Part 2: Full Scope of Dominion Voting Machine Hack in Federal Court is FAR Worse than Just the BIC Pen Hack – Audit Logs Can Be Edited

Gateway Pundit ^ | Brian Lupo

[PittsburghAfterDark]

Tell me like I’m a small child, or a golden retriever, how none of this came out in Dominion’s lawsuit against Newscorp?

[Red Badger]

It wasn’t meant to. Newscorp has been suborned..................

[z3n]

I can’t remember, but didn’t fox settle that case, or was it an actual award by the court. If they settled than they probably didn’t fight it.

[Political Junkie Too]

Fox News settled rather than let the evidence of voting machine tampering be introduced in a credible court.

If this news got out, it would have changed everything the LAAP-dog media said about the motivations for January 6th just as the indictments against President Trump were coming down.

-PJ

[JohnnyP]

Is that the same suit against Fox? They seemed happy to roll over and pay $750M or something like that?

[Liz]

There was more revealed in the courtroom WRT
vulnerabilities of electronic voting. To summarize:

<><>Dr. Halderman used a simple BIC ball-point pen to reboot a Dominion ICX BMD by simply inserting it into the power button on the back of the machine and hold it down for five seconds.

<><>This rebooted the machine into Safe Mode and allowed Super User access, (voter fraud unlimited) granting the attacker almost unlimited abilities to manipulate voting data on the machine.

<><>Professor Halderman was also able to use a Smart card purchased for $10 online and a $20 USB Smart card Reader from Amazon to program voter cards that could be used over and over again, county-wide.

<><>He also made a poll-worker card and, most importantly, a technician card that would also grant “Super User access.”

<><>commands to manipulate the Dominion ICX BMD could be automated – simply insert the card and it will do the rest. Further, nothing was needed that wasn’t public information to complete the programming.

<><>These cards would require some expertise to program, but once the counterfeit cards are made, anyone could insert it into the machine and exploit the vulnerability automatically.

[taxcontrol]

I am of the opinion that:

1) FEC should sponsor the development of an open source, public code only, suite of election software. (voting roll, ballot tracking, ballot tabulation, reporting, etc)

2) That the code should undergo a regular challenge where vulnerabilities are exposed and penetration of the system is tested on a bi-annual frequency.

3) There be a law passed that requires the use of the open source voting system.

[Political Junkie Too]

Last November, I posted outsourcing election tallying to the credit card companies.

---

Here is a high-tech solution.

Let a company like Visa or MasterCard manage the elections.

The process would go like this:

1. Citizen registers to vote.
2. County processes the voter registration.
3. Credit card company sends a voter card to the citizen. The voter's PIN is sent in a separate mailing within 90 days of the next election. This card is a permanent voter registration until such time as the voter leaves the jurisdiction or dies.
4. For each election:
   • For in-person voting:
     1. The voter checks in and swipes their voter card into the reader. They enter their PIN.
     2. If the PIN is accepted, the voter signs the precinct log book and receives a local voting sheet, computer code, or whatever device is used to vote. The PIN is marked as used.
     3. The voter proceeds to vote.
   • For absentee/mail-in voting:
     1. The voter completes the absentee/mail-in ballot and signs the ballot. The voter also writes their voter card number and PIN on the ballot.
     2. The voter seals the ballot in a return envelope and signs the envelope.
     3. The voter mails in the ballot or drops it in a ballot box.
     4. The ballot is received by the county and entered into the tabulation system. The PIN is marked as used.
5. The voter receives a confirmation notice that their ballot was processed. This could be either via text message, automated phone call, or direct mail based on the voter's designation when registering.
6. The credit card company tabulates the ballots immediately, using the same technology that processes billions of credit card transactions each day.
7. Election results are published within two hours after the polls close in a state. The credit card company nullifies all the PIN numbers.
8. Ninety days prior to the next election, the credit card company resets all the PINs to new numbers and mails the new PINs to voter for use in the next election.

