Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/26/2018
01:55 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail

8 Steps Toward Safer Elections

Here's some advice from leading authorities on how state and local governments can adapt to an environment where election systems will inevitably be hacked.
1 of 10

Image Source: Shutterstock via Artist_R

Image Source: Shutterstock via Artist_R

1 of 10
Comment  | 
Print  | 
Comments
Oldest First  |  Newest First  |  Threaded View
bobfrank
100%
0%
bobfrank,
User Rank: Apprentice
7/27/2018 | 7:10:47 PM
Untrusted Processing Systems, Self-Certification of Citizenship for Registration & Self-Audits by Secretaries of State Provide Untrustworthy Election Results!
Outstanding article! Unfortunately, it is just the latest in hundreds of valid articles about U.S. failures to provide trustworthy elections.  Just do web searches on "election fraud" and "elections integrity" to see some of them. 

This is a much more complex issue than the typical "voter fraud" component focused on just the voter registration elements.  Even if a 100% accurate voter registration system was implemented where only valid U.S. Citizens could register, that element would miss the most urgent need for end-to-end audit trails, chain-of-custody records and appropriate background checks on those allowed access to voting machines and within the ballot processing system.

In Nevada, our citizens task force composed of professionals has worked for almost a decade trying to stimulate interest in "Trustworthy Elections" by all levels of government and by both political parties. Check out my profile for my past expertise.

We have demonstrated that "Untrusted Processing Systems, Self-Certification of Citizenship for Registration & Self-Audits by Secretaries of State Provide Untrustworthy Election Results!"

But, so far, we have been unable to get leading government officials to make any significant improvements.  And, detected government failures and suspected fraud is never prosecuted by District Attorneys because they are prohibited from investigating the evidence.

Conduct a web search on "NevadansCAN elections integrity some voting machines allow remote access" to find some of our exhaustive research, documentation and Nevada court hearing records up through the Nevada  Supreme Court on this vital issue. 

We have tried often to amend Nevada statutes to require independent audits of the systems components before, during and after elections (proposed to be done by accredited members of the Association of Certified Fraud Examiners), but leaders of both political parties at all levels have refused to cooperate.  Imaginie if our society refused to have such certified fraud examiner reviews of banking records and government secrets! How could we trust the financial institutions?

Find some of our legislative video testimony by searching on YouTube with the words "elections integrity robert frank"

We have twice contested elections in state courts the results of the Nevada Elections System by following statutes and appealed one particularly improper ruling at the district level to the Nevada Supreme Court and been summarily dismissed. 

The President's and Vice President's federal commission on elections integrity was sabotaged and had to be terminated because of opposition by both parties.  The Federal Elections Commission and Elections Assistance Commission refuse to ensure that at least the federal elections are conducted on trustworthy systems and are independently audited by unconflicted fraud examiners. 

Does anyone have a viable way to "fix" this problem of untrustworthy election systems?  We have exhausted our list of possible ideas for action.  

Robert Frank, Chair, NevadansCAN.com, Las Vegas, Nevada
szurier210
50%
50%
szurier210,
User Rank: Moderator
7/30/2018 | 3:32:06 PM
Re: Untrusted Processing Systems, Self-Certification of Citizenship for Registration & Self-Audits by Secretaries of State Provide Untrustworthy Election Results!
Thanks very much Robert for your long comments. I don't have the answer but my expansive hope was that this story would generate some good discussion and sharing of ideas. I just think given the current state of politics in Washington a solution won't come from Washington. Average citizens, state and local governments and security people who know how to solve at least the technical issues need to be more vocal. 
orderhangtrungquoc1221
50%
50%
orderhangtrungquoc1221,
User Rank: Apprentice
8/2/2018 | 9:48:47 AM
Re: Untrusted Processing Systems, Self-Certification of Citizenship for Registration & Self-Audits by Secretaries of State Provide Untrustworthy Election Results!
tks for share
rcash
50%
50%
rcash,
User Rank: Strategist
8/2/2018 | 12:00:30 PM
Illinois and election integrity are mutually exclusive terms
"What I've been telling everyone as I speak to groups is that we have to run a successful election that people can trust even if we are hacked," says Noah Praetz, director of elections in the Cook County Clerk's Office in Illinois

When 130% more people vote in Cook county than are actually alive one could be preplexed with priorities.
  • Secure voter registration and validate the roles
  • Secure integrity with auditable chain of custody
  • Secure and isolate voting machines from tampering, verifiably.
  • TRAIN the poll personnel on best practices and validate their skills! 
  • Bring in accounting oversight at every step.

These are a few of my favorite things.
BanduraCSO
50%
50%
BanduraCSO,
User Rank: Author
8/14/2018 | 6:58:04 AM
Threat Intelligence
This article hits on a number of important points.  Part of this is basic cyber hygiene practices and it's not clear to me why the election networks themselves should be connected to the public Internet.  Threat intelligence and information sharing are very important.  We are seeing TI and info sharing become more important in guidelines like NIST Cyber Security Framework.  As the article points out a lack of skilled security staff is a challenge.  There is a newer technology called a Threat Intelligence Gateway (TIG) that gives you access to significant amounts of threat intelligence, enables you to integrate ISAC and other TI sources, and allows you to make use of TI to protect your network.  The cool thing about the TIG is that it enables organizations to access and act with enterprise grade TI without needing an army of security analysts.
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.