6 ms·

I bought used voting machines on eBay for $100 apiece (2018)

183 points by djsumdog 7y ago

dang 7y ago
Url changed from https://boingboing.net/2018/10/25/windows-ce-and-usb.html https://boingboing.net/2018/10/25/windows-ce-and-usb.html, which points to this.
lhball 7y ago
The conclusion that nation wide legislation would fix this is, at best, wishful thinking. ATMs are secure because banks would lose money if they weren’t. Not because of regulation. Regulation leads to a bare minimum of safety, not a best-in-class security. One thing banana-republics all have in common is nationalized voting commissions. Doesn’t turn out as well as the author here suggests.
- Omnitaus 7y ago
  Banking and medical information are kept secure through federal regulations. Why should we trust the states that have already shown either their inability or unwillingness to remedy the issue?
  - lhball 7y ago
    Experian fiasco (and others that came* long before) taught us the shortcomings of these types of regulations. Do you really feel like banking and medical records are being kept secure? If so I envy your confidence. Compare that to the way our messages are being encrypted these days (iMessage comes to mind) and i think we’d find the regulation to be lacking. The incentive provided by regulations (I.e. jail time or fines) doesn’t compare to incentives derived from competition, or (heaven forbid) profit. It’s, for better or for worse, human nature.
- deleted 7y ago
  [deleted]
- jammygit 7y ago
  Lowest-cost bidding among companies is going to do better? Security is often the first thing to go when your company’s survival depends on tiny margins
- Hokusai 7y ago
  > ATMs are secure because banks would lose money if they weren’t. Not because of regulation. Banking is heavely regulated. I agree that security is good business practice. But, to disregard regulations without proof is a big leap of faith. Banking have survived thanks to government intervention. And to start with got itself in a mess because Great Depression era regulations where removed.
- teh_klev 7y ago
  > ATMs are secure because banks would lose money if they weren’t Now that's wishful thinking. Do you know how hard it is to get your money back from fraudulent transactions caused by compromised ATMs (card skimmers etc - the kinda thing Krebs routinely writes about)? The banks don't lose their money, they lose your money, and good luck proving this in many countries around the world including the US, UK, Europe.
droithomme 7y ago
It's good that people can get these and reverse engineer them, do a security audit, and publish the results (which are that they are easily hackable and insecure). > The fact that voter information is left on devices, unencrypted, that are then sold on the open market is malpractice I disagree with him that what he describes is "voter information". There's vote information and election information, both which are already public information and are not sensitive information at all. The machines do not have voter information on them nor does he give any evidence of it. What he describes finding was: > The information I found on the drives including candidates, precincts, and the number of votes cast on the machine, were not encrypted. All these things are public information already. > Worse, the “Property Of” government labels were still attached, meaning someone had sold government property filled with voter information and location data online, at a low cost, with no consequences. It would be the equivalent of buying a surplus police car with the logos still on it. When government agencies auction off surplus cars they seldom repaint them first. It's common to find them with the logos. Example: https://www.copcarsonline.com/2018_Dodge_Charger_Largo_FL_35020052.veh https://www.copcarsonline.com/2018_Dodge_Charger_Largo_FL_35... Even comes with the original light bar and the radar!
- userbinator 7y ago
  All these things are public information already No kidding. You don't even have to buy a voting machine to get that information.
- mrtnmcc 7y ago
  to be fair, that particular example says "being marketed to Law Enforcement only".
  - droithomme 7y ago
    Well it says "Over $5000.00 in Police Equipment being marketed to Law Enforcement only." I read that as that there's optional gear that is a restricted buy, not the car itself. You could be right though. Also, no matter who buys it they'll have to remove the decals before driving since it's not going to be bought by the same agency that sold it. A good question though is how much do you have to change before you can legally drive it? This guy here seems to believe that driving a police car with lights and even "911" and "Dodge Law Enforcement" is Ok as long as it doesn't say the word "Police" at which point it would be impersonating a police officer. https://www.motorauthority.com/news/1100773_driving-a-police-car-six-things-you-should-know https://www.motorauthority.com/news/1100773_driving-a-police... In this police forum where they are discussing the issue one person notes that in California driving anything that remotely looks like a police car is illegal, and another states that in Tennessee you can drive a police car if you feel like it. So state laws perhaps vary as to whether you have to remove the decals and/or repaint the whole thing before driving a decalled surplus acquisition. https://forum.officer.com/forum/public-forums/general-law-enforcement-topics/80484-civilains-driving-used-police-cars https://forum.officer.com/forum/public-forums/general-law-en...
cpach 7y ago
Previous discussion: https://news.ycombinator.com/item?id=18306992 https://news.ycombinator.com/item?id=18306992
rmetzler 7y ago
Recently @hackerfantastic on Twitter has a few videos of hacked Diebold voting machines [1,2,3,4] along with a blog post [5] and the git repository [6]. From this I followed the link to a video on twitter on how to get admin access on some voting machines.[7] [1]: https://twitter.com/hackerfantastic/status/1187491177303552002 https://twitter.com/hackerfantastic/status/11874911773035520... [2]: https://twitter.com/hackerfantastic/status/1188187378436804610 https://twitter.com/hackerfantastic/status/11881873784368046... [3]: https://twitter.com/hackerfantastic/status/1187278289435389952 https://twitter.com/hackerfantastic/status/11872782894353899... [4]: https://twitter.com/hackerfantastic/status/1188178825487605760 https://twitter.com/hackerfantastic/status/11881788254876057... [5]: https://hacker.house/lab/hacking-elections-diebold-accuvote-tsx-runs-space-invaders/ https://hacker.house/lab/hacking-elections-diebold-accuvote-... [6]: https://github.com/hackerhouse-opensource/electionhacking https://github.com/hackerhouse-opensource/electionhacking [7]: https://twitter.com/RachelTobac/status/1028437783050776576 https://twitter.com/RachelTobac/status/1028437783050776576