This should make it very difficult harvest ballots, since PIN numbers can't be made up or reused. The voter will know if their absentee/mail-in ballot was processed or not based on whether the PIN was used or not.

The technology exists to do this now.

---

-PJ

[Liz]

p

[Lockbox]

Gee, amazing all those defects were found, almost as if there were planned 🤔🤔🤔

[ProtectOurFreedom]

Holy CRAP! This should be HUGE!

• Buy a $100 "BASH Bunny"
• Add some not-very-sophisticated malicious code
• Unplug the printer cable (apparently the one unprotected USB port) and attach the BASH Bunny via the printer cable
• BASH Bunny starts driving the ballot counting machine: opens a terminal, get superuser access, installs malicious software, modifies settings
• Deletes audit log

Are there REALLY such nefarious people out there who would steal an election that way?

Nah, not a chance. It was the most secure election in the history of mankind.

Hak5 BASH Bunny for $119.95

The groundbreaking payload platform that introduced multi-vector USB attacks has evolved.

Pull off covert attacks or IT automation tasks faster than ever with just the flick of a switch. The NEW Bash Bunny Mark II goes from plug to pwn in 7 seconds — so when the light turns green it's a hacked machine.

Now with faster performance, wireless geofencing, remote triggers and MicroSD support, the Bash Bunny is an even more impressive tool for your Red Team arsenal.

Simultaneously mimic multiple trusted devices to trick targets into divulging sensitive information without triggering defenses. The Bash Bunny is truly the world's most advanced USB attack platform.

Two years ago, the BASH Bunny added a MicroSD Card XC slot ultra high capacity, up to 500 GB today (spec goes to 2 TB). It has built-in Blue Tooth which adds RF to a vote machine that should NOT have any RF capability. The Bash Bunny can sit there idle waiting for a certain Blue Tooth device to be activated in the vicinity. It can inject keystrokes.

Here's a video about BASH Bunny. Introducing the Bash Bunny Mark II - Story Time with @Hak5Darren

How can a guy producing products made solely to commit electronic crimes not be in jail? Probably the same way that crowbar and hammer makers (or gun manufacturers) don't go to jail

[Red Badger]

Thoughts?........................

[ChinaGotTheGoodsOnClinton]

Little boy, the case was settled before any of this could come out...

[ProtectOurFreedom]

See #12. This should be the smoking gun, but it doesn’t prove cheating was used. It shows the tools the attackers can use, how the attach can be executed, reveals horrendous vulnerabilities in the election equipment, and shows how audit logs can be modified to delete evidence.

To our experts. Is it possible to modify logs without that modification access itself being logged?

[algore]

I just checked out the BASH bunny

a very cool piece of kit, amazing what you can do in such a small package.

everyone should know that if you can have physical access to a computer like this you can own it.

[Made In The USA]

Fascinating concept. We use technology in far more complex ways each day, this problem could solved. There could be methods attached to ensure security and audit. A wise entrepreneur would make this happen, assuming the desire to to actually fix the problem is there.

It’s clear the use of current technology (dominion) is not secure. I hope the judge in this case agrees.

[Political Junkie Too]

I hope the judge in this case agrees.

The judge is the sister of long-time NPR judicial correspondent Nina Totenberg, FWIW.

-PJ

[taxcontrol]

I agree that the technology already exists for a secure election. What is missing is the backbone / will in the state legislatures to implement a secure voting system.

A few minor changes to this specific proposal:

Pins must be 8 characters

Voter rolls are locked the day after the new president is inaugurated and all voters must re-register.

No mail in ballots without a signed request for a ballot and a legal (ie under penalty of perjury) statement claiming a voting disability (out of the country, shut in, military service, etc.)

[fuzzylogic]

I used to agree with this. My main concern is somebody or some group, backed by massive funding, being able to find a vulnerability to specifically NOT disclose it. Then use it as desired.

It’s just far more difficult to commit widespread fraud with paper ballots and manual counting, with lots of eyes. Otherwise, it can be done with a click, seen by nobody.