election cybersecurity

Tag Archive

Editorials: Utah needs to think about security above all as it buys new voting machines | Robert Gehrke/The Salt Lake Tribune

State elections officials held an open house earlier this month to demonstrate five election systems vying to replace the voting machines that have been chugging away for the past 13 years. Just a few days earlier, a group of hackers in Las Vegas took part in a demonstration of their own, designed to show how easily they could exploit the machines used around the country and potentially compromise our elections process. The results were alarming. The first voting machine was hacked within 90 minutes. By the end of the afternoon, all five had been compromised. One was reprogrammed to play Rick Astley’s 1987 hit “Never Gonna Give You Up.” The whole thing had been Rick Rolled. … Barbara Simons, president of Verified Voting, has been sounding the alarm about voting machine security — or lack thereof — for years. But even she was skeptical before the DefCon hacker exercise that the hackers would be able to compromise the machines. She was wrong. And the Russian interest in hacking election equipment makes her doubly concerned. Read More

National: Trump Election Commissioners Are Resisting Efforts to Protect Elections From Hacking | Mother Jones

The intelligence community fears that Russia’s meddling in US elections did not end in November 2016, and that when the Kremlin tries to intervene again, state and local voting systems will be a prime target. “They will be back,” former FBI Director James Comey warned in June. Many election systems would prove an easy target. Last month, hackers at the annual DEF Con conference demonstrated this vulnerability when they easily breached multiple voting machines. A 16-year-old hacked a machine in 45 minutes. In response to this threat, the Department of Homeland Security has taken a major step to protect elections by prioritizing the cybersecurity of state and local voting systems. Yet several members of President Donald Trump’s controversial election commission oppose DHS’s move, and two of them have dismissed the threat entirely as a ploy for the federal government to intrude on states’ rights. Their opposition is a signal that the commission, tasked with finding vulnerabilities in the country’s election system, is not likely to take cybersecurity seriously. On January 6, the same day that the intelligence community released a declassified report alleging Russian meddling in the election, DHS announced that it would make additional cybersecurity assistance available to states that request it. This was done by classifying election infrastructure as “critical infrastructure,” a designation that already brings heightened security measures to critical infrastructure such as dams and the electrical grid. The move means that DHS will provide risk assessments, system scanning, and other cybersecurity services to states that request them. But several election officials and experts who sit on the Presidential Advisory Commission on Election Integrity quickly condemned the designation. Read More

Illinois: Election Systems & Software Exposes Backup of Chicago Voter Roll via AWS Bucket | Threatpost

Voter registration data belonging to the entirety of Chicago’s electoral roll—1.8 million records—was found a week ago in an Amazon Web Services bucket configured for public access. The data was a backup stored in AWS by Election Systems & Software (ES&S), a voting machine and election management systems vendor based in Omaha, Nebraska. Researchers from UpGuard made the discovery last Saturday and privately reported the leak to a government regulator who connected them to the Chicago FBI field office. The FBI then notified ES&S, which immediately pulled down the data from Amazon. Amazon buckets are configured to be private by default and require some kind of authentication to access what’s stored in them. For some reason, ES&S misconfigured its bucket to public months ago, opening the possibility that others had accessed the data before UpGuard. Read More

Illinois: 1.8 million Chicago voter records exposed online | CNN

A voting machine company exposed 1.8 million Chicago voter records after misconfiguring a security setting on the server that stored them. Election Systems & Software (ES&S), the Nebraska-based voting software and election management company, confirmed the leak on Thursday. In a blog post, the company said the voter data leak contained names, addresses, birthdates, partial social security numbers and some driver’s license and state ID numbers stored in backup files on a server. Authorities alerted ES&S to the leak on Aug. 12, and the data was secured. A security researcher from UpGuard discovered the breach. The data did not contain any voting information, like the results of how someone voted. Jim Allen, a spokesman for the Chicago Board of Elections, said the leak did not contain or affect anyone’s voting ballots, which are handled by a different vendor. “We deeply regret this,” Allen said. “It was a violation of our information security protocol by the vendor.” Read More

Illinois: Info on 1.8M Chicago voters was publicly accessible, now removed from cloud service: election officials | Chicago Tribune

