Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
United States Politics

The Nation's Best Hackers Found Vulnerabilities in Voting Machines - But No Time To Fix Them (politico.com) 189

Posted by msmash from the worrying-signs dept.
Hackers at the DEF CON conference in Las Vegas identified vulnerabilities in voting machines slated for use in the 2024 U.S. election, but fixes are unlikely to be implemented before November 5, organizers said. The annual "Voting Village" event, held away from the main conference floor due to security concerns, drew election officials and cybersecurity experts. Organizers plan to release a detailed report on the vulnerabilities found.

Catherine Terranova, an event organizer, said major systemic changes are difficult to make 90 days before an election, particularly given heightened scrutiny of election security in 2024. The process of addressing vulnerabilities involves manufacturer approval, recertification by authorities, and updating individual devices. This typically takes longer than the time remaining before the election, according to Scott Algeier, executive director of the Information Technology-Information Sharing and Analysis Center. The event comes amid ongoing concerns about foreign targeting of U.S. elections, including a recent hack of former President Donald Trump's campaign, reportedly by Iran.
This discussion has been archived. No new comments can be posted.

The Nation's Best Hackers Found Vulnerabilities in Voting Machines - But No Time To Fix Them More

The Nation's Best Hackers Found Vulnerabilities in Voting Machines - But No Time To Fix Them

Comments Filter:

  • As a programmer... (Score:5, Insightful)

    by CEC-P ( 10248912 ) on Tuesday August 13, 2024 @12:27PM (#64702688)
    +1 to variable, write to log with a timestamp, SHOULDN'T NEED A DAMN INTERNET CONNECTION AND HAVE SECURITY WEAKNESSES! Voting machines have been trash for decades. Literally since they were invented. No other 1st world country on Earth allows machines of this style either. Why just us? You wonder why it looks so suspicious.

    • Re:As a programmer... (Score:5, Insightful)

      by AlanObject ( 3603453 ) on Tuesday August 13, 2024 @12:37PM (#64702718)

      Connecting a voting machine to the Internet is just nuts. And there is no need for it.

      • Re: (Score:3, Insightful)

        by saloomy ( 2817221 )
        Said no politician, ever. Sorry, but there is a reason and a justification for connecting them, and that is by design by the people who would control the decision to connect them or not, and that person is not you or the members of the public interested in a fair and transparent election.

    • Event sourcing this seems so easy. My assumption is that it was not built by a bunch of interns and I hope the vulnerabilities are elsewhere.

    • PLC (Score:5, Interesting)

      by JBMcB ( 73720 ) on Tuesday August 13, 2024 @01:36PM (#64702932)

      You drive it via ladder logic and a PLC. The tree for a complex election shouldn't be more than a couple dozen lines. Have the PLC code checksummed and displayed on the front of the machine - it should be the same for every machine in the precinct and everyone can check.

      You have a count on the back of the machine hidden by a hatch that disables the machine once opened. Backup to a paper tape.

      For the uninitiated, a PLC only runs a series of programmed I/O sequences. It doesn't run arbitrary code.

    • Re:As a programmer... (Score:4, Insightful)

      by AmiMoJo ( 196126 ) on Tuesday August 13, 2024 @02:14PM (#64703042) Homepage Journal

      Can you imagine if a bank connected their equipment to the internet? Everyone's account would be drained in minutes!

      Germany uses these kinds of machine too, and last time I checked Germany is a 1st world country. They legally require some kind of verifiable backup, typically a printed receipt of your vote that can be checked and if necessary manually counted.

      I'd be more worried about people trying to get voters removed from electoral registers and voter suppression. Those things are demonstrably happening right now.

    • At most companies, quality gets in the way of profit. If you want a quality voting machine you have to pay extra, in a market where officials are elected based upon the promise of cutting costs.

    • +1 to variable, write to log with a timestamp, SHOULDN'T NEED A DAMN INTERNET CONNECTION AND HAVE SECURITY WEAKNESSES!

      Is there some reason you think they are connected to the Internet?