makomk 7y ago
Obligatory reminder that, prior to Trump winning, Wired magazine ran a (popular, widely viral) article claiming that the idea that the vote could be rigged by hacking voting machines was a nutty conspiracy theory: https://www.wired.com/2016/10/wireds-totally-legit-guide-rigging-presidential-election/ https://www.wired.com/2016/10/wireds-totally-legit-guide-rig... Like, I'm sure there are some folks whose concern about voting maching hacking isn't just a partisan tactic - especially on places like HN - but Wired magazine isn't one of them. Given that the last time this was such a major mainstream topic was after the 2004 election, well...
- jdsully 7y ago
  Ironically trump makes me feel more secure that the elections are not rigged. Nobody in the GOP, civil service, military, and intelligence communities wanted him. All were very outspoken against him throughout the primaries and even into the election.
  - moonbug 7y ago
    and the US has no geopolitical adversaries of note.
    - 1000units 7y ago
      You think they have more influence over the American public than the parties the parent listed?
      - netsharc 7y ago
        Well, apparently through Facebook ads they did... And apparently you only needed to flip 4000 votes in swing states to secure the electoral college numbers... 4000 targeted ads on Facebook, how much did that cost? Cambridge Analytica knows.
        tsimionescu 7y ago
        > Well, apparently through Facebook ads they did... Where did you get that idea? We know from the Mueller report that they indeed paid to try to influence the election, but the sums were tiny compared to what the actual candidates paid. Also, please remember that Cambridge Analytica was hired by Trump ('s people) , not the Russians.
peterkelly 7y ago
In 2017 someone in Canberra bought a couple of used filing cabinets from a second hand store for $10 each. They turned out to contain hundreds of highly classified documents detailing years of cabinet discussions of successive Australian governments ("cabinet" here meaning the core group of senior ministers). This probably happened because the (filing) cabinets were locked and no-one could find the keys, so someone at parliament house got lazy and didn't dispose of them properly. The documents were handed over to journalists and the whole saga became known as "the cabinet files". https://www.abc.net.au/news/about/backstory/news-coverage/2018-02-03/the-cabinet-files-and-how-they-were-found/9393008 https://www.abc.net.au/news/about/backstory/news-coverage/20...
- akimball 7y ago
  And that much to public benefit. Governmental secrecy is the essential precondition of governmental corruption and criminality.
qrbLPHiKpiux 7y ago
With voting, the simplest solution is the best solution: paper and ink. A few people to tally locally from each opposing party, report the numbers on up. Unhackable. Verifiable.
- WillPostForFood 7y ago
  At this point, you might be right this is a better solution, but it is hackable. Add or remove paper ballots, mark existing ballots with your own pen to change or invalidate it. But at least the physicality of it creates some limit on the scale of fraud.
  - qrbLPHiKpiux 7y ago
    What if each opposing party watches the box and a few other choke points for casting ones vote? I mean, we’re only talking twice a year events!
  - smitop 7y ago
    The recent Canada federal election used paper ballots (all of them have), and those attacks are mostly preventable. Ballots are counted by two people from Elections Canada, and all candidates can watch. The match up the number of ballots with the number of people crossed off on the list of people who were eligible to vote at that polling station. They also compare it to the number of ballots at the start of polling and end of polling. If votes were added or removed, those checks wouldn't work out (and there would probably be a re-vote for people who voted at that polling station). Adding marks before people vote wouldn't work since voters would probably notice, and it'd be hard to add marks between marking the ballot and it being put in the ballot box. Ballots also need to be signed by the chief returning officer.
- swalls 7y ago
  It's the best solution because attempts on it don't scale; any attempt at it requires either everyone in the room be in on the fraud (and it takes just one person to break that) and even then, going through ballots by hand takes a long time, where the crime can be found at any point due to physically being there. E-voting? One hacker can reprogram thousands of machines, possibly not having to even be in the country, anonymously. It gets even worse when you have online voting, because then you have a whole host of potential exploits, like MITM, DDOSing targets like libraries, gathering IDs, etc. When you consider the amount of money running on elections, it's not unthinkable to consider there could be state-sponsored hackers, so there's no problem of resources there. And this is all assuming the hardware and software aren't already compromised by the manufacturers; considering we've seen compromised hardware coming from China it's a very likely possibility.
jsjohnst 7y ago
> The same common-sense regulations don’t exist for election systems. PCI and HIPAA are great successes that have gone a long way in protecting personally identifiable information and patient health conditions. One of these is not like the other. ;) PCI-DSS = Payment Card Industry Data Security Standard. It’s not a regulation (as in law), it’s a self imposed industry standard as the name implies. HIPAA - Health Insurance Portability and Accountability Act, as in an actual law passed by Congress and signed into law by President Clinton. While PCI can end up with huge fines and/or inability to process payment transactions for non-compliance, it’s not a law.
- projektfu 7y ago
  It could be called a regulation, however.
  - jsjohnst 7y ago
    True in retrospect, it’s an industry regulation, just not a legal regulation. Thanks for catching that!
akimball 7y ago
Terrible article, perfuse with one terrible, fatal misconception: Systems openness is essential to confidence. Concealing breaches or even vulnerabilities does orders of magnitude more damage to public confidence than disclosing them and remediating them. The cover-up mentality is why the constitutional heroine Reality Winner is imprisoned & gagged.

