4 ms·

4chan reveals online voter exploit that can be used to cancel ballots?

69 points by michannne 6y ago

3np 6y ago
They wouldn't listen https://xkcd.com/2030/ https://xkcd.com/2030/
michannne 6y ago
I would like to add that so far, the information suggests that anyone in Washington (known to use a similar system) receiving a mail-in ballot can have their mail-in ballot cancelled by a stranger on the internet before it arrives. I will update the link and title as additional information comes in. EDIT: California requires SSN, so it is not as susceptible EDIT: Oregon requires further steps, is not susceptible, there has not been any confirmation on Washington and I cannot test that myself
kache_ 6y ago
Apparently an uzbekistani anonymous user wrote a script to automate cancelling votes after the exploit was discovered. https://i.4cdn.org/g/1603000632172.jpg https://i.4cdn.org/g/1603000632172.jpg Non ephemeral link: https://web.archive.org/web/20201018061012/https://i.4cdn.org/g/1603000632172.jpg https://web.archive.org/web/20201018061012/https://i.4cdn.or...
- aspenmayer 6y ago
  https://web.archive.org/web/20201018061012/https://i.4cdn.org/g/1603000632172.jpg https://web.archive.org/web/20201018061012/https://i.4cdn.or...
dawnerd 6y ago
Actually no, this isn't voting. It's a sample digital ballot that you have to print out and return in person. I'm honestly surprised this amount of disinformation made it to the HN front page. Here's the form they think is real: http://oregonvotes.org/pages/ballots/11032020/Washington/34_BallotStyleForPrinting_304-1.html http://oregonvotes.org/pages/ballots/11032020/Washington/34_...
- michannne 6y ago
  The tweet does imply voting, but cancelling is possible, this is just the most visible tweet as of right now Ive updated the title to reflect this
  - theplague42 6y ago
    The tweet does far more than imply. Why are you posting 4Chan garbage to HackerNews? Is this even confirmed?
    - arkis22 6y ago
      If I had to pit 4chan against HN in a scavenger hunt, I would bet on 4chan. edit: in fact I think this happened. wasnt there an online quiz we lost at a couple years ago?
    - michannne 6y ago
      If you head to the website and put your name and DOB, the cancellation of your ballot after requesting a replacement is mentioned at the bottom of the page I'll add that anyone can request a replacement, and the cancellation is effective immediately
      - theplague42 6y ago
        Can you actually cancel a ballot through the online portal or not?
        evan_ 6y ago
        In Oregon you cannot cancel a ballot through the online portal, or at all
  - dawnerd 6y ago
    Where on the my vote portal does it let you cancel? Ballots have already been mailed anyways so it's a bit late for anyone to try to change anyones status.
rshnotsecure 6y ago
The robots.txt file of Oregon.gov is somewhat suspicious. There seem to be lots of hidden executable files as well as pages with GET queries. Because of the amount, I would guess some of the executable files lead to web shells. I am less sure of, but still somewhat confident, that the open GET queries might be pages where someone has discovered a SQL injection flaw. They are likely trying to prevent these pages from appearing on Google where a regular user might notice. Will try to look shortly on desktop and update further. [1] - https://www.oregon.gov/robots.txt https://www.oregon.gov/robots.txt
- TheDong 6y ago
  Honestly, it seems far more likely to me that some "SEO Expert" came through at some point and said they should optimize their searchability by making sure search-engines didn't index certain pages. Seems far more likely than that there's anything actually bad going on here. Also, jumping from "Huh, lots of robots.txt entries" to "SQL injection flaw" doesn't make sense to me. I don't see how those things are related.
exdsq 6y ago
Can someone verify this? It’s huge if true, but I thought voting was anonymous so how can someone see a vote via an online platform? Edit: Please remember there’s a lot of disinformation going around about voting in general, be extra skeptical before sharing this further because it’ll just cause more unrest about the election.
- michannne 6y ago
  Yeah, I shouldn't have jumped on the tweet, but I was able to verify on the website itself that it does notify that an existing ballot would be canceled when requesting a replacement. I've no intention of creating undue panic. I've hidden the thread and will delete it tomorrow likely.
  - exdsq 6y ago
    It’s easily done, I’ve fallen for something myself recently and started sharing it around, it is pretty tiring to be constantly alert to (probably) fake stories!
mullingitover 6y ago
This post should be removed, it's spreading highly misleading information about an ongoing election.
deleted 6y ago
[deleted]
envy2 6y ago
This is straight up FUD. Yes, you can change a printable ballot form that you then have to PRINT OUT AND RETURN before it is counted. This is no more an "exploit" than a printing a blank ballot, filling it in, and sending it in under someone else's name, or showing up at a polling place and voting as someone else. It's also fraud and a felony for anyone who does it...
- evan_ 6y ago
  Not just return it: Return it in a certified, signed ballot envelope that was mailed to a registered voter
- 2ion 6y ago
  > It's also fraud and a felony for anyone who does it... Because that stops people who are planning to tamper an election in the first place?
- SV_BubbleTime 6y ago
  Whew, well, that’s good. So the posts about how in Washington they cancel the original ballot when you go through the print process for a new one are not correct? That seemed like too obvious a flaw!
  - throwawayforce 6y ago
    The parent commentor is being strangely dismissive and they are 100% wrong. In washington merely printing out a new ballot will immediately cancel the old one. It says it on the damn website. I can't speak for Oregon, but this is not FUD. I can't imagine any good intentions from someone being so disinterested in the possibility of fraud.
    - SV_BubbleTime 6y ago
      That seems impossibly wrong! Such a glaring flaw in the system should be big news. Has anyone but 4chan written about this? I wasn’t able to find anything.
percentcer 6y ago
Why would this cancel the vote?
- theplague42 6y ago
  It won't. This is blatant misinformation.
- guidedprism 6y ago
  Depends on the state that uses this system on if it does do this. I assume to prevent people from sending in 2 ballots with the same name.
hedora 6y ago
This article shouldn’t have been flagged. Here’s a link to the Oregon authentication page for updating voter registration: https://secure.sos.state.or.us/orestar/vr/showVoterSearch.do?lang=eng&source=SOS https://secure.sos.state.or.us/orestar/vr/showVoterSearch.do... Others from Oregon confirm what this page implies: you just need name and DOB to mess up a voter’s registration. In California, to change someone’s voter registration, you also need the last four digits of their SSN and their drivers license number.
- theplague42 6y ago
  You obviously didn't even open the link. This isn't an "article." It's a twitter thread of screenshots from 4chan.
- evan_ 6y ago
  You can’t change anything on the Oregon page with only a name and DOB. You need a drivers license/ID number and that’s just to request a postcard that you have to sign and return. Please stop spreading misinformation.
- grimli333 6y ago
  It took me five minutes to verify this information about Oregon is not factual. You can see someone’s address with name and date of birth, but the site makes it clear if you register with this system that info will not be confidential. You cannot register or change address without an Oregon DMV number. I have not verified additional states. EDIT: To clarify, I only mention registration and change of address because these are the only features I can find that resemble the report in any way. There is no way to request a replacement. You can very very easily test this yourself.
  - michannne 6y ago
    This is not about registration, it is the replacement feature that can cause a ballot that has not yet been successfully validated to be invalidated.
    - 6y ago

