National: States ramping up defenses against election hacks | The Hill

States across the nation are ramping up their digital defenses to prevent the hacking of election systems in 2018. The efforts come in the wake of Russia’s interference in the 2016 presidential election, which state officials say was a needed wake up call on cybersecurity threats to election systems and infrastructure. … Security experts are still divided over the extent of hacking risks to actual voting machines. Some say that because many different voting machines are used across the country and because they are not connected to the internet, that would make any large scale attack hard to carry out. … But others contend that digital voting machines are vulnerable and could be targeted to influence actual election outcomes. “Some election functions are actually quite centralized,” Alex Halderman, a University of Michigan computer science professor, told the Senate Intelligence Committee in June. “A small number of election technology vendors and support contractors service the systems used by many local governments. Attackers could target one or a few of these companies and spread malicious code to election equipment that serves millions of voters.”

National: Voting Machine Hackers Have 5 Tips to Save the Next Election | WIRED

American Democracy depends on the sanctity of the vote. In the wake of the 2016 election, that inviolability is increasingly in question, but given that there are 66 weeks until midterm elections, and 14 weeks until local 2017 elections, there’s plenty of time to fix the poor state of voting technology, right? Wrong. To secure voting infrastructure in the US in time for even the next presidential election, government agencies must start now. At Def Con 2017 in Las Vegas, one of the largest hacker conferences in the world, Carsten Schurmann (coauthor of this article) demonstrated that US election equipment suffers from serious vulnerabilities. It took him only a few minutes to get remote control of a WINVote machine used in several states in elections between 2004 and 2015. Using a well-known exploit from 2003 called MS03-026, he gained access to the vote databases stored on the machine. This kind of attack is not rocket science and can be executed by almost anyone. All you need is basic knowledge of the Metasploit tool.

National: To Fix Voting Machines, Hackers Tear Them Apart | WIRED

The toughest thing to convey to newcomers at the DefCon Voting Village in Las Vegas this weekend? Just how far they could go with hacking the voting machines set up on site. “Break things, just try to pace yourself,” said Matt Blaze, a security researcher from the University of Pennsylvania who co-organized the workshop. DefCon veterans were way ahead of him. From the moment the doors opened, they had cracked open plastic cases and tried to hot-wire devices that wouldn’t boot. Within two minutes, democracy-tech researcher Carsten Schürmann used a novel vulnerability to get remote access to a WINVote machine. The Voting Village organizers—including Harri Hursti, an election technology researcher from Finland, and Sandy Clark from the University of Pennsylvania—had set up about a dozen US digital voting machines for conference attendees to mess with. Some of the models were used in elections until recently and have since been decommissioned; some are still in use. Over three days, attendees probed, deconstructed and, yes, even broke the equipment in an effort to understand how it works and how it could be compromised by attackers. Their findings were impressive, but more importantly, they represented a first step toward familiarizing the security community with voting machines and creating momentum for developing necessary defenses.

National: Federal judge denies Common Cause effort to block Trump fraud commission | The Washington Post

A federal judge on Tuesday declined to temporarily bar President Trump’s voting commission from collectingvoter data from states and the District, saying a federal appeals court likely will be deciding the legality of the request. U.S. District Judge Royce C. Lamberth of the District denied an emergency motion by Common Cause, a nonprofit government watchdog group. The group alleged the request for voting history and political party affiliation by the Trump administration violates a Watergate-era law that prohibits the government from gathering information about how Americans exercise their First Amendment rights. Lamberth advised the group to flesh out its claims by documenting the commission’s activity at a recent July 19 meeting while the lawsuit continues.

National: 33 states accepted Department of Homeland Security aid to secure elections | The Hill

The Department of Homeland Security (DHS) provided cybersecurity assistance to 33 state election offices and 36 local election offices leading up to the 2016 presidential election, according to information released by Democratic congressional staff. During the final weeks of the Obama administration, the DHS announced that it would designate election infrastructure as critical, following revelations about Russian interference in the 2016 election. Since January, two states and six local governments have requested cyber hygiene scanning from the DHS, according to a memo and DHS correspondence disclosed Wednesday by the Democratic staff of the Senate Homeland Security and Governmental Affairs Committee. The information is related to the committee’s ongoing oversight of the DHS decision to designate election infrastructure. 

