3 ms·

> Barnes testified that the server that holds the data that Georgia’s 159 counties use to build their ballots is “air-gapped,” or isolated from the Internet. Bu

by danso 8y ago

> Barnes testified that the server that holds the data that Georgia’s 159 counties use to build their ballots is “air-gapped,” or isolated from the Internet. But he acknowledged that he uses a thumb drive to transfer ballot proofs from the server to his desktop computer, which he uses for email. From there, he moves the data to a Dropbox-like site, where counties can retrieve the ballot data. Anyone know what "ballot proofs" refers to? I hope that's not just a fancy terminology for a tab-delimited text file that contains the voting totals. I wonder what "Dropbox-like" site actually refers to -- a cloud site created in-house by the state government? Or by a contractor that ostensibly specializes and is authorized (i.e. fills out the paperwork and background checks) to sell a file-transfer app that's basically a wrapper around a commercial cloud service?

xmasgator 8y ago
In design a "proof" is a preview of the final design. That's probably what he's referring to. A final-ish draft of the ballot for review by the stakeholders.
- danso 8y ago
  That makes the most sense on the face of it, especially in the preceding context of "Barnes testified that the server that holds the data that Georgia's 159 counties use to build their ballots". It's possible that the reporter conflates this "ballot data" on the "Dropbox-like site" with actual voting tallies. Such a site for the election center to upload ballot proofs sounds reasonable, although I question why such a site would need to be "air-gapped". The data to build ballots would presumably contain entirely public information (e.g. the serialized info of which candidates are running for which parties in which races). But even if these details about ballot proofs isn't relevant to the main point, Mr. Barnes's testimony is still concerning. He's the director of the state's centralized elections system, after all. Last year, when Lamb notified the state of the data breach, Barnes "wrote of blacklisting Lamb from accessing the website before changing his mind and ordering scans of the system". [0] That the vulnerability stemmed from Drupalmageddon is even more troubling, because it's not as if Lamb's claims were hard to verify, given how well-publicized Drupalmageddon had been at that point. It's also worth noting that I haven't seen any read about how the elections center receives the actual vote data. The stories I've read so far -- including this WaPo article -- have only referenced voter registration data. Having this data breached via arbitrary code execution is still a big deal, if the site is used to verify voter eligibility, but AFAIK, it's (hopefully) not the same system and database that holds vote data. (Voter registration data contains personal info, but some states actually publish it online. in machine-readable format even) [0] https://www.mcclatchydc.com/news/politics-government/article216031450.html https://www.mcclatchydc.com/news/politics-government/article...
cmiles74 8y ago
I understand that they need a way to transfer data to and from the machine that builds the ballots but the method outlined above doesn't fill me with a lot of confidence. Barnes freely admitted that their desktop computer handles their email and that they use a thumb drive to transfer data from that desktop computer to the "air gapped" ballot build server. If his desktop becomes infected with a virus of some kind, isn't it straightforward for that virus to infect the thumb drive and then to infect this server that builds the ballots? My understanding is that most "air gapped" machines lack USB ports or have those ports plugged so as to discourage their use. In terms of what they should be using to transfer data, that is outside of my wheelhouse. But the current system seems ripe for exploitation by a third party dedicated to gaining access to this machine that builds the ballots.
- darpa_escapee 8y ago
  Yes, and since he's outed himself a point of failure, he's sure to be subject to spear phishing campaigns.
- wool_gather 8y ago
  > isn't it straightforward for that virus to infect the thumb drive Maybe not "straightforward", but, yes, absolutely, that would be a very likely vector. As I understand it, this is how the Stuxnet worm was designed (the one that sabotaged the Iranian centrifuges).
5874-4b22-a4e0 8y ago
Dropbox-like site: Pastebin

by danso 8y ago

xmasgator 8y ago

In design a "proof" is a preview of the final design. That's probably what he's referring to. A final-ish draft of the ballot for review by the stakeholders.

danso 8y ago
That makes the most sense on the face of it, especially in the preceding context of "Barnes testified that the server that holds the data that Georgia's 159 counties use to build their ballots". It's possible that the reporter conflates this "ballot data" on the "Dropbox-like site" with actual voting tallies. Such a site for the election center to upload ballot proofs sounds reasonable, although I question why such a site would need to be "air-gapped". The data to build ballots would presumably contain entirely public information (e.g. the serialized info of which candidates are running for which parties in which races). But even if these details about ballot proofs isn't relevant to the main point, Mr. Barnes's testimony is still concerning. He's the director of the state's centralized elections system, after all. Last year, when Lamb notified the state of the data breach, Barnes "wrote of blacklisting Lamb from accessing the website before changing his mind and ordering scans of the system". [0] That the vulnerability stemmed from Drupalmageddon is even more troubling, because it's not as if Lamb's claims were hard to verify, given how well-publicized Drupalmageddon had been at that point. It's also worth noting that I haven't seen any read about how the elections center receives the actual vote data. The stories I've read so far -- including this WaPo article -- have only referenced voter registration data. Having this data breached via arbitrary code execution is still a big deal, if the site is used to verify voter eligibility, but AFAIK, it's (hopefully) not the same system and database that holds vote data. (Voter registration data contains personal info, but some states actually publish it online. in machine-readable format even) [0] https://www.mcclatchydc.com/news/politics-government/article216031450.html https://www.mcclatchydc.com/news/politics-government/article...

cmiles74 8y ago

I understand that they need a way to transfer data to and from the machine that builds the ballots but the method outlined above doesn't fill me with a lot of confidence. Barnes freely admitted that their desktop computer handles their email and that they use a thumb drive to transfer data from that desktop computer to the "air gapped" ballot build server. If his desktop becomes infected with a virus of some kind, isn't it straightforward for that virus to infect the thumb drive and then to infect this server that builds the ballots? My understanding is that most "air gapped" machines lack USB ports or have those ports plugged so as to discourage their use. In terms of what they should be using to transfer data, that is outside of my wheelhouse. But the current system seems ripe for exploitation by a third party dedicated to gaining access to this machine that builds the ballots.

darpa_escapee 8y ago
Yes, and since he's outed himself a point of failure, he's sure to be subject to spear phishing campaigns.
wool_gather 8y ago
> isn't it straightforward for that virus to infect the thumb drive Maybe not "straightforward", but, yes, absolutely, that would be a very likely vector. As I understand it, this is how the Stuxnet worm was designed (the one that sabotaged the Iranian centrifuges).

5874-4b22-a4e0 8y ago

Dropbox-like site: Pastebin