69 points by michannne 6y ago

3np 6y ago

They wouldn't listen https://xkcd.com/2030/ https://xkcd.com/2030/

I would like to add that so far, the information suggests that anyone in Washington (known to use a similar system) receiving a mail-in ballot can have their mail-in ballot cancelled by a stranger on the internet before it arrives. I will update the link and title as additional information comes in. EDIT: California requires SSN, so it is not as susceptible EDIT: Oregon requires further steps, is not susceptible, there has not been any confirmation on Washington and I cannot test that myself

kache_ 6y ago

Apparently an uzbekistani anonymous user wrote a script to automate cancelling votes after the exploit was discovered. https://i.4cdn.org/g/1603000632172.jpg https://i.4cdn.org/g/1603000632172.jpg Non ephemeral link: https://web.archive.org/web/20201018061012/https://i.4cdn.org/g/1603000632172.jpg https://web.archive.org/web/20201018061012/https://i.4cdn.or...

aspenmayer 6y ago
https://web.archive.org/web/20201018061012/https://i.4cdn.org/g/1603000632172.jpg https://web.archive.org/web/20201018061012/https://i.4cdn.or...

dawnerd 6y ago

Actually no, this isn't voting. It's a sample digital ballot that you have to print out and return in person. I'm honestly surprised this amount of disinformation made it to the HN front page. Here's the form they think is real: http://oregonvotes.org/pages/ballots/11032020/Washington/34_BallotStyleForPrinting_304-1.html http://oregonvotes.org/pages/ballots/11032020/Washington/34_...

michannne 6y ago
The tweet does imply voting, but cancelling is possible, this is just the most visible tweet as of right now Ive updated the title to reflect this
- theplague42 6y ago
  The tweet does far more than imply. Why are you posting 4Chan garbage to HackerNews? Is this even confirmed?
  - arkis22 6y ago
    If I had to pit 4chan against HN in a scavenger hunt, I would bet on 4chan. edit: in fact I think this happened. wasnt there an online quiz we lost at a couple years ago?
  - michannne 6y ago
    If you head to the website and put your name and DOB, the cancellation of your ballot after requesting a replacement is mentioned at the bottom of the page I'll add that anyone can request a replacement, and the cancellation is effective immediately
    - theplague42 6y ago
      Can you actually cancel a ballot through the online portal or not?
      - evan_ 6y ago
        In Oregon you cannot cancel a ballot through the online portal, or at all
- dawnerd 6y ago
  Where on the my vote portal does it let you cancel? Ballots have already been mailed anyways so it's a bit late for anyone to try to change anyones status.