National: DEFCON Hackers Found Many Holes in Voting Machines and Poll Systems | IEEE Spectrum

E-voting machines and voter registration systems used widely in the United States and other countries’ elections can readily be hacked—in some cases with less than two hours’ work. This conclusion emerged from a three-day-long hackathon at the Def Con security conference in Las Vegas last weekend. Some of those hacks could potentially leave no trace, undercutting the assurances of election officials and voting machine companies who claim that virtually unhackable election systems are in place. … “These people who hacked the e-poll book system, when they came in the door they didn’t even know such a machine exists. They had no prior knowledge, so they started completely from scratch,” says Harri Hursti, Hacking Village co-coordinator and data security expert behind the first hack of any e-voting system in 2005.

National: State Voter Registration Systems Are Easier to Hack Than Anyone Wants to Admit | Mother Jones

Last weekend at the DEF CON conference—the annual get together for hackers, spooks, and computer enthusiasts—hackers showed how easily voting machines could be hacked, proving once more how vulnerable they are to cyber attacks. But conference organizers did not restrict the electoral hacking demonstration to voting machines. A virtual voter registration data base was also attacked, and defended, which experts say is just as worrisome. “If you look at all of the reports about foreign actors, malicious actors attacking US election infrastructure in the last election, they were not attacking the election machines,” Harri Hursti, an expert in hacking voting machines, and one of the co-organizers of the voting machine hacking exercises, tells Mother Jones. “They were attacking the back-end network, the underlying infrastructure. This was the simulation that showed how vulnerable [it is] and how hard it is to defend.”

National: Special Counsel Robert Mueller Impanels Washington Grand Jury in Russia Probe | The New York Times

Robert S. Mueller III, the special counsel investigating Russia’s attempts to disrupt last year’s presidential election, has issued subpoenas from a Washington-based grand jury in recent weeks, according to several lawyers involved in the case. At least some of the subpoenas were for documents related to the business dealings of Michael T. Flynn, the retired general who briefly served as President Trump’s national security adviser. Mr. Flynn is under investigation for foreign lobbying work, as well as for conversations he had during the transition with Sergey I. Kislyak, who was Russia’s ambassador to the United States. Mr. Mueller’s team is broadly investigating whether any Trump associates colluded with the Russian government in its attempts to disrupt the election. It is unclear whether the subpoenas issued in recent weeks relate to other members of Mr. Trump’s campaign who have been a focus of the Mueller investigation, including Paul J. Manafort, the former campaign chairman.

National: New lawsuits cite Trump comments, tweets to challenge fraud panel | CNN

Opponents of President Donald Trump’s voting integrity commission are seeking to hamstring the effort in court, filing three lawsuits Monday that say the panel is running afoul of federal laws — and introducing Trump’s heated rhetoric against him in court. The new lawsuits add to the legal challenges against the Presidential Advisory Commission on Election Integrity, which recently sent a letter to all 50 states that included a request for voter roll information, including parts of Social Security numbers, that alarmed states and voters. The letter asked for all “publicly available” data, but the long list of pieces of information sought, including the last four digits of Social Security numbers, included several elements that very few states, if any, say they can legally comply with. One lawsuit targets on the request for voter information as a violation of privacy, while the other two focus more generally on whether the commission has been violating government transparency laws.

National: Hacking voting machines takes center stage at DEFCON | Tech Target

“Anyone who says they’re un-hackable is either a fool or a liar.” Jake Braun, CEO of Cambridge Global Advisors and one of the main organizers of the DEFCON Voting Village, said the U.S. election industry has an attitude similar to what had been seen with the air and space industry and financial sectors. Companies in those sectors, Braun said, would often say they were un-hackable their machines didn’t touch the internet and their databases were air-gapped —  until they were attacked by nation-states with unlimited resources and organized cybercrime syndicates and they realized they were “sitting ducks.” … Candice Hoke, law professor and co-director of the Center for Cybersecurity and Privacy Protection, said in a DEFCON talk the laws surrounding investigations of potential election hacking were troublesome. “In some states, you need evidence of election hacking in order to begin an investigation. This is an invitation to hackers,” Hoke said. “We all know in the security world that you can’t run a secure system if no one is looking.”

