Hacker infiltration ends D.C. online voting trial

[Bill Bored]

Source: Washington Post

Last week, the D.C. Board of Elections and Ethics opened a new Internet-based voting system for a weeklong test period, inviting computer experts from all corners to prod its vulnerabilities in the spirit of "give it your best shot." Well, the hackers gave it their best shot -- and midday Friday, the trial period was suspended, with the board citing "usability issues brought to our attention."

Here's one of those issues: After casting a vote, according to test observers, the Web site played "Hail to the Victors" -- the University of Michigan fight song.

"The integrity of the system had been violated," said Paul Stenbjorn, the board's chief technology officer.

Stenbjorn said a Michigan professor whom the board has been working with on the project had "unleashed his students" during the test period, and one succeeded in infiltrating the system.

The fight song is a symptom of deeper vulnerabilities, says Jeremy Epstein, a computer scientist working with the Common Cause good-government nonprofit on online voting issues. "In order to do that, they had to be able to change anything they wanted on the Web site," Epstein said.

-snip-


Read more: http://voices.washingtonpost.com/debonis/2010/10/hacker_infiltration_ends_dc_on.html

---

I'm sorry, but everyone should be visiting the DU Election Reform Forum for this kind of news on a regular basis. So here's the link to the excerpt there:
http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=203x516403

This may be the tail wagging the dog, but elections are too important not to have their own forum that everyone checks regularly.

A few days ago, I posted about this story and it didn't even get 5 Recommends! So if you're interested in voting news, please visit the ER Forum on a regular basis from now on!:
http://www.democraticunderground.com/discuss/duboard.php?az=show_topics&forum=203

Thanks!

[LittleGirl]

1. stands and cheers! yeah, this is exactly how you prove online

voting isn't secure!

I follow the Brad blog.

[Pab Sungenis]

2. Really, no voting system is completely secure.

Online websites can be hacked.

DRE "voting" machines can do whatever they want, and some just need to have a USB key inserted to change their software.

Mail-in ballots can be waylaid.

Paper ballot boxes get stuffed or emptied, or loaded onto trucks with Bush/Cheney bumperstickers.

The more we try to make our voting system "more secure," the worse it gets. To quote Montgomery Scott, "the fancier they make the plumbing the easier it is to stop up the drain."

[Bill Bored]

5. You left out Optical Scan which is as hackable as DREs.

Yeah, yeah, I know, PAPER BALLOTS can be hand-counted to check the scanners. But it's rarely done.

[CatholicEdHead]

6. It can be done if there is a controversy

or a close race.

[AtheistCrusader]

11. And ballots can be removed, or added, if it's close.

[donco6]

25. That would be very hard, too.

Our county creates a header label on each batch of votes, with totals on it. If that is altered at any time, the scanner alarms. I'm sure it's not perfect, but it's pretty darn good.

[donco6]

23. We do it every year.

We do a hand audit check of our scanners in Adams County Colorado every year. We select a number of batches, scan them ourselves as judges, then we trade batches and hand count them all. It's very difficult. I've done it for three years. Our machines are very accurate - way more accurate than the hand tallies.

[eridani]

45. It would be if it were mandated, as OR and MN now do

Their protocol should be upgraded by the American Statistical Association, though.

[LittleGirl]

10. Yep, agreed

After following Brad's blog for over 2 yrs, I'm not sure there is a secure voting system.

[LanternWaste]

22. However it's a little more difficul...

"no voting system is completely secure."

However it's a little more difficult for a computer hacker with a grudge and a political dogma to stuff ballot boxes.

Although no one thing is secure, all things being equal some are more secure than others.

[Liberty Belle]

39. They should be hand-counted AT PRECINCTS, with counts videotaped.

[DissedByBush]

52. The question is relative security

I could design a digital voting machine that is far more secure than anything else we've seen.

The problem so far has been that most of the machines were designed without really even caring about security.

You know the designers like Diebold don't care when you can open one with a standard office cabinet key.

[Bill Bored]

3. Nothing against Brad, but he's only one voice, and he's got a lot on his plate! nt

[thereismore]

4. Props to Michigan from a OSU graduate! nt

[Blue State Bandit]

7. So funny, it's sad.

both the story, and the apathy.

[diva77]

8. K & R !!!!!

I wonder whether Bill Gates or Mark Zuckerberg are aware of any of this?

