Hacker demonstrates how voting machines can be compromised

Good memory you have about the party of stupid (GOP), now known as the GOPe / Uniparty.
The GOP had been constrained from officially contesting and investigating suspected voter fraud since a 1987 Consent decree agreement.

Now however, I think there’s little doubt that the Republican establishment would disagree with Democrat victories, in light of the large amount of GOPe hacks who have officially throw their support to Hillary Clinton.

http://mobile.wnd.com/2012/11/gop-legally-barred-from-fighting-vote-fraud/

WND EXCLUSIVE
GOP legally barred from fighting vote fraud
30 years later, consent decree violation claims still threaten
Published: 11/20/2012 at 8:01 PM
Bob Unruh

If the people running the system are corrupt any voting method can be compromised from paper ballots to electronic machines.

Honest elections depend on honest voting officials.

Thanks for the info and link. Maybe my memory isn’t failing after all :)

Crux point, detective!
“Only a virtuous people are capable of freedom. As nations become more corrupt and vicious, they have more need of masters.”
Benjamin Franklin

“Laws without morals are in vain.”
Benjamin Franklin (Motto of the University of Pennsylvania)

RE: “If the people running the system are corrupt any voting method can be compromised from paper ballots to electronic machines.

-> Honest elections depend on honest voting officials.

An Incredibly Insecure Voting Machine - Schneier on Security

https://www.schneier.com/blog/archives/2015/04/an_incredibly_i.html

An Incredibly Insecure Voting Machine

Wow:

The weak passwords — which are hard-coded and can’t be changed — were only one item on a long list of critical defects uncovered by the review. The Wi-Fi network the machines use is encrypted with wired equivalent privacy, an algorithm so weak that it takes as little as 10 minutes for attackers to break a network’s encryption key. The shortcomings of WEP have been so well-known that it was banished in 2004 by the IEEE, the world’s largest association of technical professionals. What’s more, the WINVote runs a version of Windows XP Embedded that hasn’t received a security patch since 2004, making it vulnerable to scores of known exploits that completely hijack the underlying machine. Making matters worse, the machine uses no firewall and exposes several important Internet ports.

It’s the AVS WinVote touchscreen Direct Recording Electronic (DRE). The Virginia Information Technology Agency (VITA) investigated the machine, and found that you could hack this machine from across the street with a smart phone:

So how would someone use these vulnerabilities to change an election?

        Take your laptop to a polling place, and sit outside in the parking lot.
        Use a free sniffer to capture the traffic, and use that to figure out the WEP password (which VITA did for us).
        Connect to the voting machine over WiFi.
        If asked for a password, the administrator password is “admin” (VITA provided that).
        Download the Microsoft Access database using Windows Explorer.
        Use a free tool to extract the hardwired key (”shoup”), which VITA also did for us.
        Use Microsoft Access to add, delete, or change any of the votes in the database.
        Upload the modified copy of the Microsoft Access database back to the voting machine.
        Wait for the election results to be published.

Note that none of the above steps, with the possible exception of figuring out the WEP password, require any technical expertise. In fact, they’re pretty much things that the average office worker does on a daily basis.

More.

Tags: cell phones, firewall, passwords, patching, security engineering, voting, vulnerabilities, Wi-Fi

Posted on April 23, 2015 at 7:19 AM • 70 Comments

    not connected to Facebook
    Facebook “Like”-Dummy
    not connected to Twitter
    “Tweet this”-Dummy
    not connected to Google+
    “Google+1”-Dummy
    Settings

Comments

Dimitris Andrakakis • April 23, 2015 8:04 AM

- WEP
- WinXP
- Password: admin
- DB: MS Access
- No firewall

AAAAAAAARRRGGHHHHHHHHHHHHHHHHHHHHHHH

Andrew • April 23, 2015 8:04 AM

Wow! This brings back memories!

Back in uni someone had cooked up a similar scheme for sharing MS Access dbs for the Department’s administration. Took some time and effort to get everyone involved to agree that it’s a really terrible idea.

That said, my experience is about half a dozen years old. To still use this approach, let alone in a voting machine... I really don’t think there’s any excuse for such idiocy.

QnJ1Y2U • April 23, 2015 8:04 AM

Turns out the (unchangeable) wi-fi password is abcde.
Cue the luggage jokes ...

charlie • April 23, 2015 8:17 AM

I’m sure you can do that to change what a voting machine does.

You’ve got 4-5 voting machines at a precinct, so I’d so one person could do that at a precinct.

(And some voting locations might have 2 precinct combined. Easier)

I’m not taking away from the flaws here. Not even sure why they have wifi.

But this isn’t how you steal elections.

The lines out the door in June (because of replaced machines) will be a far larger effect on vote suppression.

Anura • April 23, 2015 8:19 AM

This is why we need serious certification and auditing standards for these machines. I’d argue they should all be open source hardware and software, not necessarily because open source is more secure, but because it allows us to provide a modicum of trust and discourages stupidity occurring because programmers assume that secrets in compiled code cannot be extracted.

Xavier • April 23, 2015 8:21 AM

Wifi connected voting machine running windows XP, with votes in a Microsoft Access database, with accessible usb ports.

How could it end wrong ?

Hasn't he voted like 4-5 times already???

BTTT

The “hacking” of DNC emails was in no wise a “hack.” It was a gift.