Vulnerabilities Affecting Dominion Voting Systems ImageCast X | CISA
us-cert.cisa.gov
So much for defamation.
Looks like dominion may have to drop their lawsuit
- Thread starter Beavishusker1978
- Start date
us-cert.cisa.gov
So much for defamation.
Not getting any attention on the NGEbraska boards? 😂😂😂Vulnerabilities Affecting Dominion Voting Systems ImageCast X | CISA
So much for defamation.
As Information Assurance (IA, aka CyberSecurity) expert who has written, let alone audited, all sorts of GNU/Linux and non-GNU (like Android) Linux-based (among other) firmware, like Android, for related, embedded/kiosk applications, let's start with these 2 ...Vulnerabilities Affecting Dominion Voting Systems ImageCast X | CISA
So much for defamation.
- '... does not validate application signatures ...'
- '... application ... self-attestation ...'
In fact, this is just downright damning ...
- '... can execute code with elevated privileges by exploiting a system level service ...'
- ' ... has a Terminal Emulator ...'
But forget all that! Because here come my favorites!
- '... authentication mechanism used by poll workers ... can expose cryptographic secrets ...'
- '... authentication mechanism used by voters to activate a voting session ... is susceptible to forgery ... print an arbitrary number of ballots without authorization ...'
Voters can print all the ballots they want without authorization!
OMG ... WTF is defending this system?!?!?!
BTW, this made me laugh ... because they should never ship anything like this!
- '... firmware based on Android 5.1 ...'
- '... allows for rebooting into Android Safe Mode ...'
I'd like to bring one home and have fun with that! Old Android ... full control of the OS ... albeit out-of-nominal runtime.
Last edited:
As a georgian, nobody believes Brandon won. In fact, nobody knows who voted for brandon and i live in a purple county
WTF signed off on this? Seriously?! This is worse than many of the ATM and other designs I've seen!
Beyond the fact that the application itself is exploitable, which is beyond comprehension ...
Even the application-level is running with full privilege and with a terminal emulator installed, totally exploitable via it's system service ... that's Android root, the app is running with total OS control! And without any certificate and its self-
And it's old Android 5.1 atop of all that, but that's besides the point. That just gives me more attack vectors, but frankly ... I don't think one even needs those!
Who the heck signed-off on this? How the heck did this even get certified? The lack of signatures/self-attest let alone everything running privileged ... ugh!
I'm now so calling total bullshit on this! Wow! Just wow!
QUOTE: _'The flaws, some of which stem directly from machine design, are fairly technical and would likely require any perpetrator to have direct, physical access to voting devices and/or other equipment polling management equipment.'_
The machine design is wide open at the application-level! Heck, voters can do things at the app-level!
But at the system design level ... I cannot believe they are defending no signature validation and self-attestation. No one does that! No one!
www.cbsnews.com
QUOTE: _'The flaws, some of which stem directly from machine design, are fairly technical and would likely require any perpetrator to have direct, physical access to voting devices and/or other equipment polling management equipment.'_
The machine design is wide open at the application-level! Heck, voters can do things at the app-level!
But at the system design level ... I cannot believe they are defending no signature validation and self-attestation. No one does that! No one!
U.S. finds no evidence flaws in Dominion voting machines were ever exploited
The Cybersecurity and Infrastructure Security Agency released a bulletin Friday saying it "has no evidence that these vulnerabilities have been exploited in any elections."
www.cbsnews.com
Last edited:
I had been ignoring this whole thing ... until they did.
I've been in the camp that said Trump should have shut up after the Electoral College met in mid-December 2020, just like some of the Democrats who refused to certify the 2016 election too.
But this ... I cannot believe people are defending these voting machines now, period. Forget the claims on the right ... this vendor has a grossly insecure device for voting, period. It should not be allowed to be used, period.
And I thought ATMs were bad a decade, let alone two, ago?! No contest! It's not even the fact that its running an Android OS from a decade ago ... the application privilege and lack of any basic crypto principles make it a joke.
