Securing Elections

Minimalist · Apr 8, 2020

Experts: Internet voting isn’t ready for COVID-19 crisis

Internet technologies are set to play a critical role in the 2020 presidential election, but precisely which voting alternatives will be pursued – and whether they can adequately be secured – is now a $400 million question.
Click to expand...

https://www.cyberscoop.com/coronavirus-internet-voting-2020-election-risky-business/

Minimalist · Apr 10, 2020

Vote by Mail Isn't Perfect. But It's Essential in a Pandemic

Election security has become a more prominent (and urgent) topic in the United States over the past few years, but as the Covid-19 pandemic rages, a different type of crisis is also presenting itself: how to carry out voting in a way that maintains both social distancing and electoral integrity. With less than seven months before November 3, too many states still don't have a full-fledged contingency plan—and haven't yet embraced the expansion of absentee voting by mail.
Click to expand...

https://www.wired.com/story/vote-by-mail-absentee-coronvirus-covid-19-pandemic/

guest · Apr 11, 2020

Working with Government to Help Secure Our Elections
April 9, 2020
https://www.securitymagazine.com/bl...-with-government-to-help-secure-our-elections

Whether it’s local, state or national races, election security has become a serious issue. And it’s easy to understand why.
There is a real threat to take away your voice and ability to participate in a democracy.

But it is important that steps be taken to ensure that never happens. At the state level in particular, there must be a more serious approach to securing the applications that run these elections. In any modern election system, there are two main applications: the actual app you use to vote and the app for the voter database/registration. Both are equally important to safe, free elections. But most government agencies don’t have the tools to fully ensure their security.

A bigger issue is that states simply lack the technology and cybersecurity expertise. Even in the private sector, the skills gap is a well-publicized problem. Keeping and finding talent is one of the bigger challenges facing our industry.
Click to expand...

guest · Apr 13, 2020

Why you can’t trust your vote to the internet
April 13, 2020
https://www.cyberscoop.com/online-voting-election-security-voatz-app-risky-business/

The team at Trail of Bits — a boutique software security firm based in New York — was commissioned by Tusk in late 2019 to conduct a thorough ‘white box’ security test of mobile voting app Voatz, an app used in five states. The testers would have full access to all the source code and documentation they required to discover security gaps and recommend fixes.

In total, Trail of Bits published 79 vulnerabilities in the app, a third of them high-severity. While some of the more avoidable misconfigurations found in the code became a source of mockery, the folly of any one bug was missing the point, according to Evan Sultanik, the lead tester on the project.

“I’m less concerned about finding hard-coded encryption keys copied from Stack Overflow in the code base,” he told Risky Business. “I’m more worried that those keys were still in the code base since the last time it was used in 2018. [...]”
“All the commercial electronic voting vendors will face the same time and resource constraints,” Guido said. “Software security and cryptography expertise is rare and expensive. I wish I had more of them.”
Click to expand...

Hursti credits California and Ohio for setting a tougher testing criteria, but adds that testing spends a disproportionate amount of effort on safeguarding against a voter being electrocuted at the polling place compared to securing the data they submit.
“Even with the bar as low as you could set it, there is no meaningful security testing,” he said. “It doesn’t exist.”
Click to expand...

Minimalist · May 12, 2020

Online Voting Has Worked So Far. That Doesn’t Mean It's Safe

Proponents of mobile and internet voting point to its uneventful track record. That's not good enough.
Click to expand...

https://www.wired.com/story/online-voting-worked-so-far-doesnt-mean-safe/

guest · May 25, 2020

U.S. Elections: Effectively Balancing Access and Security
May 24, 2020
https://www.tripwire.com/state-of-security/government/elections-balancing-access-security/

For a Democratic Party desperate to unseat President Trump in November, the primary election process has been filled with large-scale technology failure, official miscalculations, voter annoyance and public embarrassment, not to mention piles of money spent in pursuit of an improved 21st-century process that turned out to be worse than what they had.
They might have been better to just pass out paper ballots and pencils.

