maxoidos - Fotolia

News Stay informed about the latest enterprise technology news and product updates.

Risk & Repeat: DEFCON tackles voting machine security

Listen to this podcast

In this week's Risk & Repeat podcast, SearchSecurity editors discuss DEFCON's efforts to improve voting machine security in the wake of hacking threats during the 2016 election.

With U.S. midterm elections approximately a year away, DEFCON organizers are sounding the alarm on lackluster voting machine security.

Last week, DEFCON published research on vulnerabilities and security shortcomings found in U.S. election equipment and infrastructures during the conference's Voting Village this past summer. DEFCON founder Jeff Moss, along with other security researchers and experts who co-authored the DEFCON report, held a press conference highlighting some of the findings on voting machine security.

In addition, Moss urged election officials and voting machine manufacturers to work with the infosec community and provide researchers access to the latest equipment so it can be thoroughly analyzed and vetted. To that end, DEFCON organizers offered free penetration testing and security training to state and local election offices.

Will election officials take DEFCON up on its offer to help? What were the most surprising findings in the Voting Village research report? Can election security be protected from hacking threats before the midterm elections in 2018?

In this episode of the Risk & Repeat podcast, SearchSecurity Editor Rob Wright and Senior Reporter Michael Heller discuss those questions and more on DEFCON's effort to improve voting machine security.

Next Steps

Risk & Repeat: The Kaspersky controversy continues

Risk & Repeat: Equifax, Yahoo breaches grow larger

Risk & Repeat: Is there too much victim-blaming in cybersecurity?

Join the conversation


Send me notifications when other members comment.

Please create a username to comment.

How will the DEFCON Voting Village research help improve election security?
Any serious look at voting machines, and at the larger voter registration and election process from which the machines cannot be separated, needs to separate the partisan hype from reality.

On one side, people talk of millions of illegal immigrants voting.
On the other side, people talk of the "Russians".

The reality is that vote fraud does exist...and overwhelmingly it is committed by patronage employees and contractors of politicians who are natural born US citizens and neither illegals nor Russians. 

How can a machine, and the system of which it is a part, prevent one person from casting many votes by impersonating other people who are registered by do not vote because they are dead, or more likely, because they moved away but have not yet been removed from the voter registration database?

How can a machine, and the system, prevent the altering of the vote count inside the machine.  The most common way to alter the vote count is to shift the undervotes and the 3d party votes to the favored candidate.  In a race where both major party candidates are hated, the undervote is significant.  A less common way to alter the vote count is to increase the total vote count to more than the number of people who actually voted, sometimes to a number greater than the number of people registered in the precinct.

Real world situations need to be addressed before we go trying to solve the elusive Russian and illegal immigrant fantasies.
It is very difficult for bad-actors to break encryption when modern algorithms, long keys, and very secure key management methods are used. Storing a copy of the key or a master-key used to encrypt the data-encryption keys poses additional problems because  we then have to trust the holder of the stored keys or master-keys. A method of using polynomials to split keys into N parts such that M<N holders of one of the key parts must cooperate with the government in order to access the encryption key would work. M trusted organizations each hold part of a key that can be used in combination with M-1 other part holders to  decrypt  the government requested key. This means that at least M of the N holders of parts of the key-decryption key must agree with the government's warrant.  The government would compensate  the N trusted organizations for the cost of this service. Organizations encrypting data that the Government thinks might be the subject of a future warrant would generate their encryption key, encrypt that key in in a generated Master Key and then split that master key into N parts which are distributed,along with the encrypted (by the master key) key to the N trusted organizations in a highly secured manner. Such distributed key-parts would be fully identified - organization, key identity, and key version number. The N trusted organizations then accede to the warrant by sending the encrypted target key and the master key part that they are entrusted with to the appropriate government agency and notify the original creator of the encryption key. The Government agency can now recover the target key. The trusted N organizations would be a mix of non-government, independent  organizations whose main activity-focus is not related to the Government. If this overall process was highly automated by secured software that is operated by the selected trusted personnel at each of the N trusted organizations it would provide all parties with appropriate security and warranted, monitored access to necessary key for law enforcement.