I bought used voting machines on eBay for $100 apiece (2018)

https://www.wired.com/story/i-bought-used-voting-machines-on-ebay/

by djsumdog • 7 years ago

183 41 7 years ago

dang• 7 years ago

Url changed from https://boingboing.net/2018/10/25/windows-ce-and-usb.html, which points to this.

droithomme3• 7 years ago

It's good that people can get these and reverse engineer them, do a security audit, and publish the results (which are that they are easily hackable and insecure).

The fact that voter information is left on devices, unencrypted, that are then sold on the open market is malpractice

I disagree with him that what he describes is "voter information".

There's vote information and election information, both which are already public information and are not sensitive information at all. The machines do not have voter information on them nor does he give any evidence of it. What he describes finding was:

The information I found on the drives including candidates, precincts, and the number of votes cast on the machine, were not encrypted.

All these things are public information already.

Worse, the “Property Of” government labels were still attached, meaning someone had sold government property filled with voter information and location data online, at a low cost, with no consequences. It would be the equivalent of buying a surplus police car with the logos still on it.

When government agencies auction off surplus cars they seldom repaint them first. It's common to find them with the logos. Example:

https://www.copcarsonline.com/2018_Dodge_Charger_Largo_FL_35...

Even comes with the original light bar and the radar!

userbinator• 7 years ago

All these things are public information already

No kidding. You don't even have to buy a voting machine to get that information.

mrtnmcc• 7 years ago

to be fair, that particular example says "being marketed to Law Enforcement only".

droithomme3• 7 years ago

Well it says "Over $5000.00 in Police Equipment being marketed to Law Enforcement only." I read that as that there's optional gear that is a restricted buy, not the car itself. You could be right though. Also, no matter who buys it they'll have to remove the decals before driving since it's not going to be bought by the same agency that sold it.

A good question though is how much do you have to change before you can legally drive it?

This guy here seems to believe that driving a police car with lights and even "911" and "Dodge Law Enforcement" is Ok as long as it doesn't say the word "Police" at which point it would be impersonating a police officer.

https://www.motorauthority.com/news/1100773_driving-a-police...

In this police forum where they are discussing the issue one person notes that in California driving anything that remotely looks like a police car is illegal, and another states that in Tennessee you can drive a police car if you feel like it. So state laws perhaps vary as to whether you have to remove the decals and/or repaint the whole thing before driving a decalled surplus acquisition.

https://forum.officer.com/forum/public-forums/general-law-en...

TwoBit• 7 years ago

So the machines don't indicate who I individual voters selected?

bitwize• 7 years ago

That reminds me of how The KLF (as The Timelords) bought a used Ford Galaxie police car and used it as the "frontman" for their group, calling it Ford Timelord. They repainted the logo on the doors, but the black and white coloring is original I think and they kept the siren.

noja• 7 years ago

I disagree with him that what he describes is "voter information".

If you combine a voting machine ID from a certain time and place, can you determine with good certainty the way that a particular person voted?

bryanrasmussen• 7 years ago

if you know exactly what time the person you're targeting went to vote - maybe.

cpach• 7 years ago

Previous discussion: https://news.ycombinator.com/item?id=18306992

rmetzler• 7 years ago

Recently @hackerfantastic on Twitter has a few videos of hacked Diebold voting machines [1,2,3,4] along with a blog post [5] and the git repository [6]. From this I followed the link to a video on twitter on how to get admin access on some voting machines.[7]

[1] https://twitter.com/hackerfantastic/status/11874911773035520...

[2] https://twitter.com/hackerfantastic/status/11881873784368046...

[3] https://twitter.com/hackerfantastic/status/11872782894353899...

[4] https://twitter.com/hackerfantastic/status/11881788254876057...

[5] https://hacker.house/lab/hacking-elections-diebold-accuvote-...

[6] https://github.com/hackerhouse-opensource/electionhacking

[7] https://twitter.com/RachelTobac/status/1028437783050776576

makomk• 7 years ago

Obligatory reminder that, prior to Trump winning, Wired magazine ran a (popular, widely viral) article claiming that the idea that the vote could be rigged by hacking voting machines was a nutty conspiracy theory: https://www.wired.com/2016/10/wireds-totally-legit-guide-rig...

Like, I'm sure there are some folks whose concern about voting maching hacking isn't just a partisan tactic - especially on places like HN - but Wired magazine isn't one of them. Given that the last time this was such a major mainstream topic was after the 2004 election, well...

jdsully• 7 years ago

Ironically trump makes me feel more secure that the elections are not rigged. Nobody in the GOP, civil service, military, and intelligence communities wanted him. All were very outspoken against him throughout the primaries and even into the election.

moonbug• 7 years ago

and the US has no geopolitical adversaries of note.

OrgNet• 7 years ago

Exactly. The deep state wanted Clinton, and they failed.

icebraining• 7 years ago

On the other hand, there was this article at around the same time as that one: https://www.wired.com/2016/08/americas-voting-machines-arent...

peterkelly• 7 years ago

In 2017 someone in Canberra bought a couple of used filing cabinets from a second hand store for $10 each.

They turned out to contain hundreds of highly classified documents detailing years of cabinet discussions of successive Australian governments ("cabinet" here meaning the core group of senior ministers). This probably happened because the (filing) cabinets were locked and no-one could find the keys, so someone at parliament house got lazy and didn't dispose of them properly.