So here's a perfect example of required mitigation in Missouri for a clearly exploitable system ... (emphasize mine)
Understand that even in federal systems that are air-gapped, they still cannot be exploitable by those who have access to them, including users like the voter -- let alone poll workers -- and this system very much is. All air-gapped does is prevents automated exploitation by remote access, but they are still exploitable ... just not en masse by a remote party.
No state should have these systems connected outside ... period. Although that kinda defeats the purpose of electronic voting machines. So ... ultimately ... we see the circular issue. Those vunerabilities don't require physical access. That is just a false statement by leadership based on the report, which lays out quite the opposite. In fact, with old Android 5.1, there are countless vectors ... but even the app itself has many.
"HB1878 - recently passed by the Missouri legislature allows for a number of security enhancements: the use of hand-marked paper ballots, requiring equipment to be air-gapped, the ability to disassemble and review equipment by the secretary of state’s office to ensure accurate performance, and the prohibition of “drop boxes.” Also, DRE (Direct-Recording Electronic) equipment will not be used beyond January 2024."
Understand that even in federal systems that are air-gapped, they still cannot be exploitable by those who have access to them, including users like the voter -- let alone poll workers -- and this system very much is. All air-gapped does is prevents automated exploitation by remote access, but they are still exploitable ... just not en masse by a remote party.
No state should have these systems connected outside ... period. Although that kinda defeats the purpose of electronic voting machines. So ... ultimately ... we see the circular issue. Those vunerabilities don't require physical access. That is just a false statement by leadership based on the report, which lays out quite the opposite. In fact, with old Android 5.1, there are countless vectors ... but even the app itself has many.
So, for liability reasons, I yanked my Twitter posts. I've now summarized a recommendation in my LinkedIn feed, which was posted to my Twitter (the start of it), as well ... (BTW, you weren't the first that sent me the report ... I just didn't look at it until now).
Looks like Twitter is on the 'misinformation warpath' and is trying to 'cover' for grossly irresponsible and incompetent companies like Dominion that create E-voting systems by just banning. Glad I yanked my 'CISA quotes' from Twitter.
I swear I would love 5 minutes with their CTO.
I swear I would love 5 minutes with their CTO.
And yes, I do have those types of conversations regularly. As one prominent security company CTO 'fessed up' on a call, "We're not used to having kernel Linux developers and debuggers at customers."
imagine being so goddamn stupid you actually truly believe Trump won in 2020.
Holy shit how do you function in society? Other than BS, who obviously is incapable of integrating in society.
Holy shit how do you function in society? Other than BS, who obviously is incapable of integrating in society.
I'm merely pointing out how Dominion suing people over libel/slander isn't going to go well for them.
I.e., their e-Voting systems are easily compromised both locally by non-technical people, and remotely by more technical people. The required, basic non-repudiation is also non-existent, so they couldn't even 'verify' they weren't modified. Dominion should have never filed that lawsuit.
E.g., if I took the stand as a SME, I could totally lay waste to them. Especially if they were required to provide me with some systems ... I already know many toolkits, but ... also, I could document how a non-technical user could compromise the systems even if they were 'air gapped' (no Internet). Furthermore, coming from me, with my credentials and standing in organizations, would damage them greatly. I also know many others who could do the same.
That has nothing to do with whether Trump won or not in 2020. But it utterly does destroy the entire Media Narrative and current, sitting Executive-Agency Leadership that is saying these e-Voting systems couldn't be compromised. Yes, they could ... very easiliy, even 'air gapped.'
But you have basic reading comphrension issues, so I expect nothing less.
With all due respect to UCFBS's evidence, the only question is how much money Fox News will have to throw at Dominion to settle their case out-of-court.
Dominion has no case whatsoever.
Short Version: It's like the neighborhood kid used an Android Kit and ignored all major foundations of basic security practices. In fact, I wouldn't be surprised if it was outsourced and built by some kids in Indial It's that bad!
Long Version ...
