3 ms·

TL;DR from the title. 11 year old uses sql injection to change the election results on a voting machine at defcon. In reading the headline I was expecting they

TL;DR from the title. 11 year old uses sql injection to change the election results on a voting machine at defcon. In reading the headline I was expecting they would explain it within the first few paragraphs but instead buried what the kid did in the last 5 sentences of the article. Like most of us though still alarms me that these machines are in use and have some easily exploitable vulnerabilities but as mentioned by one of the vendors in the article some/most of these exploits require physical access to the voting machine. Not to take way from the exploits but it would be pretty obvious if someone was doing this (plugging a device into the voting machine) on election day.

em3rgent0rdr 8y ago
> "it would be pretty obvious if someone was doing this (plugging a device into the voting machine) on election day." Poll workers (or someone posing as a poll worker) could easily do this and it wouldn't be noticed as suspicious because poll workers are naturally assumed to be allowed to interact with the poll machines. "What are you doing there?" "Oh, just updating the firmware to protect against a new zero-day threat."
- humantiy 8y ago
  Interact sure, but on election day no way would they be 'updating the firmware'. From my own personal experience there is always more than one person watching or hands-on the polling machines. I'm sure some places are probably more lax than my experience. There is also variance in where you vote what machine they might have. My location has always been a scantron type and only one device per voting location. You'd have to know ahead of time what device is used where and have the correct exploit handy. Still in my scenario going to be hard to pull off an exploit while people are waiting to enter their ballots into the machine. Not saying it couldn't be done but I'd say it is out there for a probable attack. They do make for good headlines and of course are something no one wants to see tampered with. I'm glad the one's in my district still have a paper trail, which has been used in the past to verify votes by hand when the election was close.

em3rgent0rdr 8y ago

> "it would be pretty obvious if someone was doing this (plugging a device into the voting machine) on election day." Poll workers (or someone posing as a poll worker) could easily do this and it wouldn't be noticed as suspicious because poll workers are naturally assumed to be allowed to interact with the poll machines. "What are you doing there?" "Oh, just updating the firmware to protect against a new zero-day threat."

humantiy 8y ago
Interact sure, but on election day no way would they be 'updating the firmware'. From my own personal experience there is always more than one person watching or hands-on the polling machines. I'm sure some places are probably more lax than my experience. There is also variance in where you vote what machine they might have. My location has always been a scantron type and only one device per voting location. You'd have to know ahead of time what device is used where and have the correct exploit handy. Still in my scenario going to be hard to pull off an exploit while people are waiting to enter their ballots into the machine. Not saying it couldn't be done but I'd say it is out there for a probable attack. They do make for good headlines and of course are something no one wants to see tampered with. I'm glad the one's in my district still have a paper trail, which has been used in the past to verify votes by hand when the election was close.