It’s no secret that America’s election process has fallen decades behind the capabilities of modern technology. The big issue is how to ensure that hackers don’t emerge from the Dark Web to stick their fingers in the mix in order to prevent votes from being counted quickly and reliably. Let’s take a look at a couple of public failures, Iowa and Los Angeles, to learn what went wrong and how best to create secure voting systems before the 2020 presidential election.
Click to expand...

guest · May 29, 2020

Law Enforcement Files Discredit Brian Kemp’s Accusation That Democrats Tried to Hack the Georgia Election
...newly released documents show that there was no such hack
May 29, 2020
https://www.propublica.org/article/...t-democrats-tried-to-hack-the-george-election

It was a stunning accusation: Two days before the 2018 election for Georgia governor, Republican Brian Kemp used his power as secretary of state to open an investigation into what he called a “failed hacking attempt” of voter registration systems involving the Democratic Party.

But newly released case files from the Georgia Bureau of Investigation reveal that there was no such hacking attempt.
The evidence from the closed investigation indicates that Kemp’s office mistook planned security tests and a warning about potential election security holes for malicious hacking.

It remains unclear how Kemp’s staff concluded that the Democratic Party was responsible for a hacking attempt.
Click to expand...

The internet activity that Kemp’s staff described as hacking attempts was actually scans by the U.S. Department of Homeland Security that the secretary of state’s office had agreed to, according to the GBI. Kemp’s chief information officer signed off on the DHS scans three months beforehand.
Candice Broce, Kemp’s spokeswoman, continued to insist Friday that elections officials responded to a “failed cyber intrusion,” despite the GBI’s findings that scans came from DHS.
Click to expand...

guest · Jun 3, 2020

United States Attorney William M. McSwain Announces his Office’s Efforts to Preserve Integrity of Today’s Primary Elections in Eastern District of Pennsylvania
June 2, 2020
https://www.justice.gov/usao-edpa/p...swain-announces-his-office-s-efforts-preserve

United States Attorney William M. McSwain announced that Assistant United States Attorney Richard P. Barrett has been appointed to serve as the District Election Officer for the Eastern District of Pennsylvania for today’s primary elections as part of the Department of Justice’s nationwide Election Day Program. In that capacity, AUSA Barrett is responsible for overseeing the District’s handling of complaints of election fraud and voting rights abuses in consultation with Justice Department headquarters in Washington.

The Department of Justice has an important role in deterring ballot fraud and discrimination at the polls, and combating these violations whenever and wherever they occur.

“Every citizen must be able to vote without interference or discrimination and to have that vote counted without it being impacted by fraud,” said U.S. Attorney McSwain.
Click to expand...

guest · Jun 8, 2020

Researchers say OmniBallot online voting platform is vulnerable to manipulation
June 8, 2020
https://statescoop.com/researchers-...oting-platform-is-vulnerable-to-manipulation/

An online voting platform that a handful of states are using in limited capacities this year has been found to be vulnerable to hacking that could expose or manipulate how a person’s ballot was cast without being detected by either voters or officials tallying results, according to a paper published Sunday by a pair of influential election-security experts.

According to the paper, by J. Alex Halderman, a computer scientist at the University of Michigan, and Michael Specter, a doctoral student at the Massachusetts Institute of Technology, OmniBallot “is vulnerable to vote manipulation by malware on the voter’s device and by insiders or other attackers” who can compromise systems made by Amazon, Google, Cloudflare or OmniBallot’s publisher, Democracy Live.

“Your safest option is to avoid using OmniBallot,” they write. “Either vote in person or request a mail-in absentee ballot, if you can.”
Click to expand...

guest · Jun 9, 2020

Many of Georgia's new voting machines aren't working on primary day
June 9, 2020
https://www.engadget.com/georgia-primary-voting-machines-164626418.html

It's primary day in five states and while things seem to be going relatively smoothly in Nevada, North Dakota, South Carolina and West Virginia, voters and election workers in Georgia are reporting problems with new voting machines. Workers at some polling places are having difficulty operating the machines, according to the New York Times.

The issues have led to many people facing long waits in lines to cast their votes. But even the provisional ballot system isn’t sufficient, as some locations quickly ran out of them. “If you are in line, PLEASE do not allow your vote to be suppressed,” Atlanta mayor Keisha Lance Bottoms wrote on Twitter.
Click to expand...

guest · Jun 9, 2020

Will Vote-by-App Ever Be Safe?
June 9, 2020
https://www.darkreading.com/endpoint/will-vote-by-app-ever-be-safe/a/d-id/1337999

The push for online voting has been happening for years, but now that a major pandemic has hit the US, there is more incentive than ever for states and counties to try out online and mobile voting services.