183 points by djsumdog 7y ago

dang 7y ago

Url changed from https://boingboing.net/2018/10/25/windows-ce-and-usb.html https://boingboing.net/2018/10/25/windows-ce-and-usb.html, which points to this.

lhball 7y ago

The conclusion that nation wide legislation would fix this is, at best, wishful thinking. ATMs are secure because banks would lose money if they weren’t. Not because of regulation. Regulation leads to a bare minimum of safety, not a best-in-class security. One thing banana-republics all have in common is nationalized voting commissions. Doesn’t turn out as well as the author here suggests.

Omnitaus 7y ago
Banking and medical information are kept secure through federal regulations. Why should we trust the states that have already shown either their inability or unwillingness to remedy the issue?
- lhball 7y ago
  Experian fiasco (and others that came* long before) taught us the shortcomings of these types of regulations. Do you really feel like banking and medical records are being kept secure? If so I envy your confidence. Compare that to the way our messages are being encrypted these days (iMessage comes to mind) and i think we’d find the regulation to be lacking. The incentive provided by regulations (I.e. jail time or fines) doesn’t compare to incentives derived from competition, or (heaven forbid) profit. It’s, for better or for worse, human nature.
deleted 7y ago
[deleted]
jammygit 7y ago
Lowest-cost bidding among companies is going to do better? Security is often the first thing to go when your company’s survival depends on tiny margins
Hokusai 7y ago
> ATMs are secure because banks would lose money if they weren’t. Not because of regulation. Banking is heavely regulated. I agree that security is good business practice. But, to disregard regulations without proof is a big leap of faith. Banking have survived thanks to government intervention. And to start with got itself in a mess because Great Depression era regulations where removed.
teh_klev 7y ago
> ATMs are secure because banks would lose money if they weren’t Now that's wishful thinking. Do you know how hard it is to get your money back from fraudulent transactions caused by compromised ATMs (card skimmers etc - the kinda thing Krebs routinely writes about)? The banks don't lose their money, they lose your money, and good luck proving this in many countries around the world including the US, UK, Europe.