      The point of this type of article is to drum up interest by prompting people to make such assumptions. Then they compound that by ignoring the larger security context, such as what would happen if a particular machine that was inappropriately left connected to the internet registered a bunch of votes.

    • Re: (Score:2)

      by Ichijo ( 607641 )

      Ok but how do you get a timestamp without an Internet connection?

    • Security doesn't sell voting machines. Features sell voting machines (and security as a feature can be provided by a flashy pamphlet and a glowing icon).

  • Simple system (Score:5, Insightful)

    by Baron_Yam ( 643147 ) on Tuesday August 13, 2024 @12:36PM (#64702716)

    Paper ballots and hard pencils. With the right paper, difficult to damage with water and graphite doesn't run.

    Vote. Scan for fast tabulation, lock up the ballot as your backup. Protect the ballot boxes. Anything statistically unlikely triggers a manual count.

    Allow a representative of anyone on the ballot to act as an observer. And maybe throw in a neutral 3rd party.

    It's not complicated, and it's extremely difficult to exploit. But an Internet-connected 'voting machine'? That's just asking for widespread automated fraud.

    • No paper ballots = You want to cheat (Score:5, Insightful)

      by Seven Spirals ( 4924941 ) on Tuesday August 13, 2024 @12:41PM (#64702750)
      If anyone wants electronic-only voting with no physical ballots the odds are they want to cheat. The convenience argument just isn't strong enough. Of course, if they do use easily falsifiable e-voting systems be prepared for a barrage of "THERE WAS NO PROOF!" hysteria from the media. Yeah, of course there wasn't, that was the whole point of using e-voting, dummies.

      • You bring very strong and valid points.

        Now tell me which corrupt cheating party fights the most against your points.

    • Re: (Score:2)

      by Pascoea ( 968200 )
      This is how Minnesota does it. It floors me that it's done any other way. Obviously there's ways to exploit such a thing, but it has got to be the most secure method, and you still get "instant" results. If there isn't a piece of paper stored somewhere that is either the ballot as handed over by the user or a printed representation that's verified by the voter before stored, you don't have a secure process. Pure electronic voting is insanity.

    • After all the bruhaha about 2020 election, I'm surprised any county is still approving and using digital voting machines. Neither conservatives nor progressives have a fondness for them. Conservatives used to see them as a way to cut election costs, but the 2020 paranoia and accusations has wiped most that view out.

    • Paper ballots and hard pencils. With the right paper, difficult to damage with water and graphite doesn't run.

      First off, a guy named Chad has been Hanging around since the 2000 election to argue for the right paper. Haven’t figured it out yet.

      But more to the corrupt point..the simpler a solution appears, the more voting taxpayers should understand the ones in Control right now don’t want to fix this.

      Now, or ever.

      • Re: (Score:3)

        by flink ( 18449 )

        The hanging chad issue was caused by using a punch voting system that incompletely removed the paper, compounded with the fact that it used a system to align candidates with holes that confused some users.

        An optical scan ballot has none of these issues.

    • Re:Simple system (Score:4, Informative)

      by celest ( 100606 ) <mekki@@@mekki...ca> on Tuesday August 13, 2024 @03:19PM (#64703282) Homepage

      You just described the Elections Canada system, verbatim. There's a reason Elections Canada representatives are asked to be neutral observers at other countries' elections.

    • Vote. Scan for fast tabulation

      Even better have the vote counted by humans in a room where representatives of all the candidates are allowed to walk around to inspect that the process is being done honestly and flag anything they see that does not look right to the returning officer.

      Vote counting is something that needs to be both done right and seen to be done right even if that takes longer, although the UK uses a monitored human vote counting system and gets all of its votes counted far, far faster than I've ever seen in the US.

    • Exactly this. Nothing else should be trusted.

    • paper and pencil can get "hacked" as well.

      of course, the "monkey with elections" stuff always brings to mind this one ... https://jpfo.org/filegen-a-m/a... [jpfo.org]

    • "I'm 'Landslide Lyndon' Johnson, and I approve this message
    • San Mateo county has an electronic ballot, with a hard copy printed out (and stored) during the process. If there are any questions about the electronic results, the paper ballots can be counted by hand.
    • Paper ballots are easily replaced or removed. Far more vulnerable then a well secured digital system. Even with vulnerabilities if the access and network is properly secured they are not particularly risky.