Any Linux InfoSec/IA-Cyber with a modicum of experience would eat their lunch because there are a half-dozen 'show stoppers,' as CISA found. At the bare minimum, the utterly lack of non-repudiation on software integrity is bad enough, but the ability for non-technical people to change votes and even get at encryption keys is a joke!
Then we can get into the fact that this is completely exploitable over a network, beyond just being way, way old software with thousands of vulnerabilities, but suseptible to man-in-the-middle and other things. Give me these things overnight and I will break in and change votes ... and put in a rootkit they wouldn't even be able to verify ... because they have no signatures and many other things.
This would never, ever be certified for any federal regulated air gap networks, much more definitely never something Internet connected. It would fail on multiple levels, and Dominion blacklisted until remediated. These are elementry security things ... even removing the old software with all the attack vectors.
Then we can get into the fact that this is completely exploitable over a network, beyond just being way, way old software with thousands of vulnerabilities, but suseptible to man-in-the-middle and other things. Give me these things overnight and I will break in and change votes ... and put in a rootkit they wouldn't even be able to verify ... because they have no signatures and many other things.
This would never, ever be certified for any federal regulated air gap networks, much more definitely never something Internet connected. It would fail on multiple levels, and Dominion blacklisted until remediated. These are elementry security things ... even removing the old software with all the attack vectors.
Again, this is 'grandstanding' by Dominion. They are now a joke in the InfoSec/IA-Cyber community after the CISA audit. I'm not kidding about this being like someone build an embedded Android overnight and didn't care about any basic security practices.
A federal judge found enough merit to allow the Dominion case against Fox News to go forward. So pardon me if I wait to see what a court of law says, not your InfoSec/IA-Cyber Community.
Yes, there is nothing legally to stop the case from proceding.
But Dominion has no case once the experts show up to talk the technical argument.
Did you just confuse legal merit with technical merit?!
Why do you keep making arguments with me that are nothing about what I stated? Why?! I keep having to point this out.
Dominion has no merit to their case, techncially.
Once they start going through their security issues, even beyond the fact that their systems are easily compromised by technical people, but that they can be compromised by non-technical people even if air gapped, they will quickly shut this down.
But I don't expect it will reach that. I fully expect Dominion to try to get to a settlement, and if they don't, then drag it out to avoid it ever reaching a courtroom where they will get destroyed. Let me say that again ... they would get destroyed in a courtroom!
I could never get such a system in a door like theirs ... not even a lower 'Public Trust' setup like at the US Census Bureau.
But I don't expect it will reach that. I fully expect Dominion to try to get to a settlement, and if they don't, then drag it out to avoid it ever reaching a courtroom where they will get destroyed. Let me say that again ... they would get destroyed in a courtroom!
I could never get such a system in a door like theirs ... not even a lower 'Public Trust' setup like at the US Census Bureau.
It's crap from people like Dominion that literally make us bark at the government why NIST CMMC 2.0 matters in the 2020s -- for even unclassified ('regular') networks -- when Dominion's crap cannot even follow 1990s security practices and are on the same networks!
I mean, that's what really pisses all of us off!
EDIT: **** it, I said it publicly ... because it ****ing matters.
Last edited:
What 'technical' argument? This is a defamation case for crying out loud!
Fox News reporters villainized the company for its supposed involvement in massive, wide-spread vote fraud. Seems to me it'll be damn hard for Dominion's lawsuit to "drop," "disappear", or "go away" when it has been proven beyond all reasonable doubt that no massive, wide-spread voter fraud took place across this country and that Joe Biden won the election fair and square.
What makes the Dominion's case against Fox News even more compelling is the company provided the network’s anchors and executives at the time of their fraudulent reporting with information that disproved the network's accusations.
Yet despite being provided with Dominion's documentary evidence, Fox and its news personnel continued their fraudulent claims and refused to report the evidence Dominion provided them. The network was unwilling to even present it to their viewing audience as "Dominion's side of the story."
Without the technical, it has no merit.
You do understand their argument is that Dominion systems can be compromised, easiliy ... which is true.
