Hacker House Exposes Major Vulnerability in US Election Voting Machines

A popular electronic voting machine used in at least 16 States during local State and county elections
in 2016 - and which is due to be used in some upcoming elections - has been found to have serious
security flaws. In a recent blog post, cyber security firm Hacker House demonstrated how attackers
could gain “full reign” over the machine with relative ease. The research by Hacker House, which
expands upon existing efforts to enhance the US voting experience, highlights the inherent risks in
existing electronic voting systems to the US democratic election process.

The machine in question is the Diebold AccuVote-TSx, a voting device which has made frequent
appearances in news articles discussing the failed state of electronic voting systems. In its blog post,
Hacker House illustrates how the machine’s security can be breached, giving users access to
confidential data and the means to manipulate the device’s functionality. In this instance, Hacker
House reprogrammed the machine to play desktop games, but Matthew Hickey, Director at Hacker
House, explains that the consequences for the democratic voting system are incredibly serious:

“An election voting machine shouldn’t be able to do anything other than count votes. It shouldn’t
store those votes or allow users access to the voting history on that machine, and it absolutely
should not enable users to deploy malware. But we’ve shown that the DieBold machine will let a
user do all of those things. In essence, any attacker could infect the machine in a stealthy way that
could go completely unnoticed, offering the potential for votes to be manipulated and falsified.”

According to Mr. Hickey, the failure of the machine comes down to fundamentally insecure
engineering practices combined with mediocre security implementation on the machine’s OS
(operating system):

“The Diebold AccuVote-TSx makes use of what was cutting edge technology in 2003, Windows
CE.NET, and has a number of serious hardware security issues that would be unexpected in a device
being used as a key component of democratic voting. Unless serious consideration is given to re-
engineering and hardening of both hardware and software, these machines are not fit for purpose
and cannot be relied upon to store or hold information in a secure means,” he stated.

Hacker House press release 21.11.2019
“All US citizens should have the right for their personal data to be secure. It is imperative, for the
sake of our democracy, that manufacturers of electronic voting machines and the US government
actualize better security practices with urgency,” he concluded.

Hacker House specializes in cutting edge cyber security training for individuals and companies, and
works closely with manufacturers, businesses and government agencies to enhance data security for
all Americans.

A full technical break down of the reprogramming of the voting machine can be found on the Hacker
House blog.

Hacker House registered office: 3rd Floor 207 Regent Street, London, England, W1B 3HH

Press contact: Elisa Tidswell, Brand Clever, +44 1376 566899

Hacker House is a cyber security training firm led by world-renowned ethical hacker Matthew Hickey
and tech entrepreneur Jennifer Arcuri. With an aim to effectively and quickly close the skills gap in
cyber security, Hacker House equips students and corporations with the mindset and skills required
to secure systems and prevent malicious attacks. Through its pioneering Hands-On-Hacking course,
the company is bringing financially accessible and highly effective purple teaming skills to the
forefront.

This release was published on openPR.