sonofsanta Posted April 16, 2015 Posted April 16, 2015 This article is simply staggering. Meet the e-voting machine so easy to hack, it will take your breath away | Ars Technica The AVS WINVote, made by Advanced Voting Solutions, passed necessary voting systems standards and has been used in Virginia and, until recently, in Pennsylvania and Mississippi. It used the easy-to-crack passwords of "admin," "abcde," and "shoup" to lock down its Windows administrator account, Wi-Fi network, and voting results database respectively The weak passwords—which are hard-coded and can't be changed—were only one item on a long list of critical defects uncovered by the review. The Wi-Fi network the machines use is encrypted with wired equivalent privacy, an algorithm so weak that it takes as little as 10 minutes for attackers to break a network's encryption key. The shortcomings of WEP have been so well-known that it was banished in 2004 by the IEEE, the world's largest association of technical professionals. What's more, the WINVote runs a version of Windows XP Embedded that hasn't received a security patch since 2004, making it vulnerable to scores of known exploits that completely hijack the underlying machine. Making matters worse, the machine uses no firewall and exposes several important Internet ports. "shoup", incidentally, is the name of the company at the time the device was installed. So that's "abcde" to connect to the network, "admin" to get into the admin account, and the company name to open the database and start fiddling results. As a commenter on the article points out, flaws like these aren't deliberate backdoors; they're so unbelievably awful they can only be incompetence. It makes you wonder what the certification process actually consisted of beyond "it turns on. Great, we're done!"
Grey-gear Posted April 16, 2015 Posted April 16, 2015 The more I read the worse it gets, though vote is a pain for some people in this country after reading that I think we should never do E-voting.
SovietRussia Posted April 16, 2015 Posted April 16, 2015 E-Voting in the UK would not consist of electronic machines, plans put forward only indicate online voting.
sonofsanta Posted April 16, 2015 Author Posted April 16, 2015 E-Voting in the UK would not consist of electronic machines, plans put forward only indicate online voting. Even so, would you trust them to develop a secure and reliable system? Pound to the penny they forget to renew the security certificate the day before the election and it all breaks anyway, judging by most government websites.
SovietRussia Posted April 16, 2015 Posted April 16, 2015 (edited) Even so, would you trust them to develop a secure and reliable system? Pound to the penny they forget to renew the security certificate the day before the election and it all breaks anyway, judging by most government websites. The state of government IT (As in the Cabinet Office, not the NHS) I would say is pretty postitive at the moment, GOV.UK looks and is a great website for people to use - they actually realised that things need to "look" good to be friendly to users. But voting responsibility* does not lie with the Government it lies with Parliament who issue writs and receive them back to declare, so it would be the brand new Parliamentary Digital Service who actually build it. *Registering to vote is responsibility of the Government. Actually voting is very different but it is Parliament who is responsible - the Electoral Commission only oversee elections (the management functions) Edited April 16, 2015 by SovietRussia
localzuk Posted April 16, 2015 Posted April 16, 2015 The state of government IT (As in the Cabinet Office, not the NHS) I would say is pretty postitive at the moment, GOV.uk looks and is a great website for people to use - they actually realised that things need to "look" good to be friendly to users. But voting responsibility does not lie with the Government it lies with Parliament who issue writs and receive them back to declare, so it would be the brand new Parliamentary Digital Service who actually build it. Gov.UK is a disaster. It isn't good for people to use at all. There's massive holes in the things that are on there, and the site is driven by form over function mentality meaning that any edge cases are simply not catered for. The latest one I heard about was that there was no way to apply for a visa for celebs/public figures to visit the country via it. The member of our office staff who handles VAT returns hates the new 126 form. It is all done online, you can't save and come back to it, and it doesn't actually get sent electronically - you have to print it and then send it by post. So, no, government IT may *look* pretty but it is functionally deficient.
pete Posted April 16, 2015 Posted April 16, 2015 I'm completely unsurprised. I mean, there's people out there making cash machines that can be broken into with a drill and an USB stick. Even so, would you trust them to develop a secure and reliable system? Pound to the penny they forget to renew the security certificate the day before the election and it all breaks anyway, judging by most government websites. Remember last time there was a change of government and they decided to rebrand all the depts, but couldn't be bothered to buy new SSL certs for any site the general public wouldn't typically use? For months afterwards you'd get SSL errors on a plethora of education-related government sites until the slackers got their act together (or the cert expired and they were forced to fix it). Chances are you'll go to vote, they'll have rebranded the site, the cert will be scuppered and Chrome will block the site and then whoever's in power will start an anti-trust investigation against Google to take attention away from the fact that they're a bunch of muppets.
plexer Posted April 16, 2015 Posted April 16, 2015 The member of our office staff who handles VAT returns hates the new 126 form. It is all done online, you can't save and come back to it, and it doesn't actually get sent electronically - you have to print it and then send it by post. All their forms are probably like that the P87 I did the other day was exactly the same Ben
Oddbod Posted April 19, 2015 Posted April 19, 2015 (edited) The state of government IT (As in the Cabinet Office, not the NHS) I would say is pretty postitive at the moment, GOV.UK looks and is a great website for people to use - they actually realised that things need to "look" good to be friendly to users. But voting responsibility* does not lie with the Government it lies with Parliament who issue writs and receive them back to declare, so it would be the brand new Parliamentary Digital Service who actually build it. *Registering to vote is responsibility of the Government. Actually voting is very different but it is Parliament who is responsible - the Electoral Commission only oversee elections (the management functions) GOVUK is a *&£$^*(. I can't believe they approved this. Random pages… Broken links… Broken tagging… Broken law subsections… The HMRC are so incensed by the mess, that they have built their own system. That works and the old system is still available… for now… Check on the register to see what a shambles the GOVUK team have created! Edited April 19, 2015 by Dos_Box Swearing!
