4 ms·

This is terrifying. Full stop.

ganoushoreilly 8y ago
Every electronic device is hackable with physical access. Every process that has humans involved is exploitable. I'm more alarmed at the number of people willing to complain and moan about change, yet refuse to volunteer at their local polling station. If awareness is important, we have to start somewhere, yet the vast majority of people complaining expect it to just solve itself. Sometimes to fix a broken system you have to become a part of it and change from the inside.
- TheDong 8y ago
  > Every electronic device is hackable with physical access. Every process that has humans involved is exploitable. This is a useless statement. Security is a continuum, and it's perfectly valid to point out voting machines suck on that continuum. I store my private key on a yubikey, and sure if you had physical access and spent about $300k you could decap it and recover the private key (with a success rate of maybe 10%, an expensive hardware lab, and expertise only a handful of people have). That's a whole different ballpark from voting machines which don't use a hardware TPM [0] to attest votes, but instead store them in csvs while running windows CE such that an attacker with a jumpdrive can plug it in and alter records using exploits which have been public for years and years. > Sometimes to fix a broken system you have to become a part of it and change from the inside. Unfortunately, various people have tried to change it with no success. The voting machine companies have contracts with the government that preclude new entrants to the business. Security researchers who contact voting machine companies have no impact. Technology such as TPMs exist, but the voting machine vendors have little apparent interest in these new ideas and technologies. I don't think it's fair to discount other commentors from providing information and discussing their views just because they're unwilling to go into politics to attempt to fix this silly government contracts (with a low chance of succeeding) [0]: https://en.wikipedia.org/wiki/Trusted_Platform_Module https://en.wikipedia.org/wiki/Trusted_Platform_Module
  - ganoushoreilly 8y ago
    "That's a whole different ballpark from voting machines which don't use a hardware TPM [0] to attest votes, but instead store them in csvs while running windows CE such that an attacker with a jumpdrive can plug it in and alter records." you're not getting any of these access with out modifying hardware at the poling station. If poll monitoring is being performed, they're going to notice someone taking apart a voting machine. I was at the Voter Village, Two years in a row I spent time disassembling the machines. They're not as easy as you're making it out. Being a part of monitoring of these systems is not something stopped by big business. That's a cop out. TPM should be a part of medical devices, but it's not. I would argue that's even more important than a voting machine. Unless you work for a manufacturer or are building a voting machine with these systems, sitting around and saying you could do X or Y doesn't solve a damn thing.
- auslander 8y ago
  > Every electronic device is hackable with physical access. iOS 11+ Apple devices are pretty much not.

Every electronic device is hackable with physical access. Every process that has humans involved is exploitable. I'm more alarmed at the number of people willing to complain and moan about change, yet refuse to volunteer at their local polling station. If awareness is important, we have to start somewhere, yet the vast majority of people complaining expect it to just solve itself. Sometimes to fix a broken system you have to become a part of it and change from the inside.

TheDong 8y ago
> Every electronic device is hackable with physical access. Every process that has humans involved is exploitable. This is a useless statement. Security is a continuum, and it's perfectly valid to point out voting machines suck on that continuum. I store my private key on a yubikey, and sure if you had physical access and spent about $300k you could decap it and recover the private key (with a success rate of maybe 10%, an expensive hardware lab, and expertise only a handful of people have). That's a whole different ballpark from voting machines which don't use a hardware TPM [0] to attest votes, but instead store them in csvs while running windows CE such that an attacker with a jumpdrive can plug it in and alter records using exploits which have been public for years and years. > Sometimes to fix a broken system you have to become a part of it and change from the inside. Unfortunately, various people have tried to change it with no success. The voting machine companies have contracts with the government that preclude new entrants to the business. Security researchers who contact voting machine companies have no impact. Technology such as TPMs exist, but the voting machine vendors have little apparent interest in these new ideas and technologies. I don't think it's fair to discount other commentors from providing information and discussing their views just because they're unwilling to go into politics to attempt to fix this silly government contracts (with a low chance of succeeding) [0]: https://en.wikipedia.org/wiki/Trusted_Platform_Module https://en.wikipedia.org/wiki/Trusted_Platform_Module
- ganoushoreilly 8y ago
  "That's a whole different ballpark from voting machines which don't use a hardware TPM [0] to attest votes, but instead store them in csvs while running windows CE such that an attacker with a jumpdrive can plug it in and alter records." you're not getting any of these access with out modifying hardware at the poling station. If poll monitoring is being performed, they're going to notice someone taking apart a voting machine. I was at the Voter Village, Two years in a row I spent time disassembling the machines. They're not as easy as you're making it out. Being a part of monitoring of these systems is not something stopped by big business. That's a cop out. TPM should be a part of medical devices, but it's not. I would argue that's even more important than a voting machine. Unless you work for a manufacturer or are building a voting machine with these systems, sitting around and saying you could do X or Y doesn't solve a damn thing.
auslander 8y ago
> Every electronic device is hackable with physical access. iOS 11+ Apple devices are pretty much not.