News & Commentary

9/14/2018
10:30 AM
Jasson Casey
Jasson Casey
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail vvv
50%
50%

Cybersecurity Is Only 1 Part of Election Security

Protecting the 2018 election cycle means fixing the information infrastructure.

The DEF CON 2018 Voting Machine Hacking Village aimed to raise awareness in voting security through a full day of speakers and panel discussions along with a challenge for attendees to hack more than 30 pieces of voting equipment. A partnership with rOOtz Asylum offered youths between 8 and 16 years old an opportunity to hack replicas of the websites of secretaries of state to demonstrate that even hackers with limited years of experience can easily compromise critical systems. The goal was to break as many voting machine pieces as possible in order to draw attention to the vulnerabilities that will be present in the upcoming 2018 elections.

The focus on election equipment, however, ignores the greater danger caused by hacking into the diverse collection of sensitive information that flows through political campaigns and the electoral process, and using that to influence and sow distrust among voters. While changing a vote or voting results can be traced back to a particular stakeholder, changing people's understanding of facts is far more insidious.

What Security Risks Do Election Machines and Vendors Pose?
Election machines create two points of vulnerability. First, the voting machines provide a direct line to infiltrate and control votes, manipulating the election at its most basic level. Second, malicious actors can affect the integrity of the results just by planting the seed of potential tampering of election machines in the minds of voters, creating public distrust in the democratic process.

Third-party vendors typically are used to recording votes through one company, tally in another, and, possibly, aggregate in a third. Affecting the data integrity at any one of these vendors places the election results at risk.

What Is the "Election Ecosystem"?
The election ecosystem refers to state actors and the actual voter base along with think tanks, super PACs, political parties, election officials, lobbyists, and other invested groups. Voters rely on publicly available information to make their decisions, and this information needs to be secured.

The ecosystem presents a large attack surface and is a rich environment for exfiltrated data that could be used in an information campaign, such as compromising (in public) or coercing (in private) actors within the system.

What Types of Security Risks Exist within the Election Ecosystem?
Network security, DNS health, and patching cadence are the largest security concerns for governmental stakeholders.

Network Security
Many state and local governments leave their networks exposed to the Internet by not applying best practices to firewalls, intrusion-detection systems, packet-filtering routers, and advanced network threat-detection systems.

Endpoint Security
Exploit kits can be easily purchased on the Dark Web. They focus on outdated, insecure browser and operating systems to execute client-side exploitation attacks. While the federal government’s infrastructure budget increased, state and local governments remain underfunded. Most nongovernmental organizations continue to use outdated software to maintain compatibility with antiquated infrastructure, and the replacement cost for an entirely updated infrastructure outpaces their budget.

Patching Cadence
Most governmental stakeholders use outdated software and devices where patching updates may no longer be available. Additionally, underfunded IT departments get overwhelmed trying to maintain a regular patching cadence.

How Do Adversaries Use the Important Information They Siphoned?
They can use the information gained from specifically target individuals and organizations to coerce the campaign, or they release the information to swing public opinion to benefit their goals. Conspiracy theorists used John Podesta's spearphished emails to undermine his authority by spreading rumors across fake news sites and falsely connect high-ranking Democratic Party officials to a child-sex ring. Despite this theory being debunked, the information influenced the course of the election.

Even if the hacker’s candidate of-choice is not elected, the information's integrity becomes a distraction as authority figures are discredited, creating social and political instability. This pattern of information campaign sabotage is easily replicated. My last quarterly Center for Strategic International and Studies (CSIS) Cybersecurity fellows meeting was consumed with understanding where and when this will occur next. It is a leading conversation for security and policy professionals this year.

How Can We Protect the Election Ecosystem from the Biggest Risks?
Political information campaigns have existed for over 3,000 years. The cyber landscape makes espionage and information wars more efficient by removing physical proximity and access requirements. In Watergate, the malicious actors needed physical proximity and access to obtain the information. Today, they access information remotely, expanding the threat parameters.

Protecting the 2018 election cycle requires fixing the information infrastructure. Voters need to worry less about the election machines and more about the security of the organizations from where malicious actors obtain information. 

The vulnerabilities in state and local government security need to be addressed so that the indirect influence of hackers can be restrained. Additionally, nongovernmental organizations need help improving their cybersecurity posture.

However, none of the cybersecurity issues alone can protect the elections without finding a dampening solution for the use of social media as an accelerant to spread false information. Official government actors and private political stakeholders need to protect their data environments to begin rebuilding the trust that ensures election integrity.

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Jasson Casey serves as Chief Technology Officer at SecurityScorecard and leads the company's engineering efforts. Casey is an 18-year veteran of the telecom and computer networking industry. Most recently, he managed the engineering team for IronNet CyberSecurity, a security ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How the US Chooses Which Zero-Day Vulnerabilities to Stockpile
Ricardo Arroyo, Senior Technical Product Manager, Watchguard Technologies,  1/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3906
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials to access the badge system database and modify its contents.
CVE-2019-3907
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and password).
CVE-2019-3908
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups can decrypt them and obtain sensitive data.
CVE-2019-3909
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention.
CVE-2019-3910
PUBLISHED: 2019-01-18
Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device.