[drm604]

9. K&R

Vital information.

[AtheistCrusader]

12. Wrong.

"The fight song is a symptom of deeper vulnerabilities, says Jeremy Epstein, a computer scientist working with the Common Cause good-government nonprofit on online voting issues. "In order to do that, they had to be able to change anything they wanted on the Web site," Epstein said."

Completely wrong. The sound file MAY have been the ONLY thing they could alter, because it was relegated to an 'unimportant' status by the authors, or they used a turn-key system that considered it unimportant, possibly because it was authored for a different purpose, and they used a different set of permissions for it.

[Bill Bored]

20. Doesn't matter. This system has other problems besides the security ones.

It didn't even work with all web browsers, esp. the ones that come with MACs!

So our latte-drinking, MAC-toting, different-thinking, progressive friends who probably think Internet Voting is "KEWL!" would be the first ones to be disenfranchised by this crap!:popcorn:

[boppers]

46. It sounds to me like they checked into it, and found the files were read-only.

It may be breathless hyperbole, or the computer scientist may have simply noted that the hacked file(s) was only writable by root/Administrator (or the web "page" had somehow been modified to *play* a sound file that was located somewhere, such files don't have to come from the same machine).... and once somebody has escalated to that point, all bets are off.

[Bill Bored]

57. See post #56. nt

[Lydia Leftcoast]

13. Considering that I, with one programming course in the 1980s, can think of

TWO algorithms for undetectable cheating, I'm surprised that the dangers aren't obvious.

[BradBlog]

14. MUCH MORE ON THIS STORY & OTHER RECENT E-VOTE HACKS

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=102x4563927

Full story: http://www.bradblog.com/?p=8106

Thanks for helping to get it out there Bill Bored!

[KamaAina]

15. Go Blue!

Not a huge Michigan fan (except when they play ND), but that was teh awesome! :yourock:

[Cal Carpenter]

16. LOL M GO BLUE! n/t

[nyy1998]

17. Haha, Go Blue!!!

[herbm]

18. When voting say,"Paper,please!"

[apacherose]

19. I bet I know who this was

I'm a recent UM Computer Science Engineering graduate and my final course was a grad-level class on Computer and Network Security...our professor was a very accomplished hacker and I'm 99% sure this had to have been him.

GO BLUE!

[a2liberal]

49. Well the article said it was one of the professor's students

I know several students in CSE though who have a reputation for this sort of thing, including some grads who are specifically studying voting machine security

[Bozita]

21. Here's hoping they buy good quality speaker systems for those voting machines.

Perhaps something from Klipsch.

[harvey007]

24. The song....

http://www.youtube.com/watch?v=EF--ldYIBnM

[Bozita]

26. I prefer the version by the entire marching band ... with an intro by Bob Ufer

This one:
http://www.youtube.com/watch?v=n77q4ifpgKU&feature=related

[SharonRB]

29. I miss Bob Ufer

And watching the band in the stadium on football Saturdays, doing the fanfare and The Victors still gives me a chill. Can't wait for Saturday's big game against MSU! I hope Denard has a big day.

[pleah]

27. K&R

[SharonRB]

28. Go Blue!

and Hail to the Victors Valiant!

[davidinalameda]

30. didn't Anne Coulter graduate from Michigan

just saying

:hide:

:rofl:

[Bozita]

33. Coulter's a Cornell grad.

Just like Bill Maher and Keith Olbermann.

[davidinalameda]

47. where did she go to law school?

:evilgrin:

[caraher]

51. It's a big school

No doubt, a lot of bad people graduated from Michigan.

But we also get to claim Clarence Darrow...

[davidinalameda]

53. that almost evens it out

[w4rma]

31. Awesome! These things are *absolutely* unable to be secured. P.S. I'm a computer engineer. (nt)

[femrap]

32. Corporations have no

right to count our votes. Give me paper and pen.

[GreenTea]

34. Republican Secretary of States change & steal votes every election with the extremely easily

hackable electronic voting machines that have no verification (no paper trail) whatever the finally tally (vote numbers) that are on the easily hacked machines becomes the official count....

No way to check, no one allowed to even check the accuracy of the machines because our voting machine are owned not by the people who paid for them.....but by the corporations who own build and maintain them.

