And the boy?
5
Halderman Report on Georgi… by Jim Hoft
Professor Halderman wrote about his findings in a blog post after the report’s release.
Back in September 2020, the Court granted the Curling Plaintiffs access to one of Georgia’s touchscreen ballot marking devices (BMDs) so that they could assess its security. Drew and I extensively tested the machine, and we discovered vulnerabilities in nearly every part of the system that is exposed to potential attackers. The most critical problem we found is an arbitrary-code-execution vulnerability that can be exploited to spread malware from a county’s central election management system (EMS) to every BMD in the jurisdiction. This makes it possible to attack the BMDs at scale, over a wide area, without needing physical access to any of them.
Our report explains how attackers could exploit the flaws we found to change votes or potentially even affect election outcomes in Georgia, including how they could defeat the technical and procedural protections the state has in place. While we are not aware of any evidence that the vulnerabilities have been exploited to change votes in past elections, without more precautions and mitigations, there is a serious risk that they will be exploited in the future.
Professor Halderman also tweeted out that Georgia Secretary of State Brad Raffensperger will not install Dominion’s security patches before the 2024 election.
“The known breaches in Georgia would be sufficient to uncover and exploit every vulnerability we found—and likely others we missed. Yet MITRE’s risk assessment assumes that Georgia perfectly protects the equipment from illicit access across all of its 159 counties.
“Astonishingly, Georgia Secretary of State Brad Raffensperger, who has been aware of our findings for two years,
Raffensperger:just announced that the state will not get around to installing Dominion’s security patches until after the 2024 Presidential election.”