  • Secure machine-aided voting isn't hard (Score:5, Interesting)

    by davidwr ( 791652 ) on Tuesday August 13, 2024 @12:41PM (#64702752) Homepage Journal

    Election day:

    Step 1: Human-readable, clearly-marked paper ballot that can be hand-counted is the official record in the case of a dispute or recount. With machine-aided voting that prints out a clear, marked ballot, this is a solved problem.

    Step 2: Venezuela-style end-of-day tally-sheets from each local vote-counting machine are made available confidentially to all contestants as soon as each polling site closes. Exceptions only when doing so would reveal who voted for whom (very-low-turnout voting stations).

    Step 3: The same tallies are made available to the press with not-all-polls-closed-yet races subject to a press embargo.

    After election day:

    Step 4: Statistical audits on each vote-counting machine to find evidence of gross counting errors. Most would be done using an automated method that is independent of the vote-counting machine under test (i.e. different vendor). To short-circuit any conspiracy theorists, a few randomly-selected ones would be done by hand under the watchful eye of the press.

    Step 5: Full hand-counted audits of a few randomly-selected machines under the watchful eye of the press. The main purpose of this is to deter wholesale cheating: The more cheating you do, the more likely it is that it will be detected. It also serves a side-purpose of detecting counting errors that don't show up in step 4. It should also satisfy the conspiracy theorists.

    Step 1 makes vote-count-cheating recoverable. This step is non-negotiable.

    Steps 2-3 get results to the public as soon as possible. Cheating is harder if you are pressed for time.

    Steps 4 and 5 deter cheating, find problems with machine-counting, and, hopefully, placate the conspiracy theorists.

    With these steps, even if your vote-marking, vote-counting, and vote-tally-aggregating machines are compromised, the compromise will be much easier to detect and, once detected, votes can be re-counted by hand if necessary.

    Problems outside the scope of this solution: Denial-of-service attacks against polling stations, preventing voters from getting to the polls at all (voter intimidation, blocking traffic, etc.), fraudulent in-person voting (voting for your identical twin using his ID, etc.), bribing voters to vote a certain way, absentee/mail-in/drop-off-ballot fraud, and basically anything else that isn't a voting-site-issue.

    • "Venezuela-style"?
      • Comment removed based on user account deletion

      • Re: (Score:3)

        by davidwr ( 791652 )

        "Venezuela-style"?

        I was referring to the recent Presidential election in Venezuela where the opposition party was able to use the per-machine vote-tally sheets to prove they won the election, despite the official outcome being different.

        Perhaps I should have used different words to evoke the memory of that election instead of calling it "Venezuela-style".

      • "Venezuela-style"?

        It's a special mode where you can vote for whom you want but the same party always wins.

    • Re: Secure machine-aided voting isn't hard (Score:5, Insightful)

      by wgoodman ( 1109297 ) on Tuesday August 13, 2024 @12:56PM (#64702816)

      "It should also satisfy the conspiracy theorists."

      Prepare to be disappointed

    • With these steps, even if your vote-marking, vote-counting, and vote-tally-aggregating machines are compromised, the compromise will be much easier to detect and, once detected, votes can be re-counted by hand if necessary.

      Why not just skip the unnecessary previous steps and just do counting by hand all the time? As you note all your steps make it harder to compromise vote machines but not impossible and when it comes to something as important as an election you need a process that is not only secure but that is seen to be secure. It is much, much harder to fool a room full of humans - both those doing the counting and representatives of the candidates checking that they are doing it correctly - than it is to fool a computer

  • Paper (Score:5, Interesting)

    by bill_mcgonigle ( 4333 ) * on Tuesday August 13, 2024 @12:43PM (#64702762) Homepage Journal

    There's no cognizable benefit to voting machines.

    European nations with 60M voters regularly use paper and have their results the same day. These systems scale just fine. Each state is that size or smaller.