If that isn't enough to show you how easily the republicans can steal votes (and elections)....Each Secretary of State counts & controls & versifies certification of the vote....We saw republicans Secretary of State in FL, OH, GA, and many other states do what ever was needed to change the final vote count for the republicans. Republicans can't win elections in many places without stealing, purging and manipulating the votes.

Republicans are a amazingly arrogant shameless bunch of thugs!

[TroglodyteScholar]

36. +1

My first time voting was 2002 in GA. They had just introduced the new Diebold "Vote Into the Void" system and I was not a happy camper.

[GreenTea]

43. 2002 GA elections were a sad day for the election process & democrats the republicans

outright reversed the voting on the GA Senate & Governors race Democrats (Both Dems had very comfortable leads going through the night) when both elections and in the early morning hours the hack was in and the votes were flipped - What a shame - The media said nothing about the obvious manipulations just went along with the republicans bullshit explanations for the strange early morning reversals - After that GA hacking in 2002 is when the republicans really saw how the Diebold (and other corporate owned) electronic voting machines would make it so easy for them to steal races around the country....and they will be doing the same this Nov. 2nd absolutely positively!

[ElboRuum]

35. "The integrity of the system had been violated"

A rather terrible substitute phrase for the much more well understood "We got pwned."

[Melissa G]

37. K&R #64 n/t

[vanboggie]

38. Woot! Go Blue!

The online system and (supposedly) offline cheat machines need to be eradicated. They were designed to flip elections and did their job in foisting the Chimp and Cheney on this country. Good God, it's so obvious and yet so few are paying attention!!!!!

[RoccoR5955]

40. These voting systems are quite vulnerable. Especially when they run Windows.

This from someone who has 20+ years professional experience with computer tech, supporting it, building networks, and such. Each month, Microsoft comes out with "updates." These are merely plugs to the security that does not exist in their OS. Windows systems also get outdated, because, after a certain amount of time, Microsoft will not support them. This means that the voting systems will have to be repurchased every five or six years. If you think that it was costly to go to computer based voting systems, you haven't seen anything yet. Wait until your machines have to be upgraded, or replaced. The old lever machines were good for thirty to fifty years. Not so with computer based voting systems.

[bobbolink]

41. After all these years they decide there may be a problem... charming.

And, too soon before an election to actually do anything.

Delightful.

[robinlynne]

42. GOOD.

[valerief]

44. K&R

[a2liberal]

48. Go Blue!

I bet it's someone I know who did it too...

[ProgressOnTheMove]

50. I think voters should be sent a bar code, people will need to get a bar code reader pen then only...

the registered person can vote.

[earcandle]

54. I don't think they are trying. If we can make secure banking transactions, we can vote online. BS.

[wcollar]

55. Not trying

No, they really aren't trying, but secure banking transactions? I don't think so.
Just Google Zeus Trojan.
Banks factor in a certain amount of "acceptable loss".
What is the "acceptable loss" in an election?

[Bill Bored]

56. The hack is explained by the hacker here:

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=203x516431

[Bill_Kelleher]

58. POSITIVE NEWS FOR INTERNET VOTING

Friends!

Don’t despair over the DC hacking. Here is a short list of positive news for Internet voting:

Pasadena Star News, Two Sunday editions
“Are you ready for Internet voting? For millions of Americans overseas, it's the only way to ensure their votes are counted”
http://www.pasadenastarnews.com/opinions/ci_16357185

Also, RE: CA Prop 14 (nonpartisan elections) and the future of CA politics
http://www.pasadenastarnews.com/ci_16172903?IADID

Both articles have excellent debates in the comments.


Op Ed News
“Does the DC Fiasco Damn Internet Voting?”
http://www.opednews.com/articles/Does-the-DC-Fiasco-Damn-In-by-William-J-Kellehe-101015-957.html


SSRN
“Scary Stories Fail to Stop Internet Voting”

Abstract:
Rather than using the results of scientific testing, and probability calculation, opponents of Internet voting have commonly resorted to telling scary stories about what might happen. In 2004 this tactic had spectacular success. The Department of Defense had already spent over $22,000,000 on an Internet voting project. It was ready to be used in the 2004 November election, but well publicized scary stories had it halted.

Since that time, state election officials, the military, and DoD have regained their reason, and Internet voting is coming back.

At, http://ssrn.com/author=1053589 (free download)

William J. Kelleher, Ph.D.
[e-mail]