6 ms·

Are voting-machine modems truly divorced from the Internet?

39 points by DiabloD3 9y ago

randomerr 9y ago
Landline modems are by far the most secure. But even those modems call out to fiber optic cables that run on the same switches as the internet and cellular networks. ISDN modems a communication protocol that uses something like block chain technology is the best we can offer. ISDN give use speed (less chance to get intercepted) and data validation that audio modems just don't. Those option aside, physically shipping the units in armored trucks with tamper tapes installed and physical tapes as a backup is the best option.
- Retric 9y ago
  Key exchange is a non issue with these systems making secure SSL connections viable. However, I don't think they actually need modems in the first place. IMO, they are ideally purely independent boxes, simply print a receipt or even just display their output. A few pictures of the output in the hands of observers and 'tampering' after that point becomes pointless.
gruez 9y ago
>Even easier than hacking through router bugs is just setting up an imposter cell-phone “tower” near the voting machine; one commonly used brand of these, used by many police departments, is called “Stingray.” am i too optimistic to assume that the voting machines at least use TLS?
- dnet 9y ago
  That's mostly irrelevant, since that only protects the integrity and confidentiality of that TCP connection. However, you can still exploit the vulnerabilities of all the services listening on the device. Separating voting machine networks from the internet is orthogonal to the problem of network protocol hardening between endpoints within this "separated" network.
- Spooky23 9y ago
  That's not a very scalable hack. As dnet mentioned, that only protects the session data -- never assume that the device is setup securely or even competently. There are plenty of stories out there about traffic controls that are hooked to unsecured Mifi devices. [1] There will be remote management ports or other ways to access the device. The other thing where router hacking is productive is that the typical "secure connectivity" solution offered by carriers for this sort of application is MPLS. Compromising the router with something like this makes it even easier for a entity that compromises the network to identify the traffic that is of interest! [1] https://arstechnica.com/information-technology/2014/08/researchers-find-its-terrifyingly-easy-to-hack-traffic-lights/ https://arstechnica.com/information-technology/2014/08/resea...
Justsignedup 9y ago
I think the tl;dr is: security is hard. Really hard. In fact anyone who trivializes the complexity of keeping voting secure (including congress) is not understanding it.
zellyn 9y ago
I'm sure there are ridiculous penalties for interfering with actual elections, but I can't help feeling that what we need with electronic voting machines is for someone to hack them to only pick Democrats. Within 3 hours, Republicans would be calling for paper-only ballots, and sanity would have prevailed.
- westbywest 9y ago
  The article mentions optical-scan machines, i.e. machines that tally paper ballots.
  - zellyn 9y ago
    Ah, didn't catch that. Thanks!
  - crankylinuxuser 9y ago
    Those have always bugged me. Ok, so I fill out this scantron sheet, but how do I know that the computer interpreted the results I filled out? How do I know that some goof on the paper invalidated a vote? I'd like some sort of verification and 2 clicky buttons with VOTE/NO VOTE test upon seeing the scanned results. I guess I expect too much here...
    - westbywest 9y ago
      Nothing is going to measure pencil marks perfectly, but scantron technology is decades old. Sloppy pencil usage wouldn't inhibit manual inspection of paper ballots, e.g. during a recount, but one does have to define some expected threshold of competency for voters using the ballots.
    - ShorsHammer 9y ago
      While probably scary and a non-starter for some have often wanted a key stretched hash of a voters id number/vote/salt as a public record (possibly also stamped into a blockchain) and able to be checked by the voter holding the salt and no one else. Once you put a ballot paper in a box you have no idea whether it was properly counted or lost. There's the inevitable issue of cryprographic advances and forward secrecy, which wouldn't sit well with some people for fair reason, anonymous voting is a cornerstone of democracy. Personally wouldnt mind my vote being public a few decades after the fact but not before then. Electronic voting has a bad reputation here but there's certainly room for improvement on paper only.
ravenstine 9y ago
Why are they connected to any network at all? Why aren't they just used to tally votes?
- craftyguy 9y ago
  Because voters "need" to know results as soon as possible. (they actually don't need to know, but they think they do)
- Spooky23 9y ago
  It saves money. Remember that board of elections are funded at the county level by a county legislature and usually managed by two party hacks as election commissioners. Usually these orgs are usually starved of cash or starved of political will to act.
- willstrafach 9y ago
  According to the company, they are connected to this private network only to upload the unofficial tally.
eli 9y ago
This supports my long held belief that one of the best thing we could do for improving vote administration is convincing the public to be patient with results. There's no particular reason everyone needs to know the results of a competitive state-wide race the same night the polls close, yet we are making all kinds of security and other tradeoffs to support this as a goal.
- nerdponx 9y ago
  This had never occurred to me, but in hindsight it's really obvious. I'll start socializing this idea among people I know.
- skrause 9y ago
  Just do it like the Germans where there are no more voting machines, just paper ballots, and you have the election result within a few hours. There is really no reason for voting machines at all.
  - westbywest 9y ago
    Indeed touchscreen voting machines have well documented security flaws, but the article mentions optical-scan machines by ES&S. That is, machines that scan paper ballots. Paper ballots would be reviewed by humans during recounts, or if doubts arise over the tallies, but maybe not if election officials have no reason to be doubtful.
- makomk 9y ago
  This requires convincing the press to treat the results as something we don't need to know immediately, which goes against their fundamental nature. Good luck.
  - eli 9y ago
    The press is only giving people what they want
- MaxBarraclough 9y ago

39 points by DiabloD3 9y ago

Landline modems are by far the most secure. But even those modems call out to fiber optic cables that run on the same switches as the internet and cellular networks. ISDN modems a communication protocol that uses something like block chain technology is the best we can offer. ISDN give use speed (less chance to get intercepted) and data validation that audio modems just don't. Those option aside, physically shipping the units in armored trucks with tamper tapes installed and physical tapes as a backup is the best option.

