US e-voting system cracked in less than 48 hours

[TalkingDog]

http://www.h-online.com/security/news/item/US-e-voting-system-cracked-in-less-than-48-hours-1463881.html

Researchers at the University of Michigan have reported that it took them only a short time to break through the security functions of a pilot project for online voting in Washington, D.C. "Within 48 hours of the system going live, we had gained near complete control of the election server", the researchers wrote in a paperPDF that has now been released. "We successfully changed every vote and revealed almost every secret ballot." The hack was only discovered after about two business days – and most likely only because the intruders left a visible trail on purpose.

In 2010, the developers of the municipal e-voting system that enables voters living abroad to vote via a web site, invited security experts to conduct tests. The university researchers say that the project was developed in cooperation with the Open Source Digital Voting Foundation (OSDV) and that other US states have also worked on services similar to Washington's "Digital Vote-by-Mail Service". They also praise the system's transparency as exemplary but point out that its architecture has fundamental security weaknesses and was not able to withstand a shell injection and other common hacker techniques.

The security experts investigated common vulnerable points such as login fields, the virtual ballots' content and filenames, and session cookies – and found several exploitable weaknesses. Even the Linux kernel used in the project proved to have a well known vulnerability. They were also able to use the PDFs generated by the system to trick the encryption mechanism, while unsecured surveillance cameras provided additional insights into the infrastructure. While the open source nature of the code made their work somewhat easier, they believe that attackers would have been able to make quick headway even if the system had been proprietary.

The researchers conclude that it is generally difficult to build secure online voting systems. One small configuration or implementation error would undermine the entire voting process. Even if central servers were not used, which would be prime targets for hacking attempts, there would still be a number of other points of attack. Fundamental advances still need to be made in security, they say, before e-voting will truly be safe.

[mfcorey1]

1. This is some distubing stuff, but it also validates for me the fact that the

2000 elections and others that right wingers mysteriously won were hacked. I will always believe it.

[drm604]

2. Electronic voting should be banned.

I say this as someone with a Comp Sci degree and over 25 years in IT.

[bvar22]

7. ...and I agree with you.

Also BAN Computer based Vote tabulators,
and Vote by Mail.

The BEST way to secure our voting system:

*One day, 24 hour Voting period, National Holiday

*Paper Ballots deposited in a transparent Ballot Box

*Ballots Hand Counted at the polling station in a publicly observable, transparent method with live Internet Video feeds, similar to the Casino Video Security. The ballot boxes will remain at the polling under security surveillance until the tally is certified. No boxes removed or transported to another location before certification.

*Multiple Independent Exit Polls and Observers

The 24 hour vote-in-person holiday is necessary for valid Exit Polls and public observation.
If voting is important enough to you, you will be there.

Voting by Mail is one of the least secure methods of protecting our vote.
Who counts & tallies your vote, and HOW do you KNOW?

[benld74]

3. Slots vs Voting machines

http://imgur.com/gallery/v6m70

[Rex]

4. Just like they like it.

[kurt_cagle]

5. Agreed

I've been working in IT for the last thirty years, including several projects for government agencies where security was paramount, and have been following the e-voting issues closely. There is no question to me that e-voting as it exists today has become a potent mechanism for corruption. The systems are too easily hacked, too easily compromised "out of the factory" (take a look at how closely Diebold is to the Republican party) and have generally been at the center of controversial votes since their inception. I do not find it at all unusual that the Republican party has managed to gain the entrenchment that it has since 2000 - that's when voting machines were first rolled out in any meaningful way.

[TalkingDog]

6. Just a thought... I always send these along to my state and local election boards. Please consider

doing the same. Sometimes they have no idea.