And there is also the reality that non-technical people can change votes on system ... which Dominion denied, but it's true.
And then there's the reality that there is no audit trail, no non-repudiation and so many other things.
And that information they provided was fraudulent. Their systems are easily compromised by non-technical and technical people alike!
The documentary evidence is bullshit, and further undermined by the CISA audit.
Sorry ... but regardless of where you stand on the whole fraud thing ... Fox News wasn't wrong. Those e-Voting systems are even not being allowed in most states going forward.
But their design is utterly horrendous. And that's the point Fox News was making.
Most security researchers, including those published at the New York Times, have made this case over and over too. Sorry, but this is what Fox News is trying to get people to understand, and it's getting old how much people defend Dominion and others.
Dominion is losing money because their e-Voting machines don't even comply with federal standards, even older ones! Diebold exited the market because of this too! It wasn't Fox News, and that is easily proven. Diebold underwent the same loss of revenue when their systems were easily broken, lost votes and had other issues ... let alone were easily compromised.
This is why 'no paper trail' systems are being outlawed by most states.
New York Times previously sounded alarm on how easily electronic voting machines can be hacked
The New York Times has joined the vast majority of the mainstream media in dismissing any concerns President Trump's legal team has raised amid the challenge of the 2020 presidential election results, including the possibility that ballots from electronic voting machines were tampered with...
Sorry, but that's NOT the issue with the lawsuit. The question is did Dominion participate in a massive, wide-spread effort to vote-switch to have the election stolen from Trump.
Given that Dominion provided Fox News with their evidence -- which they ignored -- either the network proves Dominion executives rigged their machines to switch votes from Trump to Biden or they lose the lawsuit.
You are arguing with a cult member.
Might as well hit up the flat eaerth forums, its the same thing. You can't use facts and reason on people like him that dont base their worldview on facts and reason.
Yes it is!
No, the question is whether or not any clerk or state that used Dominions systems has integrity. The sad answer is ... no, they very much do not! The results cannot be trusted at all. In fact, lost votes are easy with their solutions, just like Diebold. That's just reality.
I wish it was otherwise. I literally didn't care about this whole thing. But then the CISA audit came out. And then I was pissed. They stated their systems had integrity and non-repudiation. Instead, they are the opposite. I gave Diebold a pass because it was 2 decades ago. Dominion is 2020.
Dominion should be chastized and all elections where their products used should be questioned. They literally can lose votes, in addition to poll workers changing things, pulling credentials, etc... non-technical people. There is zero integrity with their products.
And if they are on a non-'air-gap' network ... oh boy! It really pisses me off what an administration official said about the CISA audit. Several people sent me the audit after that, because ... They know they lied too!
Because it was bullshit. Dominion was covering their @$$. They lied. I read the CISA audit. They lied. I'm so tired of technology corporations literally lying their @$$es off. If I wanted an e-Voting system that did that ... Dominion is definitely the solution! They stated otherwise, and it was all a lie!
KEY POINT: I did not take interest in this until that! I had people turn to me on LinkedIn to read it (because they knew too!). Many of these professionals are in DC and are not Trump supporters! I read the CISA audit and realized ... Dominion lied, the administration lied, the Media is lying.
Dominion's case against Fox News is that they are causing Dominion to lose $600M+ in revenue. No, Dominion is doing that all on its own! Fox News just brought attention to it when the left and the administration is lying.
Lack of integrity will get me very time. It's why I hated Donald Trump in 2016 and did not believe any of the conspiracies he ever stated. Unfortunately, some of them turned out true ... like the FISA Courts and what McCain did too (not just to chastize Hillary or Democrts).
This is why Trump continues. Because the left lies their @$$es off. If they didn't, this wouldn't be an issue. Merkel did the same in Germany. Italy is yet another country undergoing 'The Right Shift' because the left has no integrity.
Which is why the lies need to stop. I couldn't believe the CISA audit pointed all this out, in stark contrast to your so-called 'documentation.'
