3 ms·

How could anyone have the ability to install a rootkit undetected on the lottery computer? Computing systems that aren't properly secured are like bank vaults l

How could anyone have the ability to install a rootkit undetected on the lottery computer? Computing systems that aren't properly secured are like bank vaults left unsecured, but in many cases they also are remotely accessible. People shouldn't be any more shocked at these exploits than the 'exploit' of an employee stealing cash from an insecure bank vault. We should expect it. It would be a honeypot if we took security seriously. For some reason people don't take the security of digital assets as seriously as security of physical assets; we don't invest the significant resources required to secure them.. How secure are voting machines, as an example? Given the enormous stakes of elections, we know what to expect.

Spooky23 11y ago
Poor internal controls. Getting internal security threats like this dealt with requires strong controls and frequent audit. That means 5x or more staff. In the old days, the lotto used ping pong balls to pick numbers and all operations were observed by a third party auditor. IMO, you need physicial processes that can be observed and understood by a layman to have a high level of assurance.
- toomuchtodo 11y ago
  Cheaper to just go back to physical processes that can be easily audited. Simple = better.
  - brianwawok 11y ago
    Is it easy to audit ping pong balls? Seems you can weight them just as easily as you can do a root kit.
    - Spooky23 11y ago
      You can write down a procedure to weigh them, measure them, document chain of custody, etc. With a computerized process, how do you assure that the code isn't tampered with? Or that the OS is tampered with? You can do it, but the average auditor from KPMG or Deloitte can't, and the people who can are hard to find.
gojomo 11y ago
Doesn't necessarily require a 'rootkit'. Maybe it's a smaller bit of subtle corruption of a random-number generator. Maybe even it's an unintentional flaw that he learned about during an audit and then decided to exploit rather than fix.
- Cyberdog 11y ago
  The prosecution is saying it's a rootkit. So either they found a rootkit, or the prosecution just though tit was a sufficiently tech-ish enough word to build a case around while hoping nobody would call them on the lack of evidence for one (the latter would not surprise me).

Spooky23 11y ago

Poor internal controls. Getting internal security threats like this dealt with requires strong controls and frequent audit. That means 5x or more staff. In the old days, the lotto used ping pong balls to pick numbers and all operations were observed by a third party auditor. IMO, you need physicial processes that can be observed and understood by a layman to have a high level of assurance.

toomuchtodo 11y ago
Cheaper to just go back to physical processes that can be easily audited. Simple = better.
- brianwawok 11y ago
  Is it easy to audit ping pong balls? Seems you can weight them just as easily as you can do a root kit.
  - Spooky23 11y ago
    You can write down a procedure to weigh them, measure them, document chain of custody, etc. With a computerized process, how do you assure that the code isn't tampered with? Or that the OS is tampered with? You can do it, but the average auditor from KPMG or Deloitte can't, and the people who can are hard to find.

gojomo 11y ago

Doesn't necessarily require a 'rootkit'. Maybe it's a smaller bit of subtle corruption of a random-number generator. Maybe even it's an unintentional flaw that he learned about during an audit and then decided to exploit rather than fix.

Cyberdog 11y ago
The prosecution is saying it's a rootkit. So either they found a rootkit, or the prosecution just though tit was a sufficiently tech-ish enough word to build a case around while hoping nobody would call them on the lack of evidence for one (the latter would not surprise me).