Kids as young as 7 hack into election systems at DEFCON event
Hacking convention shows vulnerabilities still exist three months before Election Day
Hacking convention shows vulnerabilities still exist three months before Election Day
Hacking convention shows vulnerabilities still exist three months before Election Day
With Election Day less than three months away, the Hearst Television National Investigative Unit has learned security vulnerabilities still remain in how you cast your ballot and get the results.
And children are exposing some of the potential exploits.
In Las Vegas this past weekend, kids as young as 7 years old managed to manipulate replicas of election night results pages in key battleground states from 2016; pages built, organizers say, using actual vulnerabilities previously reported.
Yonatan Lensky, an 11 year-old from Nashua, New Hampshire, who won the award for his age group for "social engineering," was asked if the hack was pretty easy.
"Yeah," he quickly responded, while peering over a laptop computer and wearing small Ray Ban glasses. To prove it, Lensky made it appear as if a journalist won the election -- with 87 billion votes.
Bianca Lewis, an 11 year-old from New Jersey, was asked for her message to the American people. Looking directly at the camera and using a raised voice, she replied, "WORK ON YOUR COMPUTER SECURITY PEOPLE!"'
Meet the kid hackers
Jake Braun, the CEO of Cambridge Global Advisors, helped organize the Vote Hacking Village at this year's DEFCON, the world's largest convention of hackers. Over the course of three days, hundreds of them scanned, manipulated and sabotaged nine different types of actual voting equipment.
"This is not make believe," he said during interview in Las Vegas. "This is stuff that's actually happened."
Brad Evans, a hacker who tried to exploit one of the pieces of voting equipment at DEFCON, said that he was doing so because, "I want to help secure these things."
Among the flaws hackers at DEFCON say they found:
- A voting scanner and tabulator -- still used in up to 24 states, according to the group Verified Voting -- with no password or software verification to prevent it from being overridden,
- A touchscreen voting machine that hackers reprogrammed to play music and animated clips.
- An electronic poll book machine that signs in voters on Election Day hacked in five seconds, potentially exposing "unencoded" personal information on voters.
Even though 100 local election officials came to DEFCON, the National Association of Secretaries of State, in a statement the day before the event began, criticized the hacking as a "pseudo environment" that "in no way replicates" accurate protections.
"Our main concern with the approach taken by DEFCON is that it utilizes a pseudo environment which in no way replicates state election systems, networks or physical security. Providing conference attendees with unlimited physical access to voting machines, most of which are no longer in use, does not replicate accurate physical and cyber protections established by state and local governments before and on Election Day," the statement read.
Hearst Television reached out to two of the biggest manufacturers in the industry, Dominion Voting and Election Systems & Software (ES&S).
In a statement, Dominion cautioned that it provides "best practices for the physical security of our systems, which do need to be followed to ensure the integrity of the unit."
ES&S replied that "security is a top priority" and that "physically accessing these machines in a polling place would be difficult, if not impossible. Having said that, we welcome the input from the voting village and constantly work to bolster security using input from a variety of experts."
"Any assertions about resistance to input on security are simply untrue - for decades ES&S has worked with leading experts in security, and in partnership with jurisdictions across the nation, ES&S has been successful in protecting the voting process," the company’s statement said.
Braun, the Vote Hacking Village organizer, addressed the criticism that the environment at DEFCON is not realistic.
"Many of the local elections officials take this defensive posture and think we're criticizing them. I'm like: 'We're not criticizing them.' We're saying, 'Hey, look: the game has changed.' It's not about them. It's about protecting our democracy," Braun said.
Even if a voting machine is not hacked or ever connected to the internet, there are ways to affect the results, researchers say.
John Sebes of the Open Source Election Technology (OSET) Institute in Silicon Valley set up for us a replica tally manager, software that adds up results from the precincts after the polls close. OSET built the replica using input from elections officials.
We timed how long it would take to change the winner using a single disc with malicious software brought back from a mock polling place, where the machines were never connected to the internet.
It took 22 seconds.
"We think these are very important systems and deserve the very best - not only in security, but engineering and in design and experience of the people. They're that important," Sebes said in an interview.
But so far, not all systems are the "very best."
This week, a group of independent cybersecurity researchers announced they found nearly one out of every three candidates for the U.S. House of Representatives have campaign websites with "some sort of security error."
Also this week, the federal government ran its first-ever tabletop, mock election exercise to spot potential problems before Election Day.
DHS Assistant Secretary for Cybersecurity, Jeanette Manfra, told the National Investigative Unit the first-of-its-kind election exercise is a lesson learned from the 2016 election.