This is why Trump continues. Because the left lies their @$$es off. If they didn't, this wouldn't be an issue. Merkel did the same in Germany. Italy is yet another country undergoing 'The Right Shift' because the left has no integrity.
You're over-simplifying things. The fact is ... yes, the machines could do that! And they were known to be a major issue. That's why most states are moving to outlaw devices without non-repudiation. In fact, this was already a federal requirement.
Which is why the lies need to stop. I couldn't believe the CISA audit pointed all this out, in stark contrast to your so-called 'documentation.'
Last edited:
I know, I know, I know. It's hard to have a discussion with someone who quotes me in a lengthy post but never bothers to actually address the points I've raised.
Having a techie testify that the Dominion machines could be compromised doesn't prove diddily-squat, The relevant question is: Were they compromised? Were their voting machines rigged in November, 2020 to sway the election away from Trump to Biden's favor?
The answer to that question has been put to bed by most rational people in this country long ago.
Dominion's units are ideal if someone wants to compromise the election ... both non-technically and technically.
Remember ... I took 0 interest in the 'stole the election' non-sense. As far as I'm concerned, the Electoral College addressed that 2020 mid-Decembber.
But then Dominion sued, and people in DC told me to look at the CISA audit. Dominion, the administration, the Media and Big Tech are lying and censoring about it.
It's right there! Change votes, no non-repudiation, especially since changes can happen and there's no way to verify anything ... software or votes! 1990s security practices utterly ignored!
That is just fact.
And we'll never know, that's the problem! There is 0 possible non-repudiation!
I.e., this is why Dominion should have never been used! And that's the arugment.
Again, I'm 100% against that non-sense! I've been complaining about Trump and MAGA people over that since mid-December.
No, that's not the argument here. Dominion is not suing over that! They have no standing to sue over that.
Dominion is arguing that Fox News cost them $600M.
The problem is ... Dominion itself cost themselves vitually all future sales. Dominion's e-Voting machines are ideal if you want to utterly compromise an election. That has now been proven, technically.
That's just fact. There is mass lying about this. That's what is pissing me off, and lots of people in this space. We're trying to secure federal and state Linux systems and networks, and we have this garbage on the same networks!
And it's just more "State was never compromised via Clinton" bullsh-- in the Media and Big Tech. That's what pisses me off ... the lying, the blatant lying.
Stop arguing with what I'm not saying! Dominion has no standing to sue over such. That's the smokescreen.
Dominion is complaining they are down $600M in potential sales over Fox News. The problem? All Fox News did was bring attention to how horrendous their products are!
People like me won't let them on their networks ... and the feds and states are outlawing them for this reason, if they didn't already. How is Fox News responsible for that?! How?!
Fox News: Those idiots at WC Bank got ROBBED for a million dollars!!!
WC Bank: What? Uh, no we weren't. FYI, we have a mega-strong vault.
Fox News: Ah, but we found a techie living in rural Alabama who assures us he could break it easy!!!
WC Bank: Big deal. uh, guys? Let me repeat this very slowly: Our. Bank. Wasn't. Broken. Into.
Fox News: SO YOU SAY!!! Prove it!!!!
WC Bank: Don't you have this 'prove it' business turned around? We still have the money that was supposedly stolen for crying out loud! We're suing your guys' asses for defamation.
WC Bank: What? Uh, no we weren't. FYI, we have a mega-strong vault.
Fox News: Ah, but we found a techie living in rural Alabama who assures us he could break it easy!!!
WC Bank: Big deal. uh, guys? Let me repeat this very slowly: Our. Bank. Wasn't. Broken. Into.
Fox News: SO YOU SAY!!! Prove it!!!!
WC Bank: Don't you have this 'prove it' business turned around? We still have the money that was supposedly stolen for crying out loud! We're suing your guys' asses for defamation.
I tried to put this multi colored, multi-font size, gibberish into the Google word count and it crashed. Before it did it flashed
CERTIFIABLY INSANE
This is the core problem with our society and culture today. All sides think they are right and nobody will even consider the possibility of the other side have some merit to the argument at hand.