National: New website aims to track Russian-backed propaganda on Twitter | Reuters

A website launched on Wednesday seeks to track Russian-supported propaganda and disinformation on Twitter, part of a growing non-governmental effort to diminish Moscow’s ability to meddle in future elections in the United States and Europe. The “Hamilton 68” dashboard (here) was built by researchers working with the Alliance for Securing Democracy, a bipartisan, transatlantic project set up last month to counter Russian disinformation campaigns. The website, supported by the German Marshall Fund, displays a “near real-time” analysis of English-language tweets from a pool of 600 Twitter accounts that analysts identified as users that spread Russian propaganda.

National: Voting machines and election systems – a quick look | Associated Press

Digital voting machines are in the spotlight in Venezuela, where the head of Smartmatic, a maker of election systems used in the country’s tumultuous constituent-assembly election, said Wednesday that the official turnout figure had been “tampered with .” The company’s CEO said the count was off by at least 1 million votes — possibly in either direction. Tibisay Lucena, head of Venezuela’s National Electoral Council, dismissed that allegation as an “irresponsible declaration” that might lead to legal action. The government-stacked electoral council claims more than 8 million people voted in the election for a nearly all-powerful constituent assembly. Independent analysts have expressed doubts at that number. Here’s a look at the technology and politics of voting machines and election systems. The voting-machine market is a speck in the prodigious tech sector. Iowa University computer scientist Douglas Jones estimates its annual revenues in the United States at less than $200 million — roughly what Google pulls in every day. It’s much harder to get reliable information about the fragmented global market for election systems.

National: Hackers Eviscerate Election Tech Security…Who’s Surprised? | WhoWhatWhy

Over the past two days, all major US news outlets breathlessly reported that hackers in Las Vegas needed little time to expose the security flaws of several types of voting machines this weekend. While it is certainly nice to see the mainstream media cover election integrity issues more than once every four years, anybody following the topic, as WhoWhatWhy routinely does, was hardly surprised that the hackers were so successful. How do we know? Because, in anticipation of what happened at the DEF CON hacking conference, WhoWhatWhy spoke to many of the leading election integrity experts to get their thoughts on the event. Most of them expressed hope that the hackers would raise much-needed awareness of the vulnerabilities of US voting machines. Some of the experts we spoke to ahead of the event expressed concerns that, should the hackers fail to breach the machines, it would give people a false sense of security. It turns out that they did not have to worry about that — at all.

National: Congressmen at DefCon: Please help us, hackers! | The Parallax

For the first time in the 25 years of the world’s largest hacker convention, DefCon, two sitting U.S. Congressmen trekked here from Washington, D.C., to discuss their cybersecurity expertise on stage. Rep. Will Hurd, a Texas Republican, and Rep. Jim Langevin, a Rhode Island Democrat, visited hacking villages investigating vulnerabilities in cars, medical devices, and voting machines; learned about how security researchers plan to defend quantum computers from hacks; and met children learning how to hack for good. … Hurd said security researchers could play an important role in addressing increasingly alarming vulnerabilities in the nation’s voting apparatus. DefCon’s first voting machine-hacking village this weekend hosted a voting machine from Shelby County, Tenn., that unexpectedly contained personal information related to more than 600,000 voters. Village visitors managed to hack the machine, along with 29 others.

National: Kobach appeals order to answer questions under oath | The Kansas City Star

Kansas Secretary of State Kris Kobach is seeking to avoid answering questions under oath about two documents containing plans for changes to U.S. election law. Kobach, who also is vice chairman of President Donald Trump’s commission on election integrity, filed a notice late Monday saying he is appealing to the 10th U.S. Circuit Court of Appeals an order to submit to a deposition by the American Civil Liberties Union in a voting rights case. The closed deposition is scheduled for Thursday. The ACLU said Tuesday that Kobach’s appeal of the deposition order to the 10th Circuit is “bizarre.”Kansas Secretary of State Kris Kobach is seeking to avoid answering questions under oath about two documents containing plans for changes to U.S. election law. Kobach, who also is vice chairman of President Donald Trump’s commission on election integrity, filed a notice late Monday saying he is appealing to the 10th U.S. Circuit Court of Appeals an order to submit to a deposition by the American Civil Liberties Union in a voting rights case. The closed deposition is scheduled for Thursday. The ACLU said Tuesday that Kobach’s appeal of the deposition order to the 10th Circuit is “bizarre.”