Andrew_C Posted April 19, 2015 Posted April 19, 2015 I used Passport pages last month. A huge improvement over a couple of years back. You still have to print, and sign a declaration, but the form works. And the system produced a passport in 2 weeks.
elsiegee40 Posted April 19, 2015 Posted April 19, 2015 I used Passport pages last month. A huge improvement over a couple of years back. You still have to print, and sign a declaration, but the form works. And the system produced a passport in 2 weeks. Likewise. Son's new passport turned round in under ten days. He even got a text telling him when the new was being posted back. I was very impressed.
Garacesh Posted April 20, 2015 Posted April 20, 2015 (edited) I'm mid-way through applying for a new passport myself.. Annoys me you can fill in LS01* online (but it's in beta, they say..) but can't apply for the passport online. I'd feel much more comfortable printing off a "Glue photo here. Write passport application reference here. Mail it to us." rather than "Mail us your photo and a bunch of other information that if intercepted could be used to create a fake ID in your name with a lot more information than a person would usually have access to." * The "My passport is lost or stolen" form which I recently had the pleasure of filling in because back in '08 when my passport was lost and they told me it was cancelled, turns out it wasn't cancelled, so when finally applying for a new one I needed the L-number which I was never issued, phoned them up to request it, imagine my surprise when they said nope, it wasn't cancelled. Fun times were had as I was quizzed about the details of a passport I haven't had possession of for nearly 6 years. Where was I living when it was applied for? No clue. How was it applied for? Dunno, mum did it all and I just signed it. Did I have to go for an interview? No, I don't recall I did. Edited April 20, 2015 by Garacesh
SovietRussia Posted April 21, 2015 Posted April 21, 2015 GOVUK is a *&£$^*(. I can't believe they approved this. Random pages… Broken links… Broken tagging… Broken law subsections… The HMRC are so incensed by the mess, that they have built their own system. That works and the old system is still available… for now… Check on the register to see what a shambles the GOVUK team have created! HMRC are moving over to GOV.UK using the same service tools...
witch Posted April 22, 2015 Posted April 22, 2015 TBH the whole voting system is in disarray. I put down both my daughter and son on the electoral register and I have voting cards for both of them. Since I did it, my daughter has registered in Brighton where she is a student and my son has moved out and registered in his new constituency. So both of them could vote in both places - or I could vote as myself and then later as my daughter - nobody ever checks identity. Postal votes are the same - I know someone who has both postal and card and so again, could vote twice.
Seb1780 Posted April 22, 2015 Posted April 22, 2015 TBH the whole voting system is in disarray. I put down both my daughter and son on the electoral register and I have voting cards for both of them. Since I did it, my daughter has registered in Brighton where she is a student and my son has moved out and registered in his new constituency. So both of them could vote in both places - or I could vote as myself and then later as my daughter - nobody ever checks identity. Postal votes are the same - I know someone who has both postal and card and so again, could vote twice. Your daughter is quite entitled to vote in both locations for the local elections, but must only vote once in the general election. Students - About my vote
witch Posted April 22, 2015 Posted April 22, 2015 Yes, I know, but that is my point - how would they know? There don't seem to be any checks carried out of any sort.
Seb1780 Posted April 22, 2015 Posted April 22, 2015 Oh, *they* know alright - your electoral register number is written on the counterfoil of the ballot paper and through that it can be checked. This is unlikely to be detected at the time but if someone got wind that your daughter had voted twice the facts could be checked retrospectively. Some of the more conspiratorial musings on this topic can be found here What happens to the voting slips used in British elections after they have been counted? | Notes and Queries | guardian.co.uk
Garacesh Posted April 22, 2015 Posted April 22, 2015 All such documents are supposed to be officially sealed so that there is no chance of interference by any party and, according to the 1983 act, the seal can only be broken by the order of the High Court or Parliament itself. Oh, okay, that's pretty cool. Good thing they're taking ca- In practice ballot papers are simply bundled-up into paper sacks and transported to a warehouse in Hayes Oh ;_; I shouldn't laugh at that, it's a gross breach of regulations (as a paper sack is hardly 'sealed with no chance of interference') but the way it was written gave me a chuckle.
witch Posted April 22, 2015 Posted April 22, 2015 Oh, *they* know alright - your electoral register number is written on the counterfoil of the ballot paper and through that it can be checked. This is unlikely to be detected at the time but if someone got wind that your daughter had voted twice the facts could be checked retrospectively. That's the point though - facts should be checked BEFORE you vote and not after. They are relying on someone telling them about the wrongdoing - and if I did do it - I would tell noone. I am sure there are lots of people who vote more than once
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now