J. Alex Halderman explaining how to hack into an electronic voting machine in a previous lecture.<\/p>\n
\u00a0<\/p>\n
In Part 1 of this series on the explosive testimony and demonstration of University of Michigan Professor Dr. J Alex Halderman in the federal lawsuit Curling v. Raffensperger, The Gateway Pundit covered more in-depth the ease of exploiting the \u201cBIC pen hack\u201d<\/a> and, further, the simple and inexpensive creation of voter, poll-worker, and, most importantly, technician Smart cards to attack the Dominion ICX BMD or ballot marking device.<\/p>\n Part 1 can be read here.<\/a><\/p>\n But there was much more revealed in Judge Totenberg\u2019s courtroom regarding the vulnerabilities of these electronic voting devices.<\/p>\n To summarize Part 1, Dr. Halderman was able to use a simple BIC ball-point pen to reboot a Dominion ICX BMD by simply inserting it into the power button on the back of the machine and hold it down for five seconds.\u00a0 This rebooted the machine into Safe Mode and allowed Super User access, granting the attacker almost unlimited abilities to manipulate data on the machine.<\/p>\n Professor Halderman was also able to use a Smart card purchased for $10 online and a $20 USB Smart card Reader from Amazon to program voter cards that could be used over and over again, county-wide.\u00a0 He also made a poll-worker card and, most importantly, a technician card that would also grant \u201cSuper User access.\u201d<\/p>\n We learned that commands to manipulate the Dominion ICX BMD could be automated \u2013 simply insert the card and it will do the rest.\u00a0 Further, nothing was needed that wasn\u2019t public information to complete the programming.<\/p>\n These cards would require some expertise to program, but once the counterfeit cards are made, anyone could insert it into the machine and exploit the vulnerability automatically.<\/p>\n Here again is the transcript from the court hearing and Professor Halderman\u2019s testimony.\n<\/p>\n But there has to be a way that these attacks could be detected, right?\u00a0 Not necessarily.<\/p>\n Dr. Halderman then demonstrated how he can delete portions of the system\u2019s audit log in order to delete any evidence that he had accessed and modified the system<\/strong>.\u00a0 Dr. Halderman testified:<\/p>\n Professor Halderman:<\/strong> \u201cSo now I\u2019m back in the technician menu\u2026and what I\u2019m going to do is I\u2019m going to go to the file manager and open the ICX\u2019s audit log file.\u00a0 This is one of the log files that the machine creates, and I\u2019m going to open it with the on-screen text editor.<\/p>\n What I have just done with the technician card is I have loaded this technician card with the automated commands that I want to run in a way that they appear in the audit log.\u00a0 But I\u2019m going to open the audit log and edit it with the on-screen text editor.<\/strong><\/p>\n I\u2019m actually going to highlight a portion that came from my card and hit the cut button to move it to the machine\u2019s clipboard.\u00a0 And I\u2019m going to save the audit log just to show you that I can delete portions of the audit log with the on-screen text editor.<\/strong><\/p>\n Dr. Halderman described it as deleting log entries \u201cthat would otherwise be evidence of some malfeasance.\u201d<\/strong>\u00a0 He can cover his tracks from anyone being able to discover the access he had and what he was able to do to the Dominion ICX BMDs.<\/p>\n Seemingly for demonstrative purposes, Dr. Halderman performed each step manually, but he testified that it can be done \u201cprogrammatically\u201d.\u00a0 Insert the card and let the machine do the rest.\u00a0 He also testified that he can quickly insert a command that would \u201ctake the other automated commands out of the log file that were copied from my technician card and execute them.\u201d<\/strong><\/p>\n Next, Dr. Halderman demonstrated perhaps the most serious of the vulnerability exploits, in this author\u2019s opinion, at least.<\/p>\n The following demonstration was not done live in court, but rather through a continuous video recording utilizing the Fulton County Dominion ICX BMD (ballot marking device).\u00a0 This video was played live before the court.<\/p>\n The \u201cattacker\u201d in the video reached behind the printer that accompanies the Dominion ICX BMD and unplugged the USB cable and plugged in what is called a Bash Bunny.\u00a0 The device looks like a big USB stick, but with the Bash Bunny, the \u201cattacker\u201d is \u201cable to load it with a sequence of commands that it will then send to the device as if it were a keyboard.\u201d<\/p>\n \u201c\u2026The Bash Bunny will start driving the device, and you can see that it is moving through a sequence of things on the screen.\u00a0 This is the USB device controlling it.<\/p>\n And it is going to go through and modify settings, as I describe in the report.\u00a0 It is going to then open a terminal, get superuser access, and take steps to install malicious software<\/strong> that is stored on that same USB device.<\/p>\n Now, the USB \u2014 the malicious software is a version of the ICX application that we have \u2014 we have extracted from the machine and slightly modified it to add some malicious functionality.\u00a0 And the Bash Bunny device is installing the malicious version of the application on the machine and replacing the version that regularly would function.\u201d<\/p>\n All of this was done automatically<\/strong>.\u00a0 The \u201cattacker\u201d simply plugged in the USB device and it completed its installation and replacement of the software in less than two minutes.\u00a0\u00a0<\/strong>Once the Bash Bunny is programmed, there is no special skill required to initiate this attack.<\/strong><\/p>\n The Bash Bunny costs about $100 and can be utilized without removing or tampering with any of the seals<\/strong> on the Dominion ICX BMD.\u00a0 As Dr. Halderman testified, an \u201cattacker\u201d can utilize a cable coming off the printer to connect the Bash Bunny rather than removing a seal and connecting it directly to the Dominion ICX BMD.\u00a0 That connection is not typically sealed, according to Dr. Halderman.<\/p>\n Part 3 of this series will follow.<\/em><\/p>\n During the testimony of Dr. Halderman, attorney David Oles was not permitted to ask any questions of Dr. Halderman.\u00a0 Oles represents co-plaintiff Ricardo Davis of VoterGA.org.\u00a0 Yesterday, The Gateway Pundit reported that Oles was able to get proffers submitted to the court regarding Dr. Halderman and Dr. Philip Stark\u2019s testimonies.<\/p>\n The Culling vs. Raffensperger Lawsuit: Evidence of Voting Machine Vulnerabilities and Fulton County 2020 Election Issues Entered into the Federal Record | The Gateway Pundit | by Brian Lupo<\/a><\/p>\n The trial that includes this explosive testimony and live demonstration is currently underway in the Northern District of Georgia in Judge Amy Totenberg\u2019s court.<\/p>\n \u00a0<\/p>\n The post Part 2: Full Scope of Dominion Voting Machine Hack in Federal Court is FAR Worse than Just the BIC Pen Hack \u2013 Audit Logs Can Be Edited<\/a> appeared first on The Gateway Pundit<\/a>.<\/p>","protected":false},"excerpt":{"rendered":" J. Alex Halderman explaining how to hack into an electronic voting machine in a previous lecture. \u00a0 In<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-24033","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"\nNo Evidence of Exploitation<\/h4>\n
The Bash Bunny<\/h4>\n