droithomme 7y ago

It's good that people can get these and reverse engineer them, do a security audit, and publish the results (which are that they are easily hackable and insecure). > The fact that voter information is left on devices, unencrypted, that are then sold on the open market is malpractice I disagree with him that what he describes is "voter information". There's vote information and election information, both which are already public information and are not sensitive information at all. The machines do not have voter information on them nor does he give any evidence of it. What he describes finding was: > The information I found on the drives including candidates, precincts, and the number of votes cast on the machine, were not encrypted. All these things are public information already. > Worse, the “Property Of” government labels were still attached, meaning someone had sold government property filled with voter information and location data online, at a low cost, with no consequences. It would be the equivalent of buying a surplus police car with the logos still on it. When government agencies auction off surplus cars they seldom repaint them first. It's common to find them with the logos. Example: https://www.copcarsonline.com/2018_Dodge_Charger_Largo_FL_35020052.veh https://www.copcarsonline.com/2018_Dodge_Charger_Largo_FL_35... Even comes with the original light bar and the radar!

userbinator 7y ago
All these things are public information already No kidding. You don't even have to buy a voting machine to get that information.
mrtnmcc 7y ago
to be fair, that particular example says "being marketed to Law Enforcement only".
- droithomme 7y ago
  Well it says "Over $5000.00 in Police Equipment being marketed to Law Enforcement only." I read that as that there's optional gear that is a restricted buy, not the car itself. You could be right though. Also, no matter who buys it they'll have to remove the decals before driving since it's not going to be bought by the same agency that sold it. A good question though is how much do you have to change before you can legally drive it? This guy here seems to believe that driving a police car with lights and even "911" and "Dodge Law Enforcement" is Ok as long as it doesn't say the word "Police" at which point it would be impersonating a police officer. https://www.motorauthority.com/news/1100773_driving-a-police-car-six-things-you-should-know https://www.motorauthority.com/news/1100773_driving-a-police... In this police forum where they are discussing the issue one person notes that in California driving anything that remotely looks like a police car is illegal, and another states that in Tennessee you can drive a police car if you feel like it. So state laws perhaps vary as to whether you have to remove the decals and/or repaint the whole thing before driving a decalled surplus acquisition. https://forum.officer.com/forum/public-forums/general-law-enforcement-topics/80484-civilains-driving-used-police-cars https://forum.officer.com/forum/public-forums/general-law-en...

cpach 7y ago

Previous discussion: https://news.ycombinator.com/item?id=18306992 https://news.ycombinator.com/item?id=18306992

rmetzler 7y ago

Recently @hackerfantastic on Twitter has a few videos of hacked Diebold voting machines [1,2,3,4] along with a blog post [5] and the git repository [6]. From this I followed the link to a video on twitter on how to get admin access on some voting machines.[7] [1]: https://twitter.com/hackerfantastic/status/1187491177303552002 https://twitter.com/hackerfantastic/status/11874911773035520... [2]: https://twitter.com/hackerfantastic/status/1188187378436804610 https://twitter.com/hackerfantastic/status/11881873784368046... [3]: https://twitter.com/hackerfantastic/status/1187278289435389952 https://twitter.com/hackerfantastic/status/11872782894353899... [4]: https://twitter.com/hackerfantastic/status/1188178825487605760 https://twitter.com/hackerfantastic/status/11881788254876057... [5]: https://hacker.house/lab/hacking-elections-diebold-accuvote-tsx-runs-space-invaders/ https://hacker.house/lab/hacking-elections-diebold-accuvote-... [6]: https://github.com/hackerhouse-opensource/electionhacking https://github.com/hackerhouse-opensource/electionhacking [7]: https://twitter.com/RachelTobac/status/1028437783050776576 https://twitter.com/RachelTobac/status/1028437783050776576

makomk 7y ago

Obligatory reminder that, prior to Trump winning, Wired magazine ran a (popular, widely viral) article claiming that the idea that the vote could be rigged by hacking voting machines was a nutty conspiracy theory: https://www.wired.com/2016/10/wireds-totally-legit-guide-rigging-presidential-election/ https://www.wired.com/2016/10/wireds-totally-legit-guide-rig... Like, I'm sure there are some folks whose concern about voting maching hacking isn't just a partisan tactic - especially on places like HN - but Wired magazine isn't one of them. Given that the last time this was such a major mainstream topic was after the 2004 election, well...

