4 ms·

Brazilian Electronic Voting Machines use Intel Atom CPUs. Any backdoor found in microcode for these is going to be a big event.

dyingkneepad 4y ago
There are SO many easier attack vectors for the urna eletrônica that you don't need to worry about this. I'm not implying there is anybody actually attacking them, but if I were to commit election fraud I wouldn't look at low level microcode backdoors.
- hulitu 4y ago
  Why not ? This would be the perfect election interference.
  - sroussey 4y ago
    Hack the tabulating machines. So much easier and they are the only ones that humans actually look at.
    - walterbell 4y ago
      Why not both?
      - thrashh 4y ago
        Cuz ultimately everything costs some money to do (and even your own time is money) and we’re all trying to do the most possible with the least amount of money
        walterbell 4y ago
        If an attacker already has sunk costs in successfully compromising both in a different market, then both isn't a new cost, it's two new markets. As for "why both", see recent attempts to audit electronic voting systems.
      - Brian_K_White 4y ago
        Because you can't cause the cpu's microcode to be updated with your hacked code by magic, and what you can do with a hacked cpu directly, and without being instantly oticed, is actually pretty limited. The way you'd get use out of it would be for some tiny single bit flip or extra op change in the cpus behavior to invoke some other larger thing, like run an execurable that wouldn't otherwise have been run, or make a region of memory readable or writable that wouldn't normally, or allow an instruction that wouldn't normally etc.., and in all of those cases you need something else installed and ready to make use of the cpu hack. But if you can arrange to insert that other stuff, then the job is already done and playing with something exotic like this is just stupid. If you have the means to use this, then you already have the means to do 500 other simpler and more useful things. It's like replacing the locks on someone's car so that you can make your own key work in it too. Sure, cool, but you already stole their entire car or at least had access to it in the shop, and could just copy their normal key if you want access again later, for much cheaper, in much less time, and much less risk of detection.
        walterbell 4y ago
        Exploitation of an existing bugdoor is statistically more likely than a backdoor, and does not require updating any microcode. Once identified and exploited, bugs may be removed in a future microcode revision, as with all other forms of firmware and software.
- hammock 4y ago
  To my knowledge there is no evidence of widespread voter machine fraud. Perhaps it is unwise to spread ideas suggesting an election system could possibly be compromised
  - reese_john 4y ago
    Absence of evidence is not evidence of absence. Not that I believe that widespread fraud has happened before, but electronic voting is inherently flawed, there is no reason why a coordinated attack couldn't happen in the future.
  - dyingkneepad 4y ago
    I agree with you, and that's why I didn't spread disinformation suggesting an election system may be compromised. I just stated that the attack surface for something like this is quite big. Edit: I'm also definitely not saying that paper voting is better than urna eletrônica. Both methods have big attack surfaces.
    - hammock 4y ago
      Maybe I misunderstood you. The attack surface for American elections is quite big also, but there is no widespread election fraud that I'm aware of
      - Brian_K_White 4y ago
        I'm not aware of that cancer that is probably killing me right now. There is no valid argument for trusting electronic voting machines. While they are still closed source like now, it is flatly impossible and not even slightly rational to trust them. If they ever become open and auditable and verifyable, well then you are no longer trusting them. Talking about "large, coordinated" is an irrelevant distraction. Maybe there have been and maybe there haven't been any such attempted to date, but you have no way to know and so your awareness means nothing, and on top of that, every minute is a new minute. There is no valid argument for trusting these things as they currently exist. Whether you think any elections have been changed doesn't even matter.
Tozen 4y ago
When there are no paper ballots or printing of ballot receipts, I take it that the quiet intent is not to have a paper trail so that election fraud can be more easily hidden or for plausible deniability. Often, such methods, are to be used against the votes of minority groups or minority parties.

dyingkneepad 4y ago

There are SO many easier attack vectors for the urna eletrônica that you don't need to worry about this. I'm not implying there is anybody actually attacking them, but if I were to commit election fraud I wouldn't look at low level microcode backdoors.

hulitu 4y ago
Why not ? This would be the perfect election interference.
- sroussey 4y ago
  Hack the tabulating machines. So much easier and they are the only ones that humans actually look at.
  - walterbell 4y ago
    Why not both?
    - thrashh 4y ago
      Cuz ultimately everything costs some money to do (and even your own time is money) and we’re all trying to do the most possible with the least amount of money
      - walterbell 4y ago
        If an attacker already has sunk costs in successfully compromising both in a different market, then both isn't a new cost, it's two new markets. As for "why both", see recent attempts to audit electronic voting systems.
    - Brian_K_White 4y ago
      Because you can't cause the cpu's microcode to be updated with your hacked code by magic, and what you can do with a hacked cpu directly, and without being instantly oticed, is actually pretty limited. The way you'd get use out of it would be for some tiny single bit flip or extra op change in the cpus behavior to invoke some other larger thing, like run an execurable that wouldn't otherwise have been run, or make a region of memory readable or writable that wouldn't normally, or allow an instruction that wouldn't normally etc.., and in all of those cases you need something else installed and ready to make use of the cpu hack. But if you can arrange to insert that other stuff, then the job is already done and playing with something exotic like this is just stupid. If you have the means to use this, then you already have the means to do 500 other simpler and more useful things. It's like replacing the locks on someone's car so that you can make your own key work in it too. Sure, cool, but you already stole their entire car or at least had access to it in the shop, and could just copy their normal key if you want access again later, for much cheaper, in much less time, and much less risk of detection.
      - walterbell 4y ago
        Exploitation of an existing bugdoor is statistically more likely than a backdoor, and does not require updating any microcode. Once identified and exploited, bugs may be removed in a future microcode revision, as with all other forms of firmware and software.
hammock 4y ago
To my knowledge there is no evidence of widespread voter machine fraud. Perhaps it is unwise to spread ideas suggesting an election system could possibly be compromised
- reese_john 4y ago
  Absence of evidence is not evidence of absence. Not that I believe that widespread fraud has happened before, but electronic voting is inherently flawed, there is no reason why a coordinated attack couldn't happen in the future.
- dyingkneepad 4y ago
  I agree with you, and that's why I didn't spread disinformation suggesting an election system may be compromised. I just stated that the attack surface for something like this is quite big. Edit: I'm also definitely not saying that paper voting is better than urna eletrônica. Both methods have big attack surfaces.
  - hammock 4y ago
    Maybe I misunderstood you. The attack surface for American elections is quite big also, but there is no widespread election fraud that I'm aware of
    - Brian_K_White 4y ago
      I'm not aware of that cancer that is probably killing me right now. There is no valid argument for trusting electronic voting machines. While they are still closed source like now, it is flatly impossible and not even slightly rational to trust them. If they ever become open and auditable and verifyable, well then you are no longer trusting them. Talking about "large, coordinated" is an irrelevant distraction. Maybe there have been and maybe there haven't been any such attempted to date, but you have no way to know and so your awareness means nothing, and on top of that, every minute is a new minute. There is no valid argument for trusting these things as they currently exist. Whether you think any elections have been changed doesn't even matter.

Tozen 4y ago

When there are no paper ballots or printing of ballot receipts, I take it that the quiet intent is not to have a paper trail so that election fraud can be more easily hidden or for plausible deniability. Often, such methods, are to be used against the votes of minority groups or minority parties.