National: Hackers at a cybersecurity conference breached dozens of voting machines | Business Insider

Professional hackers were invited to break into dozens of voting machines and election software at this year’s annual DEFCON cybersecurity conference. And they successfully hacked every single one of the 30 machines acquired by the conference. The challenge was held at DEF CON’s “Voting Village,” where hackers took turns breaching ten sample voting machines and voter registration systems, Politico reported. … “Follow the money,” Harri Hursti, the cofounder of Nordic Innovation Labs, which helped organize DEF CON, told The Hill. “On the other end of the ballot, that’s where the money is — banks and roads.” Hodge said that if officials take care to “store machines, set them up, [and] always have someone keeping an eye on machines,” that could go a long way in ensuring the safety of the electoral process.

National: To make our voting tech more secure, policymakers may need to work with the people who can break in them | KPCC

After acquiring a decommissioned voting machine, Anne-Marie “Punky” Chun and her colleagues at Synack set out to hack it. It took them only a matter of hours. “Just looking at the security hygiene, it wasn’t very strong,” Chun told Take Two host A Martinez in an interview. “The encryption password, for example, was hard-coded as ‘ABCD.’ And it was used on the whole machine.” Chun and her team test cyber security in, arguably, the most effective way: by breaking in themselves. So when they though about the best way to check the security of election data, they knew they had to find a voting machine, and preferably an older one.

National: Federal judge set to hear new challenge to Trump fraud commission Tuesday | The Washington Post

A federal judge will hear arguments Tuesday over whether a Watergate-era law prohibiting the government from collecting data on how Americans exercise their First Amendment rights bars President Trump’s Election Integrity Commission from American’s voting records. U.S. District Judge Royce C. Lamberth of the District set the hearing Monday after Common Cause, a nonprofit government watchdog group, alleged that the Trump administration was violating the Privacy Act of 1974 by seeking the “quintessentially First Amendment-protected political party affiliation and voter history data” of every American. The court could rule on the request for a temporary restraining order as early as Tuesday.

National: DHS is refusing to investigate possible breach of voting machines | Business Insider

Pressure to examine voting machines used in the 2016 election grows daily as evidence builds that Russian hacking attacks were broader and deeper than previously known. And the Department of Homeland Security has a simple response: No. DHS officials from former secretary Jeh Johnson to acting Director of Cyber Division Samuel Liles may be adamant that machines were not affected, but the agency has not in fact opened up a single voting machine since November to check. Asked about the decision, a DHS official told TPM: “In a September 2016 Intelligence Assessment, DHS and our partners determined that there was no indication that adversaries were planning cyber activity that would change the outcome of the coming US election.” According to the most recent reports, 39 states were targeted by Russian hackers, and DHS has cited–without providing details–domestic attacks in its own reports as well. “Although we continue to judge all newly available information, DHS has not fundamentally altered our prior assessments,” the department told TPM.

National: Every Voting Machine at This Hacking Conference Got Totally Pwned | Gizmodo

A noisy cheer went up from the crowd of hackers clustered around the voting machine tucked into the back corner of a casino conference room—they’d just managed to load Rick Astley’s “Never Gonna Give You Up” onto the WinVote, effectively rickrolling democracy. The hack was easy to execute. Two of the hackers working on the touchscreen voting machine, who identified only by their first names, Nick and Josh, had managed to install Windows Media Player on the machine and use it to play Astley’s classic-turned-trolling-track. … The security industry encourages regular software updates to patch bugs and keep machines as impenetrable as possible. But updating the machines used in voting systems isn’t as easy as installing a patch because the machines are subject to strict certification rules.