    Voting machines are much more expensive, more complex, black-boxed, difficult to secure, error-prone, difficult to audit, and we know they're really poorly built and maintained. Plus officials constantly lie about connectivity, password management, access controls, and the like.

    It's not even like changing the candidate list a week before an election is a feature we'd even want.

    The only thing they seem good at is allowing for the possibility of cheating (which has a rich history going back to mechanical voting machines).

    The only remaining conclusion is that we have them to enable cheating.

    It was great when the Democrats railed against voting machines (1950s-2019).

    Only paper ballots stand a chance of creating a free and fair election at this time.

    • Comment removed based on user account deletion

    • >>The only remaining conclusion is that we have them to enable cheating.

      That's not the only reason. They are also more expensive than paper which is a way for state governments to funnel taxpayer money to their well-connected friends.

    • Re:Paper (Score:5, Informative)

      by 93 Escort Wagon ( 326346 ) on Tuesday August 13, 2024 @01:29PM (#64702922)

      The vast majority of votes in the US are cast on paper ballots [reuters.com].

      * 70% cast their votes with hand-marked paper ballots
      * 23% of voters vote with machines that physically mark a paper ballot
      * Fully electronic voting machines only cover 7% of the electorate

      Additionally, the vast majority of fully electronic voting machines are used in Republican-dominated areas (there's a map in the linked article above). I don't personally think they did it with cheating in mind... I suspect they thought it would save money somehow.

      In any case, it shouldn't be difficult to move that 7% back to paper ballots.

      • You seem to forget who INSISTED on electronic voting machines.

        Look up the phrase 'hanging chads'.

    • Re: (Score:2)

      by AmiMoJo ( 196126 )

      There are some benefits. On complex ballots the machine can ensure that the voter completed it correctly. That's particularly important where you have representative systems that aren't just first-past-the-post, or where multiple elections are being combined.

      Arguably that tangible benefit, which is measurable by the number of incorrect ballots being cast, outweighs fears of hacking which have yet to result in a single known case of fraud.

      Also, if you absolutely insist on people having ID, then you probably

    • There's no cognizable benefit to voting machines.

      Remember Florida in the 2000 US Presidential election, and the hanging chads?

      One of the benefits of op-scan machines is that voters know if their ballot is filled-out unambiguously.

      Hang around a polling place, and you'll find that voters routinely double vote single races, leave ambiguous marks, and try to vote blank ballots (yes, really). Op scan machines catch all of these situations, and return the ballot to allow the voter to fix their mistakes. Without the machines, the paper ballots would remain unins

      • Having a machine that *checks* that a ballot is valid: yes.

        Having a machine that *counts* the ballots and tabulates the results itself: no.

  • First time I voted I got to use one of the old electro-mechanical voting machine booths. Big chunky jobbers built in the 1960s. Heavy toggle switches. You yanked down on one and a big green circle filled in next to whom you voted for. You could flip the toggle back up to un-set your choice. Once done, you pulled a big slot machine looking lever, and your votes were printed out on a paper strip that you could see through a window. Pulled another lever and the strip would scroll down so the next person couldn

  • I hear he's an expert on this stuff.

  • Four fucking years to fix. (Score:4, Interesting)

    by geekmux ( 1040042 ) on Tuesday August 13, 2024 @02:16PM (#64703044)

    Catherine Terranova, an event organizer, said major systemic changes are difficult to make 90 days before an election, particularly given heightened scrutiny of election security in 2024.

    I’m sorry, but wasn’t Democracy itself on the ballot before, according to the fearmongering party?

    You haven’t had 90 days to fix this. You’ve had four fucking years to fix this. You don’t want to. Stop bullshitting voters already, morons. Damn.

    • Depends entirely on the vulnerability and when it was discovered. There are new problems in the Linux kernel reported regularly. All releases, including the most recent development versions have vulnerabilities. Old ones do get patched. Sometimes this shows a new flaw. That's just a Linux example, but is true of other O/Ss as well. It will always be true. The application running, if with no shared libraries or DLLs at all, could be proven secure in 4 years. If it relies on shared libraries or DLLs or and O/

      • Depends entirely on the vulnerability and when it was discovered.