Retric 9y ago
Key exchange is a non issue with these systems making secure SSL connections viable. However, I don't think they actually need modems in the first place. IMO, they are ideally purely independent boxes, simply print a receipt or even just display their output. A few pictures of the output in the hands of observers and 'tampering' after that point becomes pointless.

gruez 9y ago

>Even easier than hacking through router bugs is just setting up an imposter cell-phone “tower” near the voting machine; one commonly used brand of these, used by many police departments, is called “Stingray.” am i too optimistic to assume that the voting machines at least use TLS?

dnet 9y ago
That's mostly irrelevant, since that only protects the integrity and confidentiality of that TCP connection. However, you can still exploit the vulnerabilities of all the services listening on the device. Separating voting machine networks from the internet is orthogonal to the problem of network protocol hardening between endpoints within this "separated" network.
Spooky23 9y ago
That's not a very scalable hack. As dnet mentioned, that only protects the session data -- never assume that the device is setup securely or even competently. There are plenty of stories out there about traffic controls that are hooked to unsecured Mifi devices. [1] There will be remote management ports or other ways to access the device. The other thing where router hacking is productive is that the typical "secure connectivity" solution offered by carriers for this sort of application is MPLS. Compromising the router with something like this makes it even easier for a entity that compromises the network to identify the traffic that is of interest! [1] https://arstechnica.com/information-technology/2014/08/researchers-find-its-terrifyingly-easy-to-hack-traffic-lights/ https://arstechnica.com/information-technology/2014/08/resea...

Justsignedup 9y ago

I think the tl;dr is: security is hard. Really hard. In fact anyone who trivializes the complexity of keeping voting secure (including congress) is not understanding it.

zellyn 9y ago

I'm sure there are ridiculous penalties for interfering with actual elections, but I can't help feeling that what we need with electronic voting machines is for someone to hack them to only pick Democrats. Within 3 hours, Republicans would be calling for paper-only ballots, and sanity would have prevailed.

westbywest 9y ago
The article mentions optical-scan machines, i.e. machines that tally paper ballots.
- zellyn 9y ago
  Ah, didn't catch that. Thanks!
- crankylinuxuser 9y ago
  Those have always bugged me. Ok, so I fill out this scantron sheet, but how do I know that the computer interpreted the results I filled out? How do I know that some goof on the paper invalidated a vote? I'd like some sort of verification and 2 clicky buttons with VOTE/NO VOTE test upon seeing the scanned results. I guess I expect too much here...
  - westbywest 9y ago
    Nothing is going to measure pencil marks perfectly, but scantron technology is decades old. Sloppy pencil usage wouldn't inhibit manual inspection of paper ballots, e.g. during a recount, but one does have to define some expected threshold of competency for voters using the ballots.
  - ShorsHammer 9y ago
    While probably scary and a non-starter for some have often wanted a key stretched hash of a voters id number/vote/salt as a public record (possibly also stamped into a blockchain) and able to be checked by the voter holding the salt and no one else. Once you put a ballot paper in a box you have no idea whether it was properly counted or lost. There's the inevitable issue of cryprographic advances and forward secrecy, which wouldn't sit well with some people for fair reason, anonymous voting is a cornerstone of democracy. Personally wouldnt mind my vote being public a few decades after the fact but not before then. Electronic voting has a bad reputation here but there's certainly room for improvement on paper only.

ravenstine 9y ago

Why are they connected to any network at all? Why aren't they just used to tally votes?

craftyguy 9y ago
Because voters "need" to know results as soon as possible. (they actually don't need to know, but they think they do)
Spooky23 9y ago
It saves money. Remember that board of elections are funded at the county level by a county legislature and usually managed by two party hacks as election commissioners. Usually these orgs are usually starved of cash or starved of political will to act.
willstrafach 9y ago
According to the company, they are connected to this private network only to upload the unofficial tally.

eli 9y ago

This supports my long held belief that one of the best thing we could do for improving vote administration is convincing the public to be patient with results. There's no particular reason everyone needs to know the results of a competitive state-wide race the same night the polls close, yet we are making all kinds of security and other tradeoffs to support this as a goal.

nerdponx 9y ago
This had never occurred to me, but in hindsight it's really obvious. I'll start socializing this idea among people I know.
skrause 9y ago
Just do it like the Germans where there are no more voting machines, just paper ballots, and you have the election result within a few hours. There is really no reason for voting machines at all.
- westbywest 9y ago
  Indeed touchscreen voting machines have well documented security flaws, but the article mentions optical-scan machines by ES&S. That is, machines that scan paper ballots. Paper ballots would be reviewed by humans during recounts, or if doubts arise over the tallies, but maybe not if election officials have no reason to be doubtful.
makomk 9y ago
This requires convincing the press to treat the results as something we don't need to know immediately, which goes against their fundamental nature. Good luck.
- eli 9y ago
  The press is only giving people what they want
MaxBarraclough 9y ago