from the election-won-by-over-25-billion-votes dept.
Galois's prototype voting machine wasn't available for hackers to test.
For the majority of Defcon, hackers couldn't crack the $10 million secure voting machine prototypes that DARPA had set up at the Voting Village. But it wasn't because of the machine's security features that the team had been working on for four months. The reason: technical difficulties during the machines' setup.
Eager hackers couldn't find vulnerabilities in the DARPA-funded project during the security conference in Las Vegas because a bug in the machines didn't allow hackers to access their systems over the first two days. (DARPA is the Defense Advanced Research Projects Agency.) Galois brought five machines, and each one had difficulties during the setup, said Joe Kiniry, a principal research scientist at the government contractor.
"They seemed to have had a myriad of different kinds of problems," the Voting Village's co-founder Harri Hursti said. "Unfortunately, when you're pushing the envelope on technology, these kinds of things happen."
It wasn't until the Voting Village opened on Sunday morning that hackers could finally get a chance to look for vulnerabilities on the machine. Kiniry said his team was able to solve the problem on three of them and was working to fix the last two before Defcon ended.
The Voting Village was started in 2017 for hackers to find vulnerabilities on machines that are used in current elections. At the last two Defcons, hackers found vulnerabilities within minutes because the machines were often outdated. The Village shines a necessary light on security flaws for voters as lawmakers seek to pass an election security bill in time for the 2020 presidential election.
(Score: 2, Interesting) by fustakrakich on Monday August 12 2019, @08:31PM (9 children)
Try hitting the reset button.
Too bad people won't simply demand paper ballots.
La politica e i criminali sono la stessa cosa..
(Score: 4, Insightful) by black6host on Monday August 12 2019, @09:42PM (5 children)
Indeed. It seems the best voting machine is one that is not plugged in.
Not to worry though. Even if we went back to paper ballots enterprising minds would still try to find a way to corrupt the count.
(Score: 0) by Anonymous Coward on Monday August 12 2019, @11:27PM (4 children)
You say that like its a new problem to solve. It has been done many times over across the globe, you can probably write a book on it - no enterprising minds needed.
One technique that comes to mind recently is in one south east asian country, the incumbent political party that formed government made a side deal with the fairly significant population in their immigration camp where they get provided with residency in particular voting blocks with the proviso that they vote for them.
(Score: 3, Insightful) by PartTimeZombie on Tuesday August 13 2019, @12:20AM
That sounds like a lot of hard work.
Why not just wait until after you've lost the election, and legislate to remove the powers of the people who won? [politico.com]
I mean, it's not like the voters know what they want, is it? [vox.com]
(Score: 2) by black6host on Tuesday August 13 2019, @01:05AM (2 children)
No, not a new problem. That was my point. Someone will almost always try to corrupt the count (Don't believe in absolutes...) Voting machine security when we can't secure much of anything else is a joke, though... I mean think about it: Equifax's breach. Who can we trust more than the folks entrusted with the info used to decide whether or not we get a loan, a house or just a damned apartment. Absolutely fucking nobody. Unless you want to trust the government which, being polite, I will describe as inept at best nowadays regarding security.
(Score: 4, Insightful) by Reziac on Tuesday August 13 2019, @03:49AM (1 child)
I'll trust a boxful of paper ballots and a gaggle of mutually-hostile poll watchers over the invisible guts of an electronic voting machine.
And there is no Alkibiades to come back and save us from ourselves.
(Score: 2) by Immerman on Tuesday August 13 2019, @05:53AM
hear, hear
(Score: 1, Interesting) by Anonymous Coward on Tuesday August 13 2019, @02:02AM
It was busy doing the automatic Windows 10 upgrade.
(Score: 2) by captain normal on Tuesday August 13 2019, @05:31AM (1 child)
Ah...but can't be hacked. Sounds like a feature, not a bug.
When life isn't going right, go left.
(Score: 0) by Anonymous Coward on Tuesday August 13 2019, @07:12PM
Well, can't be hacked because it preemptively DoS's itself is something a little different...
(Score: 0, Flamebait) by Anonymous Coward on Monday August 12 2019, @09:10PM
The retired people who manage the electronic voting systems at my local precinct are already in over their head. The last time I went to vote "the system crashed" and all the retired volunteers were panicking because they "couldn't bring it back online". I hope they work out the kinks so any grandpa could resolve the technical difficulties with these new systems.
(Score: 5, Insightful) by pipedwho on Monday August 12 2019, @10:18PM
What is 'cutting edge' about something that could be done securely with 1970's technology (and crypto algorithms developed in the 1990's)?
Oh that's right, we have to hack up totally insecure readily available 'computer systems' that offers no real benefits and major drawbacks. So all the 'cutting edge' work is about getting system security back to a secure baseline from 50 years ago. Great stuff. I applaud those clever boys and girls at DARPA.
The purported reason for replacing paper ballots is a red herring IMO. It is a feature not a bug that it requires additional manpower proportional to the number of people voting. This means the concentration of power isn't so focused when something goes awry. This allows the local regions to do the individual counts, the next level to run the higher level counts, etc. With multiple counters and verifiers from adversarial parties, this makes it very difficult to subvert the counting process, and much more likely to get discovered, identified and prosecuted.
Replacing that potential set of people with machines so you can 'take the men out of the loop' so to speak, simply makes it so less people are required. This means, less people invested in the election process, less eyeballs on the process, and probably by extension less people voting at all due to disenfranchisement. These I expect are features that benefit everyone except 'the people' by making it easier to subvert the system from multiple perspectives: statistics of voter turn out, concentration of failure (where all parties possibly assume will be a benefit to themselves), easier to manipulate a populace less invested in their political governance, pork barrel projects for machine development and manufacture, etc.
(Score: 4, Interesting) by Snotnose on Monday August 12 2019, @11:28PM
Early 80s, my company used an 8086 in a box to literally replace a wall of telemetry machines. One year at the International Telemetry Conference (ITC), held in Vegas, we were told we had a competitor. We all went to their booth only to be told "um, we dropped it getting it off the truck. But you can go to our hotel suite to see a demo". Needless to say, us low level engineers got sent (because the other company knew all the managers and sales folks at my company) to the suite only to see a tweaked box that wouldn't power up.
Never again heard from that company. As nobody had heard of them before ITC, and nobody heard of them after, we figured they were a scam.
We did get competition, which led to huge layoffs (you only made 25% profit? We promised 30% to our investors, reduce head count). But my company skated for 4-5 years on what in hindsight was a very simple and obvious thing to do.
When the dust settled America realized it was saved by a porn star.
(Score: 4, Insightful) by Thexalon on Tuesday August 13 2019, @02:27AM
The people who run elections, at least in the United States, aren't trying to have secure elections. If they were, they'd be demanding paper ballots, massive transparency, international observers, and a wide variety of checks and balances and limits on the power of elected officials and partisan hacks to swing the vote. But for some reason, they aren't doing any of that.
Based on their behavior, what they want, in order, is:
1. Ensure that their side wins.
2. Make it look legitimate enough that those who dispute the result can be successfully dismissed as some sort of kook.
You'll notice that the preferences of the electorate aren't really relevant to this process.
The only thing that stops a bad guy with a compiler is a good guy with a compiler.
(Score: 1, Insightful) by Anonymous Coward on Tuesday August 13 2019, @05:13AM
https://xkcd.com/2030/ [xkcd.com]
Voting Software