This summer, Delaware and West Virginia will allow online voting in their primaries, and New Jersey is also testing it in a municipal election. The Utah GOP recently used mobile voting in a virtual state convention. Other states and counties are likely to follow.
These solutions are far from perfect; to call them "experimental" is putting it nicely. Most of the current providers are new companies with relatively small development teams.

The inherent vulnerability of app-based voting is a serious cause for concern, but governments and political parties are likely to pursue them anyway. So, let's take a closer look at where the problems are.
Click to expand...

guest · Jun 13, 2020

Activists cite tabulation flaw in mail-in ballots in Georgia
June 13, 2020
https://apnews.com/66c2b4b36609d83aa5c08235f947ea59

Faulty software or poorly calibrated vote-tabulation scanners used to count mailed-in ballots in this week’s chaotic Georgia primary may have prevented thousands of votes from being counted, election officials and voting integrity activists say.

The issue was identified in at least four counties, DeKalb, Morgan, Clarke and Cherokee, according to officials who discovered them, including activists who have sued the state for alleged election mismanagement.

“The fact that it is in multiple counties tells me that it’s probably systemic,” said Richard DeMillo, a Georgia Tech computer scientist who has testified for the plaintiffs, because identical scanners and software were used to count all absentee ballots across the state. DeMillo said the only way to know for sure is through audits.
Click to expand...

guest · Jun 16, 2020

Vulnerability in Trump campaign app revealed keys and secrets
June 16, 2020
https://www.scmagazine.com/home/sec...trump-campaign-app-revealed-keys-and-secrets/

A security vulnerability in President Trump’s mobile campaign app exposed Twitter application keys and secrets, Google apps and maps keys and Branch.io keys in the Android APK file, researchers at Website Planet recently discovered.

“While the exposed keys allowed access to many parts of the app, we concluded in our investigation that user accounts remained inaccessible through this vulnerability,” according to a Website Planet blog post. “We did not attempt to access any user accounts on the app, as we felt the initial vulnerability was sufficient to alert the Trump campaign.”
The team alerted the Trump campaign, which released a fix a few days later.
Click to expand...

Minimalist · Jun 17, 2020

Feds, states unveil pilot program meant to secure voter databases and other election systems

Election officials and nonprofit security advocates on Wednesday announced a pilot program for testing and verifying voter registration databases, election night reporting and other systems meant to support voting.
Click to expand...

https://www.cyberscoop.com/election-security-pilot-voter-databases-cis/

guest · Jun 22, 2020

Microsoft Boosts Protections for US AccountGuard Users
June 22, 2020
https://www.securityweek.com/microsoft-boosts-protections-us-accountguard-users

Part of Microsoft’s Defending Democracy Program, AccountGuard was introduced in 2018 to “protect organizations that underpin democracy from cyberattacks.” Initially available to candidates for federal, state and local office in the United States and their campaigns, the service has since arrived in over a dozen other countries as well.

Now, Microsoft is announcing enterprise-grade identity and access management protections for AccountGuard users in the U.S., at no cost.
Additionally, the tech giant announced a partnership with Yubico, so that AccountGuard customers have access to phishing-resistant security keys. Microsoft says it will work with democracy-focused non-profit organizations and think tanks who are AccountGuard members to help them leverage these protections.
Click to expand...

“We know that many political campaigns do not have dedicated IT support staff, and today’s news comes with hands-on help for those that need it. Deployment assistance for the technologies in today’s news will be provided to AccountGuard customers as an included benefit through our FastTrack program or through our FastTrack-ready partners,” Microsoft also notes.
Click to expand...