A file containing the names, addresses, dates of birth and other information about Chicago’s 1.8 million registered voters was published online and publicly accessible for an unknown period of time, the Chicago Board of Election Commissioners said Thursday. The acknowledgment came days after a data security researcher alerted officials to the existence of the unsecured files. The researcher found the files while conducting a search of items uploaded to Amazon Web Services, a cloud system that allows users to rent storage space and share files with certain people or the general public. The files had been uploaded by Election Systems & Software, a contractor that helps maintain Chicago’s electronic poll books. Read More

National: For decade-old flaws in voting machines, no quick fix | The Parallax

Hackers rocked the voting machines this summer. On July 28, at the first DefCon “village” dedicated to exposing weaknesses in electronic voting machines—and the first coordinated, research-based assault on EVMs in the United States since 2007—it took visitors just 80 minutes to hack the first machine. The hackers proceeded to find and penetrate multiple security vulnerabilities in each of the village’s 20 machines, representing five voting machine models, calling into question how secure machine-assisted elections are. Rep. Will Hurd (R-Texas) and Rep. Jim Langevin (D-R.I.), two of Congress’ senior cybersecurity experts, visited the village and later told hackers that they were “surprised” by how easy it was to hack voting machines. Langevin promised during the first on-stage appearance of sitting Congressmen at DefCon that when they return to Washington, D.C., “this is going to be a primary topic of conversation.” Read More

National: Election officials: ‘We are going to need more assistance’ | FCW

The Department of Homeland Security continues to work with state and local governments to protect election systems as critical infrastructure. At an Aug. 16 public meeting of the federal Election Assistance Commission, however, officials made clear that risks still remain. EAC Vice-Chairman Thomas Hicks pointed to a recent planning exercise in Albany, N.Y., as an example. That exercise, conducted in July, resulted in some surprising results that remain classified. “I found the meeting very informative, enlightening and frightening,” Hicks said. “I would encourage every state to hold a similar meeting with election officials, emergency management folks and IT officials.” Read More

National: In Ukraine, a Malware Expert Who Could Blow the Whistle on Russian Hacking | The New York Times

The hacker, known only by his online alias “Profexer,” kept a low profile. He wrote computer code alone in an apartment and quietly sold his handiwork on the anonymous portion of the internet known as the Dark Web. Last winter, he suddenly went dark entirely. Profexer’s posts, already accessible only to a small band of fellow hackers and cybercriminals looking for software tips, blinked out in January — just days after American intelligence agencies publicly identified a program he had written as one tool used in the hacking of the Democratic National Committee. But while Profexer’s online persona vanished, a flesh-and-blood person has emerged: a fearful man who the Ukrainian police said turned himself in early this year, and has now become a witness for the F.B.I. “I don’t know what will happen,” he wrote in one of his last messages posted on a restricted-access website before going to the police. “It won’t be pleasant. But I’m still alive.” It is the first known instance of a living witness emerging from the arid mass of technical detail that has so far shaped the investigation into the D.N.C. hack and the heated debate it has stirred. The Ukrainian police declined to divulge the man’s name or other details, other than that he is living in Ukraine and has not been arrested. There is no evidence that Profexer worked, at least knowingly, for Russia’s intelligence services, but his malware apparently did. Read More

Illinois: Information about 1.8 million Chicago voters exposed on Amazon server | USA Today

Names, addresses, dates of birth and other information about Chicago’s 1.8 million registered voters was left exposed and publicly available online on an Amazon cloud-computing server for an unknown period of time, the Chicago Board of Election Commissions said. The database file was discovered on Friday by a security researcher at Upguard, a company that evaluates cyber risk. The company alerted election officials in Chicago on Saturday and the file was taken down three hours later. The exposure was first made public on Thursday. The database was not overseen by the Chicago Board of Election but instead Election Systems & Software, an Omaha, Neb.-based contractor that provides election equipment and software. Read More

National: Will U.S. Cyberwarriors Be Ready for the Next Big Hack? | RealClearDefense

Hackers around the world see weaknesses in U.S. voting systems, electric grids and other pillars of American society. Russia’s alleged election meddling and other high-profile breaches have created a heightened sense of vulnerability even as new gee-whiz technologies to keep hackers at bay flood the market. To deter future attacks, experts warn, the United States needs to shore up its defenses and upend the perception that its systems are easy prey. “I guarantee the North Koreans and the Iranians saw what the Russians did and they’re going to try things in 2018 and 2020,” said former Pentagon cybersecurity policy chief Eric Rosenbach. “We have to change the perception that they’re going to get away with that,” he said at an industry conference last month. Read More