[Hackers]

Many machines continue to fail basic audits for hash verification checks in the case of a null or otherwise missing comparison hash.
This specifically focuses on ES&S machines. I am sharing this so that there is awareness, and so that election software / hardware can be secured in 2028 & further.

It does seem like a golden opportunity for any software devs looking to create a new company to offer this service. I think any computer programmer can agree that these ES&S bugs are problematic at best, and negligent at worst.

Here are some links on this:

https://www.zetter-zeroday.com/votings-h...he-system/

https://robertjrei.substack.com/p/how-to...l-election

https://freespeechforpeople.org/wp-conte...111324.pdf

ECO Analysis ESS 1188.pdf

https://github.com/LNodesL/files/blob/ma...10-aug.pdf

https://github.com/LNodesL/files/blob/ma...eports.pdf

https://github.com/LNodesL/files/blob/ma...10-sec.pdf

https://github.com/LNodesL/files/blob/ma...ort2-1.pdf

Voting Machine Hashcode Testing Unsurprisingly insecure and surprisingly insecure.pdf

EVS 6060 Test Plan Rev 04 508_0.pdf

https://github.com/LNodesL/files/blob/ma...A-2016.pdf

---

6.1 has the empty hash bug:
https://www.zetter-zeroday.com/content/f...10-aug.pdf

---

6.2 doesn't specifically say this was resolved in its list of updates, AND it has another bug related to hash verifications. This is important:
"networking outage" (uhh???) can cause SSL to fail - which is used for software authenticity checks... Interesting:
https://www.sos.state.tx.us/elections/fo...vs6200.pdf

https://www.sos.state.tx.us/elections/fo...report.pdf

The thing with 6.2 is it also uses Powershell and a modifiable operating system, and specifically uses a USB based verification process:



This was flagged by the state too:



Here's another note that does mention that the improvement of a static list of hashes is an improvement.
One thing that has been noted in a few audits is that the auditors explain the primary issues of the outdated software, potential bugs, etc, but then must write a letter of authenticity as long as the verification hash works with normal inputs. So they will not for example disqualify a machine that is easily hacked, if under legal regular use by an honest person it would work. This essentially means they are highly vulnerable in the hands of anyone with the intent to hack and manipulate voting results, but they are legally able to be used in an election.



What this means:
- The verification script, Powershell, is run by the auditor on the same machine as the vote tabulation software
- The only requirement is that the current software / stub hash matches to a list of static hashes

So, in review...

It is using an outdated OS - Ubuntu 16
The SSL required for hashing in their 6.2 version fails when there is a networking issue
6.1 contains a unique error where an empty comparison hash can trigger a TRUE / SUCCESS verification result

Outdated software is not a new trend:


For further information, here is a map of the distribution of voting tabulation machine brands:

[Stanley]

I'm Stanley HF's helper bot. The OP (original poster) of this thread wants everyone to see this page and has elected to bump it to the top of the showthread listing. Since HF doesn't want a ton of LQP (Low Quality Posts) this is the best method of bumping your content. There is a small βyte fee for each bump. Any OP can bump any of their threads on HF from the linked icon on the top of their first post.

If you haven't already read the first post of this thread we encourage you to do so.

Thanks,
Stanley

[Hackers]

Please guys, someone respond to my thread, please....



Stanely ... please ...

I wish people cared this much when Biden made 20 million votes appear out of thin air lol

It's my opinion after much research that it is very likely that there was a possibility of election fraud in every election going back to at least the 90's. I haven't finished the last 4 election cycles in my ES&S research, let alone with other tabulation machine providers.

I 100% agree with you that the bugs in today's software could've been used.
These bugs are only the latest 2 versions - the prior versions were far more compromised.

This is most likely why it's not mainstream - to accuse the current election of being fraudulent would open up the door to distrusting every election. The reason is because the software trail would lead any programmer to that conclusion.

All in all, my hope is that we can secure the software for 2028 - not use the evidence to try to start a civil war over 2024, 2020, 2016, etc.

As far as I can tell, there is no guarantee that results were valid for at least the last 30 years.

I bumped this because I shared with someone in a private convo and figured it deserves more attention. If anyone wanted to make the claim that Biden stole the election, or Trump did, or anyone did - then they should start with ES&S hashing. I consider this thread bipartisan as a software analysis independent of party.

I'll act in good faith and make sure I update this with equal information about 2008, 2012, 2016 too. They all had the same types of problems. I have no clue why this isn't a bigger issue, or a bigger motivation for a new player to arise w/ secure software to sell billions of dollars worth of infrastructure. It's an egregious level of negligence in the past, but it can be a golden opportunity for a software company to fix the issue for the future.

Bugs were there for a lot of elections, not just this one.

--------------
I broke my rule to not read your post, but this thread is important.

[sector]

bumping this,,

[Hackers]

bumping this,,

Cheers sector , good call

This thread is here to provide PUBLIC information about certain machines, in an attempt to shed light on how we can improve security for not just the nation, but the entire world.

Again, nothing I am sharing is classified, private, or otherwise hidden. This is all public information that is known to the EAC, Pro V&V, SLI, ES&S, and others.

As a community of ethical tech enthusiasts, I feel that this is a good place for people to identify the problems, and consider solutions.

You will struggle to find an election that did not have a known hash verification bug specifically called out by an auditor.
Our laws do not require test scripts / hash checks to be tested independently.

"The hash is correct" is trusted, even if there is a known vulnerability with the script that specifically checks the hash.
This is neither my opinion, nor is it a recent problem.
You can track this type of issue through much of the v6 ES&s machines, and also v5.
You can also find glaring cybersecurity concerns going back to the 1980s, and possibly earlier.

---

ECO Analysis ESS 1188.pdf

https://github.com/LNodesL/files/blob/ma...10-aug.pdf

https://github.com/LNodesL/files/blob/ma...eports.pdf

https://github.com/LNodesL/files/blob/ma...10-sec.pdf

https://github.com/LNodesL/files/blob/ma...ort2-1.pdf

Voting Machine Hashcode Testing Unsurprisingly insecure and surprisingly insecure.pdf

EVS 6060 Test Plan Rev 04 508_0.pdf

https://github.com/LNodesL/files/blob/ma...A-2016.pdf