Microsoft: New tools to secure democracy

In recent months, we’ve worked closely with political campaigns and parties who are protected by our AccountGuard threat notification service and conducted hundreds of security trainings ahead of the 2020 elections.
Greater security in this area would help prevent the “hack-and-leak” scenario where cybercriminals or foreign governments steal a campaign official’s emails and release them online.
Click to expand...

guest · Jun 26, 2020

Hacker attack on Russian election website launched from US, UK, EU, and Ukraine
June 26, 2020
https://tass.com/society/1172087

Deputy Chairman of the Russian Central Election Commission (CEC) Nikolai Bulaev reported that according to preliminary data, a massive hacking attack on the CEC website on Friday was carried out from the territories of the United States, the United Kingdon, Ukraine, and a number of other countries.

"Starting at 12:30 pm the website of the Russian Central Election Commission has been subjected to a massive hacking attack which reaches 240,000 requests per second. A preliminary analysis indicates that the geography of the attackers is distributed by the following countries: the US, the UK and other European countries, Ukraine and some CIS states," the official told TASS on Friday.
Earlier the deputy chairman reported that he received information about the hacking attack on the commission’s website, now the web portal is functioning as usual.
Click to expand...

guest · Jul 3, 2020

Vulnerable Voting Infrastructure and the Future of Election Security
July 2, 2020
https://blog.radware.com/security/2...tructure-and-the-future-of-election-security/

As the United States prepares for the 2020 presidential election, there is concern regarding the vulnerability of the country’s voting infrastructure and the potential for international interference to sabotage election security.

According to a February 2020 NY Times article, history may repeat itself in the upcoming 2020 election if lawmakers don’t take extra precautions. Nation-state interference is a grave concern among governments as well as technology and social media companies. In reality, it does not take an entire nation to rig an election: Andrés Sepúlveda rigged elections throughout Latin America for almost a decade from an apartment in Bogota.

Leading up to the United States 2018 midterm elections, Radware surveyed Facebook users on the safety of U.S. elections and the results reveal a pessimistic situation. The overwhelming majority (93.4 percent) of respondents believe that the United States election system is vulnerable to targeting and hacking.
Click to expand...

guest · Jul 4, 2020

mood said: ↑

After 2016 Hack, Illinois Says Election System Secure
October 17, 2018
https://www.securityweek.com/after-2016-hack-illinois-says-election-system-secure
Click to expand...

How the Russians penetrated Illinois election computers
July 4, 2020
https://abc7chicago.com/politics/how-the-russians-penetrated-illinois-election-computers/3778816/

The twelve Russians charged with hacking into Illinois' election database may have worked as intelligence agents, but the I-Team has learned it didn't take above-average computer intelligence to pull off the heist.

The electronic intrusion, which occurred in July of 2016 at the Illinois State Board of Election, was via a hacking technique called "SQL injection." The names, addresses, dates of birth, driver's license numbers and partial Social Security numbers of about 500,000 Illinois voters are believed to have been stolen, according to federal indictments handed up last week against a dozen Russian operatives and information from state election officials.

"The Russians hacked into the computer networks of election officials and vendors in order to steal voter data and other information" said Sen. Dick Durbin , D-Illinois on Tuesday.
Click to expand...

Minimalist · Jul 19, 2020

Research on Voting by Mail Says It's Safe – from Fraud and Disease

As millions of Americans prepare to vote in November – and in many cases, primaries and state and local elections through the summer as well – lots of people are talking about voting by mail. It is a way to protect the integrity of the country’s voting system and to limit potential exposure to the coronavirus, which continues to spread widely in the U.S.
Click to expand...

https://www.nextgov.com/ideas/2020/07/research-voting-mail-says-its-safe-fraud-and-disease/166990/

guest · Jul 20, 2020

Who hacked the website of North Macedonia’s state election commission on election day?
July 19, 2020
https://www.intellinews.com/who-hac...e-election-commission-on-election-day-187756/

The website of North Macedonia’s State Election Commission (SEC), or to be more exact the site's election section, was targeted by hackers immediately after polls closed in the snap general election on July 15, leaving the question of who stands behind the attack?

The SEC was hacked immediately after voting ended at 9pm on Wednesday. The election section then recovered for few minutes but the results disappeared again, preventing journalists and other interested people from monitoring the election results, which were announced with a huge delay a day after the election.
At the same time as the SEC site was brought down, the local news aggregator Time.mk was also hacked, but it recovered more quickly.