jdsully 7y ago
Ironically trump makes me feel more secure that the elections are not rigged. Nobody in the GOP, civil service, military, and intelligence communities wanted him. All were very outspoken against him throughout the primaries and even into the election.
- moonbug 7y ago
  and the US has no geopolitical adversaries of note.
  - 1000units 7y ago
    You think they have more influence over the American public than the parties the parent listed?
    - netsharc 7y ago
      Well, apparently through Facebook ads they did... And apparently you only needed to flip 4000 votes in swing states to secure the electoral college numbers... 4000 targeted ads on Facebook, how much did that cost? Cambridge Analytica knows.
      - tsimionescu 7y ago
        > Well, apparently through Facebook ads they did... Where did you get that idea? We know from the Mueller report that they indeed paid to try to influence the election, but the sums were tiny compared to what the actual candidates paid. Also, please remember that Cambridge Analytica was hired by Trump ('s people) , not the Russians.

peterkelly 7y ago

In 2017 someone in Canberra bought a couple of used filing cabinets from a second hand store for $10 each. They turned out to contain hundreds of highly classified documents detailing years of cabinet discussions of successive Australian governments ("cabinet" here meaning the core group of senior ministers). This probably happened because the (filing) cabinets were locked and no-one could find the keys, so someone at parliament house got lazy and didn't dispose of them properly. The documents were handed over to journalists and the whole saga became known as "the cabinet files". https://www.abc.net.au/news/about/backstory/news-coverage/2018-02-03/the-cabinet-files-and-how-they-were-found/9393008 https://www.abc.net.au/news/about/backstory/news-coverage/20...

akimball 7y ago
And that much to public benefit. Governmental secrecy is the essential precondition of governmental corruption and criminality.

qrbLPHiKpiux 7y ago

With voting, the simplest solution is the best solution: paper and ink. A few people to tally locally from each opposing party, report the numbers on up. Unhackable. Verifiable.

WillPostForFood 7y ago
At this point, you might be right this is a better solution, but it is hackable. Add or remove paper ballots, mark existing ballots with your own pen to change or invalidate it. But at least the physicality of it creates some limit on the scale of fraud.
- qrbLPHiKpiux 7y ago
  What if each opposing party watches the box and a few other choke points for casting ones vote? I mean, we’re only talking twice a year events!
- smitop 7y ago
  The recent Canada federal election used paper ballots (all of them have), and those attacks are mostly preventable. Ballots are counted by two people from Elections Canada, and all candidates can watch. The match up the number of ballots with the number of people crossed off on the list of people who were eligible to vote at that polling station. They also compare it to the number of ballots at the start of polling and end of polling. If votes were added or removed, those checks wouldn't work out (and there would probably be a re-vote for people who voted at that polling station). Adding marks before people vote wouldn't work since voters would probably notice, and it'd be hard to add marks between marking the ballot and it being put in the ballot box. Ballots also need to be signed by the chief returning officer.
swalls 7y ago
It's the best solution because attempts on it don't scale; any attempt at it requires either everyone in the room be in on the fraud (and it takes just one person to break that) and even then, going through ballots by hand takes a long time, where the crime can be found at any point due to physically being there. E-voting? One hacker can reprogram thousands of machines, possibly not having to even be in the country, anonymously. It gets even worse when you have online voting, because then you have a whole host of potential exploits, like MITM, DDOSing targets like libraries, gathering IDs, etc. When you consider the amount of money running on elections, it's not unthinkable to consider there could be state-sponsored hackers, so there's no problem of resources there. And this is all assuming the hardware and software aren't already compromised by the manufacturers; considering we've seen compromised hardware coming from China it's a very likely possibility.

jsjohnst 7y ago

> The same common-sense regulations don’t exist for election systems. PCI and HIPAA are great successes that have gone a long way in protecting personally identifiable information and patient health conditions. One of these is not like the other. ;) PCI-DSS = Payment Card Industry Data Security Standard. It’s not a regulation (as in law), it’s a self imposed industry standard as the name implies. HIPAA - Health Insurance Portability and Accountability Act, as in an actual law passed by Congress and signed into law by President Clinton. While PCI can end up with huge fines and/or inability to process payment transactions for non-compliance, it’s not a law.

projektfu 7y ago
It could be called a regulation, however.
- jsjohnst 7y ago
  True in retrospect, it’s an industry regulation, just not a legal regulation. Thanks for catching that!

akimball 7y ago

Terrible article, perfuse with one terrible, fatal misconception: Systems openness is essential to confidence. Concealing breaches or even vulnerabilities does orders of magnitude more damage to public confidence than disclosing them and remediating them. The cover-up mentality is why the constitutional heroine Reality Winner is imprisoned & gagged.