Hack a State Election
Hacking conference organizers said kids had hacked “exact clones” of state election reporting websites, but that didn’t happen.
August 24, 2018
https://www.propublica.org/article/defcon-teen-did-not-hack-a-state-election

Headlines from Def Con, a hacking conference held this month in Las Vegas, might have left some thinking that infiltrating state election websites and affecting the 2018 midterm results would be child’s play.
Articles reported that teenage hackers at the event were able to “crash the upcoming midterm elections” and that it had taken “an 11-year-old hacker just 10 minutes to change election results.”

But now, elections experts are raising concerns that misunderstandings about the event — many of them stoked by its organizers — have left people with a distorted sense of its implications.

“When I learned that they were not using exact copies and pains hadn’t been taken to more properly replicate the underlying infrastructure, I was definitely saddened,” Franklin said.

“It would be lunacy to directly connect the election management system, of which the tabulation system is a part of, to the internet,” Franklin said.
Click to expand...

Minimalist · Aug 26, 2018

What we’re reading: 4 ways the U.S. can secure the 2020 election

It’s already too late to upgrade election system security for the 2018 midterms, but there are four things the U.S. can do to prepare for 2020, former Facebook chief information security officer Alex Stamos writes in Lawfare.
Click to expand...

https://www.axios.com/4-ways-the-us...ion-fdc3312a-12c1-424c-ace6-ef470c982d6e.html

mood · Aug 28, 2018

Voting machine maker claims vote machine hack-fests a 'green light' for foreign hackers
NSA code smacker says no, hackers perform a service
August 28, 2018
https://www.theregister.co.uk/2018/08/28/voting_machine_hacking/

Voting machine maker ES&S says it did not cooperate with the Voting Village at hacking conference DEF CON because it worried the event posed a national security risk.

This is according to a letter the biz sent to four US senators in response to inquiries about why the manufacturer was dismissive of the show's village and its warnings of wobbly security in some systems that officials use to record, tally, and report votes.

Security researchers, however, aren’t buying it. Among those to blast the manufacturer's response was Voting Village cofounder and Princeton University Professor Matt Blaze, who issued a scathing rebuttal. [...]

Rob Joyce, the former head of the NSA's elite Tailored Access [...]

Ignorance of insecurity does not get you security. We need to examine voting machines, SCADA systems, IOT and other important items in our lives. The investigation of these devices by the hacker community is a service, not a threat.
Click to expand...

Minimalist · Aug 29, 2018

Free Cybersecurity Services Offer a First Step to Securing US Elections

It's too late to truly secure US election infrastructure for the 2018 fall midterms: that would require a massive security overhaul nationwide. But a number of election jurisdictions around the country have signed up for free website and user-account protection services being offered this election season by a handful of security companies, including big-name vendors like Google and Microsoft.
Click to expand...

https://www.darkreading.com/applica...step-to-securing-us-elections-/d/d-id/1332687

mood · Aug 31, 2018

Justice Department Warns It Might Not Be Able to Prosecute Voting Machine Hackers
August 30, 2018
https://motherboard.vice.com/en_us/...t-be-able-to-prosecute-voting-machine-hackers

Per a Justice Department report issued in July from the Attorney General's Cyber Digital Task Force, electronic voting machines may not qualify as "protected computers" under the Computer Fraud and Abuse Act [...]
The report says the law generally only prohibits against hacking computers "that are connected to the Internet (or that meet other narrow criteria for protection)" and notes that voting machines generally do not meet this criteria "as they are typically kept off the Internet."

If the government asserts that the current CFAA only applies to non-networked computers, [...] the government opens the door for defendants to argue that any case involving a computer that is not connected to the internet and is not a voting machine can’t be prosecuted under the CFAA

"[...] I think this is a dangerous precedent [...] it creates the presumption that any non-internet connected, nonfederal owned computer is not protected under the CFAA... unless specifically mentioned.”
“By creating certainty for voting machines, the government creates uncertainty about computers that are not voting machines.”
Click to expand...

Justice Department report (PDF): https://www.justice.gov/ag/page/file/1076696/download

Log in or Sign up

Securing Elections

Minimalist Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

Krusty Registered Member

ronjor Global Moderator

Minimalist Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

xxJackxx Registered Member

Trooper Registered Member

mood Updates Team

mood Updates Team

Rico Registered Member

mood Updates Team

Rico Registered Member

mood Updates Team

Rico Registered Member

mood Updates Team

mood Updates Team

Minimalist Registered Member

mood Updates Team

Minimalist Registered Member

mood Updates Team

Duo Security Digs Into Chrome Extension Security With CRXcavator

Kaspersky Security Bulletin 2018. Top security stories

The end of security as we know it

Microsoft Security Guidance: Security Baseline Thread

The best secure browsers 2018

Log in or Sign up

Securing Elections

Minimalist Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

Krusty Registered Member

ronjor Global Moderator

Minimalist Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

xxJackxx Registered Member

Trooper Registered Member

mood Updates Team

mood Updates Team

Rico Registered Member

mood Updates Team

Rico Registered Member

mood Updates Team

Rico Registered Member

mood Updates Team

mood Updates Team

Minimalist Registered Member

mood Updates Team

Minimalist Registered Member

mood Updates Team

Duo Security Digs Into Chrome Extension Security With CRXcavator

Kaspersky Security Bulletin 2018. Top security stories

The end of security as we know it

Microsoft Security Guidance: Security Baseline Thread

The best secure browsers 2018

Useful Searches