National: Hackers Demonstrate How Vulnerable Voting Machines Are | US News & World Report

We shouldn’t need another reminder, but the DefCon hacking conference in Las Vegas provided one over the weekend anyway: Voting machines are highly susceptible to electronic attacks. You might remember the topic of hacking elections from such recent presidential campaigns as: last year’s. And while – this is important – there’s no evidence that hackers manipulated actual vote tallies in 2016, there’s every reason to believe that cyber-malefactors will try to do just that in future. And the DefCon gang proved how easy that would be. The convention set up a Voting Machine Hacking Village where attendees could see what they could do against more than 30 voting machines (procured, no kidding, via eBay and government auctions). It took less than 90 minutes before a hacker was able to crack the poorly-secured Wi-Fi on one voting machine (which is, thankfully, outdated and was apparently last used in 2015); another programmed a machine to play Rick Astley’s ghastly song, “Never Gonna Give You Up.” Imagine casting your vote on Election Day and getting rickrolled for your trouble.

National: Hackers at DefCon conference exploit vulnerabilities in voting machines | USA Today

It took less than a day for attendees at the DefCon hacking conference to find and exploit vulnerabilities in five different voting machine types. “The first ones were discovered within an hour and 30 minutes. And none of these vulnerabilities has ever been found before, they’ll all new,” said Harri Hursti, co- coordinator of the event. One group even managed to rick-roll a touch screen voting machine, getting it to run Rick Astley’s song “Never Gonna Give You Up,” from 1987. … The groups weren’t able change votes, noted Hursti, a partner at Nordic Innovation Labs and an expert on election security issues. “That’s not what we’re trying to do here today. We want to look at the fundamental compromises that might be possible,” he said.

National: Hackers descend on Las Vegas to expose voting machine flaws | Politico

Election officials and voting machine manufacturers insist that the rites of American democracy are safe from hackers. But people like Carten Schurman need just a few minutes to raise doubts about that claim. Schurman, a professor of computer science at the University of Copenhagen in Denmark, used a laptop’s Wi-Fi connection Friday to gain access to the type of voting machine that Fairfax County, Virginia, used until just two years ago. Nearby, other would-be hackers took turns trying to poke into a simulated election computer network resembling the one used by Cook County, Illinois. …  Before the 2016 election, former FBI Director James Comey assuaged fears by telling Congress that the system was so “clunky” — comprised of a mishmash of different kinds of machines and networks, with each state’s results managed by a consortium of state and county officials — that its overall integrity was fairly safe. Election security advocates aren’t as confident. Barbara Simons, Board Chair of Verified Voting, a nonprofit that since 2003 has studied U.S. elections equipment, said that the vulnerabilities on display in Las Vegas only served to reiterate a need for the country to adopt a nationwide system of verifiable paper ballots and mandatory, statistically significant audits. While numerous states have starting moving in this direction, Simons worries it’s not enough.

National: These Hackers Reveal How Easy It Is To Hack US Voting Machines | Forbes

In a muggy little room in the far corner of Caesar’s Palace, wide-eyed and almost audibly buzzing is Carsten Schurmann. The German-born hacker has just broken into a U.S. voting machine with his Apple Mac in a matter of minutes. He can turn it on and off, he can read all the information stored within and if he felt like it, he could probably change some votes if the system was in use. “This is insane,” he says. But today, that machine is not in use, it’s being opened up for anyone to try what Schurmann did. A host of technically-minded folk have gathered at DEF CON’s Voting Machine Village, where they’re tinkering with more than 25 commonly used systems used across American elections. They might just save the next election from Russian hackers. Those machines are, co-organizer Matt Blaze says, horribly insecure. Blaze’s hope is the public will be made aware of their many, many flaws, and demand elections be protected from outside, illegal interference, following the much-documented attempts by Russia to install Donald Trump as president.

National: Hackers Scour Voting Machines for Election Bugs | VoA News

Hackers attending this weekend’s Def Con hacking convention in Las Vegas were invited to break into voting machines and voter databases in a bid to uncover vulnerabilities that could be exploited to sway election results. The 25-year-old conference’s first “hacker voting village” opened on Friday as part of an effort to raise awareness about the threat of election results being altered through hacking. Hackers crammed into a crowded conference room for the rare opportunity to examine and attempt to hack some 30 pieces of election equipment, much of it purchased over eBay, including some voting machines and digital voter registries that are currently in use.

