Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
4 Practical Measures to Improve Election Security Now
Threaded  |  Newest First  |  Oldest First
wa3gin
50%
50%
wa3gin,
User Rank: Apprentice
9/17/2018 | 6:40:00 PM
The Election Process 4 Practical Measures...
Thank You for you artilce.  

In a prior life I was the CISO of Arlington County, VA.  In that county we have a non-profit FM-LP radio station WERA that has a weekly program dedicated to Practical Cyber Security.  I have co-hosted a few programs.  

We did an in-depth review of the voting process in the State of Virginia and those three 30 min programs are ON-DEMAND on MIX-CLOUD or you can go to www.practicalsecurityradio.com to get links to stream the programs.  One program was dedicate to the hardware usedv and the other two were interviews with the deputy registrar of Arlington. These are pure content and commercial free programs.  They are eye-openers for people who are clueless about how the wheels turn in local and state government elections! I'd hope you and your readers will listen to these programs to get a fair and accurate view of how the process actually works.

The DEFCON spin about hacking the laptops is not helpful. Those were surplused PCs no longer used and for hackers to gain access to the actual PCs used they would have to crash through the school gym walls where the voters were standing in line to gain access.  

On Voting Day, during the voting process those PCs are basically just tabulators, counting votes. The totals at the voting booths at the gym are called into the registrar's office, the PCs are never connected to the Internet.  The Registrar collects the totals and phones those into the State.  At no time do these PCs touch the Internet during the election process.

Sadly, it is valid that State databases can be hacked and data currupted. But that doesn't ruin the election because if you and I have our names removed  or currupted we can always use  a written form to cast our vote and it will be counted.  This is called a provisional vote. I used one last year because I moved from one city to a county.

Now it is true that the State databases are not 100% accurate and this occurs due to the nature of the process; because people move from state to state.  There is no fool-proof process to track constituent movement between states.  If you leave California and settle in UTAH. Then register in UTAH, you can vote in UTAH however your name is still in the California database.  Some states have a check-box at the bottom of voter registration forms that allow you to say what state you left.  If you check that box your current state will notify the state you left... however, this process is not provisioned across all the states.  If you are in the military for example you could very well be in several state databases, however, you can only realistically vote in the state where you are currently a resident.  I suppose if you had three addresses in three states whose boundaries were within driving distance you could drive to all three and try to vote if you maintained those addresses in your name and paid taxes, etc.... so your two extra votes would not come close to effecting the national election!

I would add a fifth measure to your four, that being all states require registrants to indicate what state they left. At least that way the politicians can't claim there are thousands of people registered in multiple places, etc.

Thanks again for the article.

 

 

 


Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21257
PUBLISHED: 2021-06-18
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations in the Contiki-NG operating system versions prior to 4.6 do not validate the address pointer in the RPL source routing header This makes it possible for an attac...
CVE-2021-21279
PUBLISHED: 2021-06-18
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-service attack by triggering an infinite loop in the processing of IPv6 neighbor solicitation (NS) messages. This type of attack can effectively ...
CVE-2021-21280
PUBLISHED: 2021-06-18
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write in versions of Contiki-NG prior to 4.6 when transmitting a 6LoWPAN packet with a chain of extension headers. Unfortunately, the written header is not checked t...
CVE-2021-21281
PUBLISHED: 2021-06-18
Contiki-NG is an open-source, cross-platform operating system for internet of things devices. A buffer overflow vulnerability exists in Contiki-NG versions prior to 4.6. After establishing a TCP socket using the tcp-socket library, it is possible for the remote end to send a packet with a data offse...
CVE-2021-21410
PUBLISHED: 2021-06-18
Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent to devices running Contiki-NG 4.6 and prior. The IPv6 header decompression function (<code>uncompress_hdr_iphc</code>) does not pe...