When the password for a voting machine is “abcde” and can’t be changed, the integrity of our democracy might be in trouble. The Advanced Voting Solutions WinVote machine, dubbed “America’s worst voting machine,” came equipped with this simple password even as it was used in some of the country’s most important elections. AVS went out of business in 2007, but Virginia used its insecure machines until 2015 before dropping them for scrap metal. That means this vulnerable hunk of technology was used in three presidential elections, starting with George W. Bush’s re-election in 2004 to Barack Obama’s in 2012. In addition to Virginia, Pennsylvania and Mississippi used the WinVote without knowing all the ways it could be hacked. Unlike other technology — your phone, your laptop, connected cars — security wasn’t really a focus.
Google and Apple invite hackers to find flaws in their code and offer hefty rewards to those who find them. It’s a common practice in the industry. The government’s done it too, with programs like “Hack the Pentagon.” But opportunities to test how secure our voting machines are from hackers have been rare. Manufacturers like to keep the details of voting machines secret. And they don’t often provide machines for people to test.
That’s why hackers swarmed to the Voter Hacking Village at Defcon in Las Vegas. The massive hacker convention is split into “villages” based on themes such as lock picking, encryption, social engineering and, for the first time, voter machine hacking.
Defcon received more than 30 voting machines to play with, providing a rare opportunity for hackers to find the flaws in our democracy’s technology. (The organizers didn’t specify how many models the 30 units represented.) Voting technology was elevated into the political spotlight in 2016 as lawmakers raised concerns about Russian hacking and President Donald Trump’s road to the White House.
Full Article: Defcon hackers break voting machines easily with old exploits – CNET.