rshnotsecure 6y ago

The robots.txt file of Oregon.gov is somewhat suspicious. There seem to be lots of hidden executable files as well as pages with GET queries. Because of the amount, I would guess some of the executable files lead to web shells. I am less sure of, but still somewhat confident, that the open GET queries might be pages where someone has discovered a SQL injection flaw. They are likely trying to prevent these pages from appearing on Google where a regular user might notice. Will try to look shortly on desktop and update further. [1] - https://www.oregon.gov/robots.txt https://www.oregon.gov/robots.txt

TheDong 6y ago
Honestly, it seems far more likely to me that some "SEO Expert" came through at some point and said they should optimize their searchability by making sure search-engines didn't index certain pages. Seems far more likely than that there's anything actually bad going on here. Also, jumping from "Huh, lots of robots.txt entries" to "SQL injection flaw" doesn't make sense to me. I don't see how those things are related.

exdsq 6y ago

Can someone verify this? It’s huge if true, but I thought voting was anonymous so how can someone see a vote via an online platform? Edit: Please remember there’s a lot of disinformation going around about voting in general, be extra skeptical before sharing this further because it’ll just cause more unrest about the election.

michannne 6y ago
Yeah, I shouldn't have jumped on the tweet, but I was able to verify on the website itself that it does notify that an existing ballot would be canceled when requesting a replacement. I've no intention of creating undue panic. I've hidden the thread and will delete it tomorrow likely.
- exdsq 6y ago
  It’s easily done, I’ve fallen for something myself recently and started sharing it around, it is pretty tiring to be constantly alert to (probably) fake stories!

mullingitover 6y ago

This post should be removed, it's spreading highly misleading information about an ongoing election.

deleted 6y ago

[deleted]

envy2 6y ago

This is straight up FUD. Yes, you can change a printable ballot form that you then have to PRINT OUT AND RETURN before it is counted. This is no more an "exploit" than a printing a blank ballot, filling it in, and sending it in under someone else's name, or showing up at a polling place and voting as someone else. It's also fraud and a felony for anyone who does it...

evan_ 6y ago
Not just return it: Return it in a certified, signed ballot envelope that was mailed to a registered voter
2ion 6y ago
> It's also fraud and a felony for anyone who does it... Because that stops people who are planning to tamper an election in the first place?
SV_BubbleTime 6y ago
Whew, well, that’s good. So the posts about how in Washington they cancel the original ballot when you go through the print process for a new one are not correct? That seemed like too obvious a flaw!
- throwawayforce 6y ago
  The parent commentor is being strangely dismissive and they are 100% wrong. In washington merely printing out a new ballot will immediately cancel the old one. It says it on the damn website. I can't speak for Oregon, but this is not FUD. I can't imagine any good intentions from someone being so disinterested in the possibility of fraud.
  - SV_BubbleTime 6y ago
    That seems impossibly wrong! Such a glaring flaw in the system should be big news. Has anyone but 4chan written about this? I wasn’t able to find anything.

percentcer 6y ago

Why would this cancel the vote?

theplague42 6y ago
It won't. This is blatant misinformation.
guidedprism 6y ago
Depends on the state that uses this system on if it does do this. I assume to prevent people from sending in 2 ballots with the same name.

hedora 6y ago

This article shouldn’t have been flagged. Here’s a link to the Oregon authentication page for updating voter registration: https://secure.sos.state.or.us/orestar/vr/showVoterSearch.do?lang=eng&source=SOS https://secure.sos.state.or.us/orestar/vr/showVoterSearch.do... Others from Oregon confirm what this page implies: you just need name and DOB to mess up a voter’s registration. In California, to change someone’s voter registration, you also need the last four digits of their SSN and their drivers license number.

theplague42 6y ago
You obviously didn't even open the link. This isn't an "article." It's a twitter thread of screenshots from 4chan.
evan_ 6y ago
You can’t change anything on the Oregon page with only a name and DOB. You need a drivers license/ID number and that’s just to request a postcard that you have to sign and return. Please stop spreading misinformation.
grimli333 6y ago
It took me five minutes to verify this information about Oregon is not factual. You can see someone’s address with name and date of birth, but the site makes it clear if you register with this system that info will not be confidential. You cannot register or change address without an Oregon DMV number. I have not verified additional states. EDIT: To clarify, I only mention registration and change of address because these are the only features I can find that resemble the report in any way. There is no way to request a replacement. You can very very easily test this yourself.
- michannne 6y ago
  This is not about registration, it is the replacement feature that can cause a ballot that has not yet been successfully validated to be invalidated.
  - 6y ago