Y'all can say ucfbs guy or girl for that matter is a maga antivaxer cult leader all you want . However, I find their technical opinion on how easily a Dominion system can be hack even on the voter end at least interesting . If it's true ,it's true .
So, with that said, going forward , let's say it's accurate their system is a leaky as a fish net , do we as citizens want their system used in future elections? If what ucfbs says is technically spot on , I would suggest none of us would want that system going forward . If but for no other reason the lawsuit exposes dominion in discovery and at trial , then so be it. I don't give a rats ass if Fox wins or loses here what I find interesting though is lawsuits involve discovery on both sides and Dominion sues and it's discovered they built a crappy machine then all of us are winners going forward.
I am 55 and the election of 2000, 2016 and 2020 have all had issues and swirling claims of voter fraud and stolen elections. I for one am just tired of it all..we need election integrity restored and we need all sides to wake up the days or weeks after an election and trust the results. We need trust in the system, the government and trust that our votes counted even when we lose . It's what sets us apart. Trust me if we don't get a handle on this and soon , it will be our undoing too. 2020 is done, Trump lost , Biden won and it's time to move on,but it's not time to stop examining what did go wrong and if these electronic voting machines are worth a crap.
You know Dominion machines can be faulty and Biden still win and both be true.
And why is that? We have a Rightwing media industry invested in keeping people like you believing crazy conspiracy theories -- like an election that Biden won by SEVEN MILLION VOTES and 305 electorial college votes was 'stolen' from Trump.
Okay, the easy answer is to invest more money in technical security. But are we hearing that from the GOP? No? Weird, I wonder what this is all about then?
Baloney. Any widespread 'issue' with voter fraud began with a sitting President's rants to avoid admitting defeat.
I agree with you that our democracy cannot survive if people can't trust the results. But the doubt is being spread by the Trump crowd -- and the election shenanighans being pulled in various Statehouses to influence future elections -- is all coming from the GOP.
Again, I took no interest in the 'Election Fraud' non-sense from the MAGA camp. It was only when my colleagues in DC said, "Hey Bryan, check out CISA's audit." These are registered Democrats and Trump hating Progressives no less! Even they are saying, "Holy ****!" And then I did too!
And thats the thing ...
Exactly!!! Thank you!!!
Dominion is trying to blame Fox News for them losing $600M in new deals -- I mean, everyone, read their filing, that's their 'meat'n potatoes,' financially!
That's why I don't see this going well for Dominion. They may even win their argument against Fox News, and be awarded $1 or something well short of $600M, but not prove Fox News as responsible for it, and Fox News is not liable at the same time for lost sales. That should very much be the case.
Just like with the whole Sussmann trial, who I even agreed -- based on the civics as presented in trial (I love civics) -- that he could not be. But, indeed, the DoJ leadership told the FBI leadership to lie to their own agents, and commit fraud in the FISA courts. That was proven in the courts, and the bigger takeaway.
When both the Conservatives and Progressives here stop being 'my team/your team' and look at how both are ****ing over the country, we're going to move on and be a far better country. Until then, embrace the anti-freedom. Embrace the police state. Embrace more arguments for more issues.
BOOM! My work here is done.
Thank you!
No, it's to stop buying purposely known and shoddy products, but ... our system is an oligarchy. It's about who greases which politicians. Dominion's basic design isn't even valid for the 1990s, much more 2020s!
And there you go again! This is not about the GOP ... but Dominion and people who buy those things! I'm sorry you want to 'get' Fox News and 'right wingers' and everything else.
But Dominion has a very, very difficult case, especially on the liability claim if $600M, and it's likely out of desperation because they are finally going bankrupt for not giving a flying **** about fixing their horrendous product.
It's not about Cyber/IA funding at all! But you keep talking about that, and other 'expertise' you have, versus people like me. Man, and @Ucfmikes says I'm the one 'acting like an expert' on everything?!
This isn't even a partisan reality.
Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal Cabal
