Virginia Finally Drops Americas' 'Worst Voting Machines'

[InfoSec News <alerts () infosecnews org>]

http://www.wired.com/2015/08/virginia-finally-drops-americas-worst-voting-machines/

By Kim Zetter
Security
Wired.com
08.17.15

IF YOU VOTED in a Virginia election any time between 2003 and April of 
this year, your vote was at serious risk of being compromised by hackers.

That’s the assessment reached by Virginia’s board of elections, which 
recently decertified some 3,000 WINVote touchscreen voting machines after 
learning about security problems with the systems, including a poorly 
secured Wi-Fi feature for tallying votes.

The problems with the machines are so severe that Jeremy Epstein, a 
computer scientist with SRI International who tried for years to get them 
banned, called them the worst voting machines in the country. If the 
WINVote systems weren’t hacked in a past election, he noted in a recent 
blog post and during a presentation last week at the USENIX security 
conference, “it was only because no one tried.”

The decision to decommission the machines, which came after the state 
spent a decade repeatedly ignoring concerns raised by Epstein and others, 
is a stark reminder as the nation heads into the 2016 presidential 
election season that the ongoing problem of voting machine security is 
still not taken seriously by election officials. Virginia officials only 
examined the WINVote systems after Governor Terry McAuliffe tried to vote 
with one during the state’s general elections last November. Dismayed at 
the problems he encountered first hand trying to select a candidate in a 
Senate race, he demanded an investigation. But even after serious 
vulnerabilities were then uncovered, some election officials argued 
against replacing the machines. Richard Herrington, secretary of the 
Fairfax City Electoral Board, asserted that no voting system was secure.

[...]

--
Evident.io - Continuous Cloud Security for AWS.
Identify and mitigate risks in 5 minutes or less.
Sign up for a free trial @ https://evident.io/