“We are under DDoS attack,” owner of Time.mk, Igor Trajkovski, said in a tweet at the time of the cyber attack. It was reported that Time.mk was attacked with more than 20mn IP addresses on July 15.
Click to expand...

Most countries take measures to protect their electoral infrastructure in order to provide the maximum security on election day, which was not the case here in North Macedonia.
The cyber attack on the SEC website, which targeted the election platform, raised many questions about the way institutions in North Macedonia protect the election process.
Click to expand...

guest · Jul 22, 2020

Election officials praised for sharing information, knocked for sharing passwords
July 21, 2020
https://statescoop.com/election-officials-information-sharing-nass/

State and local election officials have done a “tremendous” job reporting information about potential cyberthreats during the 2020 cycle, a senior Department of Homeland Security official said Tuesday.

But some, particularly at the city and county level, are also still in the unfortunate habit of not changing default passwords on new equipment or even sharing credentials, Matt Masterson, a senior adviser at DHS’s Cybersecurity and Infrastructure Security Agency, told the National Association of Secretaries of State online conference.

“CISA has observed instances where several people in election-related offices having been sharing passwords over e-mail or default passwords are being used,” read one of the slides Masterson shared.
Click to expand...

guest · Jul 26, 2020

Report finds many US election officials vulnerable to phishing attacks
Attacks on voting machines may not be the main concern
July 26, 2020
https://www.engadget.com/election-officials-vulnerable-to-phishing-204455850.html

The security risks around the 2020 presidential election aren’t limited to direct attacks on the voting systems. Research firm Area 1 Security has published a report (via Wall Street Journal) warning that many election officials are using email systems that leave them vulnerable to phishing attacks and hacks.

Out of more than 10,000 state and local officials, about 53 percent only had “rudimentary or non-standard” defenses against phishing. Only 18.6 percent had “advanced” safeguards in place, and 5.4 percent were using personal email addresses.
This wouldn’t necessarily let intruders compromise the voting process. The Cyber Threat Alliance’s J. Michael Daniel told the WSJ that it would be “really hard to do” digital vote manipulation at a meaningful level.
Click to expand...

However, ransomware and other phishing-based campaigns could make it difficult for election administrators to do their job, and might cast doubt on the results even if the voting infrastructure is safe.
Click to expand...

guest · Aug 2, 2020

Ransomware feared as possible saboteur for November election
August 2, 2020
https://apnews.com/b39a09fc9a1334e9ef78bd46a40db253?&web_view=true

Federal authorities say one of the gravest threats to the November election is a well-timed ransomware attack that could paralyze voting operations. The threat isn’t just from foreign governments, but any fortune-seeking criminal.
Even if a ransomware attack fails to disrupt elections, it could nonetheless rattle confidence in the vote.

On the spectrum of threats from the fantastical to the more probable, experts and officials say ransomware is a particularly realistic possibility because the attacks are already so pervasive and lucrative. The FBI and Department of Homeland Security have issued advisories to local governments, including recommendations for preventing attacks.

“From the standpoint of confidence in the system, I think it is much easier to disrupt a network and prevent it from operating than it is to change votes,” Adam Hickey, a Justice Department deputy assistant attorney general, said in an interview.
Click to expand...

guest · Aug 3, 2020

Foreign Threats Loom Ahead of US Presidential Election
August 3, 2020
https://www.securityweek.com/foreign-threats-loom-ahead-us-presidential-election

Intelligence officials confirmed in recent days that foreign actors are actively seeking to compromise the private communications of “U.S. political campaigns, candidates and other political targets” while working to compromise the nation’s election infrastructure. Foreign entities are also aggressively spreading disinformation intended to sow voter confusion heading into the fall.

There is no evidence that America’s enemies have yet succeeded in penetrating campaigns or state election systems, but Democrat Joe Biden’s presidential campaign confirmed this week that it has faced multiple related threats.
Click to expand...

ronjor · Aug 5, 2020

US offers $10 million reward for hackers meddling in US elections

By Catalin Cimpanu for Zero Day | August 5, 2020
This includes attacks against US election officials, election infrastructure, voting machines, but also candidates and their staff.
Click to expand...

Log in or Sign up

Securing Elections

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Log in or Sign up

Securing Elections

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Useful Searches