National: Hackers breach each of dozens voting machines brought to conference | The Hill

One of the nation’s largest cybersecurity conferences is inviting attendees to get hands-on experience hacking a slew of voting machines, demonstrating to researchers how easy the process can be. “It took me only a few minutes to see how to hack it,” said security consultant Thomas Richards, glancing at a Premier Election Solutions machine currently in use in Georgia. The DEF CON cybersecurity conference is held annually in Las Vegas. This year, for the first time, the conference is hosting a “Voting Machine Village” where attendees can try to hack a number of systems and help catch vulnerabilities. The conference acquired 30 machines for hackers to toy with. Every voting machine in the village was hacked.

National: Defcon hackers break voting machines easily with old exploits | CNET

When the password for a voting machine is “abcde” and can’t be changed, the integrity of our democracy might be in trouble. The Advanced Voting Solutions WinVote machine, dubbed “America’s worst voting machine,” came equipped with this simple password even as it was used in some of the country’s most important elections. AVS went out of business in 2007, but Virginia used its insecure machines until 2015 before dropping them for scrap metal. That means this vulnerable hunk of technology was used in three presidential elections, starting with George W. Bush’s re-election in 2004 to Barack Obama’s in 2012. In addition to Virginia, Pennsylvania and Mississippi used the WinVote without knowing all the ways it could be hacked. Unlike other technology — your phone, your laptop, connected cars — security wasn’t really a focus. 

National: Leader Of Voter Fraud Probe Really Doesn’t Want To Release Trump Meeting Documents | HuffPost

Kansas Secretary of State Kris Kobach (R) continued to fight releasing documents from a meeting with President Donald Trump in November, saying that the public did not need to see them and that disclosing them would impede his ability to serve on Trump’s commission to investigate voter fraud. Kobach, who has lent support to Trump’s claims of widespread voter fraud and exaggerated instances of it in the past, made the argument with his lawyer in a Friday court filing as part of an ongoing lawsuit brought by the American Civil Liberties Union over a Kansas law requiring people to prove their citizenship to vote. As part of the lawsuit, the ACLU is requesting a Kansas federal judge unseal documents that Kobach was photographed holding when he met with Trump in November 2016, as well as a draft amendment to federal voting law, which circulated in his office. The documents contain potential amendments to the National Voter Registration Act, a 1993 law requiring motor vehicle and some other state agencies to provide opportunities to register to vote.

National: It took DEF CON hackers minutes to pwn these US voting machines | The Register

After the debacle of the 2000 presidential election count, the US invested heavily in electronic voting systems – but not, it seems, the security to protect them. This year at the DEF CON hacking conference in Las Vegas, 30 computer-powered ballot boxes used in American elections were set up in a simulated national White House race – and hackers got to work physically breaking the gear open to find out what was hidden inside. In less than 90 minutes, the first cracks in the systems’ defenses started appearing, revealing an embarrassing low level of security. Then one was hacked wirelessly. “Without question, our voting systems are weak and susceptible. Thanks to the contributions of the hacker community today, we’ve uncovered even more about exactly how,” said Jake Braun, who sold DEF CON founder Jeff Moss on the idea earlier this year. “The scary thing is we also know that our foreign adversaries – including Russia, North Korea, Iran – possess the capabilities to hack them too, in the process undermining principles of democracy and threatening our national security.”

National: U.S. elections are an easier target for Russian hackers than once thought | Los Angeles Times

When Chris Grayson pointed his Web browser in the direction of Georgia’s elections system earlier this year, what he found there shocked him. The Santa Monica cybersecurity researcher effortlessly downloaded the confidential voter file of every registered Georgian. He hit upon unprotected folders with passwords, apparently for accessing voting machines. He found the off-the-shelf software patches used to keep the system secure, several of which Grayson said could be easily infected by a savvy 15-year-old hacker. “It was like, holy smokes, this is all on the Internet with no authentication?” Grayson said in an interview. “There were so many things wrong with this.” … Among the most alarmed have been pedigreed computer security scholars, who warn that a well-timed hack of a vendor that serves multiple states could be enough to cause chaos even in systems that were thought to be walled off from one another. And they say security lapses like those in Georgia reveal the ease with which hackers can slip in.