sb-as logo
Story image

Want to cause chaos? ICIT says hacking elections is easy

07 Aug 2017

​Following the news that hackers at the DEFCON “Voter Village” were able to exploit vulnerabilities in voting machines in a matter of minutes, ICIT has drawn attention to its alarming report that details just how easy it really is to exploit vulnerabilities in voting machines and hack elections.

‘Hacking Elections is Easy! Part One: Tactics, Techniques, and Procedures’ delves into the problems we’re currently facing at almost every modern election.

To hack an election, the report states, a criminal doesn’t need to go through the effort of exploiting a national network of election technology, but instead can simply focus on the machines in swing regions of swing states to hack the election without drawing considerable notice.

According to ICIT, voter machines are so riddled with vulnerabilities that ‘even an upstart script kiddie could wreak havoc on a regional election, a hacktivist group could easily exploit a state election, an APT could effortlessly exploit a national election and any corrupt element with nothing more than the ability to describe the desired outcome could order layers of exploits on any of the multitude of deep web forums and marketplaces.’

Despite maintaining an illusion of security based on the semblance of complexity, the report asserts voting machines are neither secure or complex as in reality these stripped down computers utilise outdated operating systems and possess virtually every conceivable vulnerability that a device can have.

ICIT affirms the fundamental cybersecurity rule dictates that organisations assume their technology is vulnerable until proven otherwise, but despite proven vulnerabilities and a demonstrative lack of security, manufactures and officials have not improved e-voting systems.

‘Easily exploitable voting machines will continue to plague the democratic process so long as manufacturers are able to profit from and covertly obfuscate the vulnerabilities inherent within electronic voting systems.’

However, ICIT says attackers of the democratic process aren’t just limited to election machines.

‘Catastrophically disrupting the campaign of just about any political candidate can be done with little more than a DDoS attack on fundraising links and web properties, spam widgets on social media platforms, an insider threat who delivers a malicious payload on a USB drive or unsuspectingly by clicking a link in a spear phishing email, and a ransomware variant to encrypt important donor lists to further cripple fundraising.’

A skilled cybercriminal could essentially create a network of spoofed sites to confuse voters, and this is just the beginning according to ICIT.

‘By combining attack vectors and layering attacks, an adversary can manipulate the democratic process by inciting chaos, imbuing suspicion, or altering results.’

Story image
ABB and Nozomi Networks extend collaboration, deliver improved OT security solutions
"With Nozomi Networks solutions added to our cybersecurity portfolio, our customers gain proven network monitoring and threat detection technology."More
Story image
Kroll completes Redscan acquisition, expands cyber risk portfolio
With the addition of Redscan and its extended detection and response (XDR) enabled security operations centre (SOC) platform, Kroll expands its Kroll Responder capabilities to support a wider array of cloud and on-premise telemetry sources.More
Link image
Virtual demo: Diagnose network cabling problems with the LinkIQ Cable+Network Tester
If you’re finding it difficult to install access points and cabling, or if you can’t pinpoint an issue with a video camera or end user, the LinkIQ Cable+Network Tester could be exactly what you need. Try a free, fully interactive demo now.More
Story image
IT leaders prioritising automation, Zero Trust and API-based security investments
"The study shows that a cocktail of multiplying threats, the proliferation of hybrid and cloud architectures, blended with a pandemic-fuelled explosion in distributed and remote work has created a perfect storm for network security teams."More
Story image
Over half of ransomware victims pay up - but does it work?
"Handing over money doesn’t guarantee the return of data, and only encourages cybercriminals to continue the practice."More
Story image
NVIDIA unveils next-gen SoC for autonomous vehicles
NVIDIA founder and CEO Jensen Huang calls it a 'technical marvel' that combines all of the company's strengths.More