        You really believe that? If so, take a good hard look at just how long DEFCON/Black Hat has been reporting on voting machine vulnerabilities and insecurities. Then tell me how long it took for those to get patched. Compare and contrast that effort to any other patching/corrective effort. You might just see the level of give-a-shit here.

        Securing a single-purpose voting machine, is no longer rocket science. Not even close. Tends to beg the question as to why we can’t do it. As another poster poin

    • Re:Four fucking years to fix. (Score:5, Insightful)

      by Voyager529 ( 1363959 ) <voyager529.yahoo@com> on Tuesday August 13, 2024 @02:49PM (#64703158)

      Catherine Terranova, an event organizer, said major systemic changes are difficult to make 90 days before an election, particularly given heightened scrutiny of election security in 2024.

      I’m sorry, but wasn’t Democracy itself on the ballot before, according to the fearmongering party?

      You haven’t had 90 days to fix this. You’ve had four fucking years to fix this. You don’t want to. Stop bullshitting voters already, morons. Damn.

      Exactly this. Just make voting machines subject to the same regulations as slot machines [riskcompliance.biz], and the problem would go away.

      How it's easier to hack a voting machine than a gambling machine is beyond me.

  • Trump wasn't "really" hacked (Score:3, Insightful)

    by Flaming Cowpie ( 830542 ) * <spamcatcher.madcowstudios@com> on Tuesday August 13, 2024 @02:29PM (#64703098) Homepage
    It was a spearphishing attack aimed at some chud that didn't know better. And their IT folks should be tarred and feathered considering the amount of crap they must get. Why wasn't the mail system hardened better to catch this chaff?

  • LMAO even.

  • Comment removed based on user account deletion

  • Surely that fixes everything! (cough) https://xkcd.com/463/ [xkcd.com] (cough)

  • Lots of Simple Questions with Answers (Score:5, Informative)

    by eepok ( 545733 ) on Tuesday August 13, 2024 @05:06PM (#64703554) Homepage

    Lots of people are asking questions in these discussion threads with the intent of them being rhetorical, but most have really simple and truthful answers. I'll start responding to them in this post and thread. Also, I'm not suggesting that the responses are sufficient justifications, I'm only answering the question and generally form an operational standpoint.

    Example:
    Q: The bathtub overflowed. Why did you leave the bath water running while not in the bathroom.
    R: I got distracted by a TV show.
    Q: That's a horrible justification!
    R: It's not intended to be a justification, but it IS what happened.

    Q: What about vulnerabilities in voters? That would seem to be the bigger issue.
    R: Stupidity is an unwritten right. People are allowed to be idiots and still vote. And even if they're genuinely intelligent, but brainwashed, they're still allowed to vote.

    Q: Why bother with electronic voting machines at all?
    R: Because it's much harder today (and getting harder still) to convince people to volunteer their time to do election work. From working the polls themselves to auditing pen/pencil marks, discerning intent from "hanging chads", and hand-counting ballots in close races, it's genuine work. And assholes make the work HARDER by spreading conspiracy theories both about the work and the people doing the work. A working digital solution would be easier to run an election with fewer volunteers required.

    Q: Why bother with internet-connected voting machines at all?
    R: See the response above and then add in the possibility to both run an audit an have instant results remotely.

    Q: How many cases of election fraud in the US have traced back to a compromise of electronic voting machines?
    R: To the best of my brief research, there hasn't been a significant breach of an electronic voting machine system in an American election. Almost all voting fraud in the last 20 years is the result of illegal voting on behalf of another person which doesn't require access to an electronic voting machine.

  • ... fixes are unlikely to be implemented ...

    The US government had 4 years to find and fix this.

    Now, every loser can claim the election was stolen: Elected, I win, not elected, you lose. Which is accurate, regardless, because US voters consistently refuse to vote for a minority party.

Slashdot Top Deals

Were there fewer fools, knaves would starve. - Anonymous

Close