The documents were handed over to journalists and the whole saga became known as "the cabinet files".

https://www.abc.net.au/news/about/backstory/news-coverage/20...

akimball2• 7 years ago

And that much to public benefit. Governmental secrecy is the essential precondition of governmental corruption and criminality.

lhball2• 7 years ago

The conclusion that nation wide legislation would fix this is, at best, wishful thinking.

ATMs are secure because banks would lose money if they weren’t. Not because of regulation.

Regulation leads to a bare minimum of safety, not a best-in-class security.

One thing banana-republics all have in common is nationalized voting commissions. Doesn’t turn out as well as the author here suggests.

Omnitaus• 7 years ago

Banking and medical information are kept secure through federal regulations. Why should we trust the states that have already shown either their inability or unwillingness to remedy the issue?

lhball2• 7 years ago

Experian fiasco (and others that came* long before) taught us the shortcomings of these types of regulations.

Do you really feel like banking and medical records are being kept secure? If so I envy your confidence.

Compare that to the way our messages are being encrypted these days (iMessage comes to mind) and i think we’d find the regulation to be lacking.

The incentive provided by regulations (I.e. jail time or fines) doesn’t compare to incentives derived from competition, or (heaven forbid) profit.

It’s, for better or for worse, human nature.

jammygit• 7 years ago

Lowest-cost bidding among companies is going to do better? Security is often the first thing to go when your company’s survival depends on tiny margins

Hokusai• 7 years ago

ATMs are secure because banks would lose money if they weren’t. Not because of regulation.

Banking is heavely regulated. I agree that security is good business practice. But, to disregard regulations without proof is a big leap of faith.

Banking have survived thanks to government intervention. And to start with got itself in a mess because Great Depression era regulations where removed.

teh_klev• 7 years ago

ATMs are secure because banks would lose money if they weren’t

Now that's wishful thinking. Do you know how hard it is to get your money back from fraudulent transactions caused by compromised ATMs (card skimmers etc - the kinda thing Krebs routinely writes about)?

The banks don't lose their money, they lose your money, and good luck proving this in many countries around the world including the US, UK, Europe.

qrbLPHiKpiux2• 7 years ago

With voting, the simplest solution is the best solution: paper and ink. A few people to tally locally from each opposing party, report the numbers on up. Unhackable. Verifiable.

WillPostForFood• 7 years ago

At this point, you might be right this is a better solution, but it is hackable. Add or remove paper ballots, mark existing ballots with your own pen to change or invalidate it. But at least the physicality of it creates some limit on the scale of fraud.

qrbLPHiKpiux2• 7 years ago

What if each opposing party watches the box and a few other choke points for casting ones vote?

I mean, we’re only talking twice a year events!

smitop• 7 years ago

The recent Canada federal election used paper ballots (all of them have), and those attacks are mostly preventable. Ballots are counted by two people from Elections Canada, and all candidates can watch. The match up the number of ballots with the number of people crossed off on the list of people who were eligible to vote at that polling station. They also compare it to the number of ballots at the start of polling and end of polling. If votes were added or removed, those checks wouldn't work out (and there would probably be a re-vote for people who voted at that polling station). Adding marks before people vote wouldn't work since voters would probably notice, and it'd be hard to add marks between marking the ballot and it being put in the ballot box. Ballots also need to be signed by the chief returning officer.

swalls• 7 years ago

It's the best solution because attempts on it don't scale; any attempt at it requires either everyone in the room be in on the fraud (and it takes just one person to break that) and even then, going through ballots by hand takes a long time, where the crime can be found at any point due to physically being there.

E-voting? One hacker can reprogram thousands of machines, possibly not having to even be in the country, anonymously. It gets even worse when you have online voting, because then you have a whole host of potential exploits, like MITM, DDOSing targets like libraries, gathering IDs, etc. When you consider the amount of money running on elections, it's not unthinkable to consider there could be state-sponsored hackers, so there's no problem of resources there. And this is all assuming the hardware and software aren't already compromised by the manufacturers; considering we've seen compromised hardware coming from China it's a very likely possibility.

jsjohnst2• 7 years ago

The same common-sense regulations don’t exist for election systems. PCI and HIPAA are great successes that have gone a long way in protecting personally identifiable information and patient health conditions.

One of these is not like the other. ;)

PCI-DSS = Payment Card Industry Data Security Standard. It’s not a regulation (as in law), it’s a self imposed industry standard as the name implies.

HIPAA - Health Insurance Portability and Accountability Act, as in an actual law passed by Congress and signed into law by President Clinton.

While PCI can end up with huge fines and/or inability to process payment transactions for non-compliance, it’s not a law.

projektfu• 7 years ago

It could be called a regulation, however.

jsjohnst2• 7 years ago

True in retrospect, it’s an industry regulation, just not a legal regulation. Thanks for catching that!

akimball2• 7 years ago

Terrible article, perfuse with one terrible, fatal misconception: Systems openness is essential to confidence. Concealing breaches or even vulnerabilities does orders of magnitude more damage to public confidence than disclosing them and remediating them. The cover-up mentality is why the constitutional heroine Reality Winner is imprisoned & gagged.

I bought used voting machines on eBay for $100 apiece (2018)

Related Stories