cyber.hendryadrian.com
Security Report · darkowl.com

Darknet Discussions Highlight Election-System Risks and Exposed Voter Data

· Original article ↗

Summary

DarkOwl reviews darknet discussions, exposed election-vendor credentials and voter-registration data, and voting-system risks ahead of the 2020 U.S. election, while outlining safeguards such as offline machines and paper backups.

Key points

  • DarkOwl reports observing darknet discussions about vulnerabilities in voting and ballot-tallying technologies from ES&S, Dominion Voting and Hart InterCivic; the discussions do not establish that those systems were compromised.
  • DarkOwl lists exposed employee credential counts for ES&S (468), Dominion Voting (94) and Hart InterCivic (218).
  • The report says voter-registration databases for Michigan, Florida, North Carolina and Colorado were shared or sold on darknet forums; a user claimed in 2018 to have shared Kansas voter data covering 4.1 million people.
  • The article recounts reported voting-machine problems in Texas and Pennsylvania in 2018, including voter reports of selections changing and machines deleting selections.
  • The National Election Defense Coalition reportedly found more than 35 voting systems online across 10 states, some in Florida and Michigan.
  • Darknet users discussed RATs and USB-based malware delivery, but the article describes these as threats or proposals, not confirmed attacks on election systems.
  • Recommendations include keeping voting systems offline, restricting physical access, preparing paper ballots and poll-book backups, and verifying vendor packages and voter-registration information.

Article Details

Publisher
DarkOwl
Report Period
2020 pre-election period; includes historical examples
Scope
Darknet discussions and reported exposures affecting U.S. election technology, voter registration data, and election-related information
Sample Size
Not disclosed
Key Statistics
  • The National Election Defense Coalition reported finding over 35 voting systems online across 10 states for several months.
  • DarkOwl reported exposed employee credentials of 468 for ES&S, 94 for Dominion Voting, and 218 for Hart InterCivic.
  • Tyler Technologies had over 2,000 corporate email addresses in DarkOwl Vision's database at the time of writing.
  • A 2018 darknet post by a user identified as Omnipotent claimed to share Kansas voter registration data for 4.1 million voters.
  • In Texas in 2018, voters in more than 80 counties reportedly said their Hart eSlate machines changed their straight-ticket Senate selections.
Recommendations
  • Disconnect voting technologies from the internet or disable their modems, and scan systems for malware.
  • Keep emergency paper ballots available and print hard-copy backups of electronic poll books.
  • Verify voter registration information before Election Day; bring photo identification and proof of residence when voting in person.
  • Verify packages and mailed USB firmware updates with the vendor before use, and update voting-system software and firmware while minimizing network exposure.
  • Review printed ballot records after using a DRE; where machines lack a paper trail, contact state representatives and request a public audit.

MITRE ATT&CK

T1021.001 · Remote Desktop ProtocolThe article reports that RansomExx distribution included use of an unsecured RDP configuration.T1091 · Replication Through Removable MediaA darknet forum post discussed a hypothetical election-system infection using a replacement USB drive; the article does not report this as a confirmed incident.T1204.002 · Malicious FileThe article describes opening a malicious attachment as a way RansomExx was distributed.T1566.001 · Spearphishing AttachmentThe article says RansomExx could be distributed by opening a malicious email attachment.

People

Kevin SkoglungIdentified as being with the National Election Defense Coalition; the article attributes to him the report of voting systems found online across multiple states.

Threat Actors

alex_61The article identifies this moniker as a Russian darknet threat actor who posted in 2016 about potential ways to compromise U.S. election systems; the described claims are not presented as confirmed attacks.

Malware

RansomExxit is worth noting that only a few weeks ago, in late September, Tyler Technologies was hit with RansomExx, a malicious strain of ransomware that began circulating the darknet in late May and early June of this

Vendors

CyberDefenses, LLCMSSPs such as DarkOwl’s partner, CyberDefenses, LLC, help harden election networks and setup redundant network systems as day-of distributed denial of service (DDoS) attacks have occurred in previous election cycles.Dominion Voting Systemstallying technologies manufactured by three principle vendors: Election Systems and Software (ES&S), Dominion Voting, and Hart InterCivic.ES&Sof ballot tallying technologies manufactured by three principle vendors: Election Systems and Software (ES&S), Dominion Voting, and Hart InterCivic.Hart InterCivicmanufactured by three principle vendors: Election Systems and Software (ES&S), Dominion Voting, and Hart InterCivic.Tyler TechnologiesTyler Technologies, a Texas-based software company whose products are used to display state and local election results, has over 2,000 corporate e-mail addresses in DarkOwl Vision’s database as of time of writing.

Products

DS850Users on a darknet hacking forum discuss that antivirus and malware detection software is not usually available on the older DRE systems such as ES&S’s DS850 8000 ballot-per-hour central counting machine.eSlateevidence is not evidence of absence” — A darknet user comments that fraud is completely possible with the eSlate voting machine’s dependence on Microsoft Access databases without encryption or authentication.ExpressVote XLofficials had to move to hand counting paper ballots well into the morning after their ES&S’s ExpressVote XL machines were acting “finicky” and deleting candidate selections.Microsoft Accessuser comments that fraud is completely possible with the eSlate voting machine’s dependence on Microsoft Access databases without encryption or authentication.Windows 10However, Microsoft released patches for both Windows 7 and Windows 10 operating systems earlier this year, to which DarkOwl assesses election officials and technology vendors would very likely patch their systemsWindows 2000states, the exploitation of absentee ballots, the ease at which DRE software at the time based on Windows 2000 could be compromised remotely via the polling location’s wi-fi, sending “fake” software upgrades thatWindows 2008 R2These diagrams also suggest they rely on Windows 2008 R2 server and Windows 7, which would have most likely been updated by the 2020 election year.Windows 7However, Microsoft released patches for both Windows 7 and Windows 10 operating systems earlier this year, to which DarkOwl assesses election officials and technology vendors would very likely patch their systems

Countries

Russiahow in 2012, Vladimir Putin publicly decried how the U.S. had encouraged local protestors to claim Russia’s presidential elections were rigged and suggested that Putin was actively seeking payback by

Industries

Election technologyDARKNET CHATTER INCLUDES DISCUSSIONS ON ELECTION TECHNOLOGY VULNERABILITIESGovernment“In 2016, the U.S. was unprepared at all levels of government for a concerted attack from a determined foreign adversary on our election infrastructure,”

Related Articles