11-Year-Old Hacks A State Election Replica Website In Under 10 Minutes At DEFCON

 At DEFCON 26, the world’s largest hacking convention that recently  took place in Las Vegas, an 11-year-old boy managed to hack a replica of  the Florida state election website and change voting results in less  than 10 minutes. Organizers of the event said that at least 30 children  were able to hack similar replica websites in under a half hour,  including an 11-year-old girl who completed the job in just under 15  minutes. One of the attractions of the event was the “DEFCON Voting Machine  Hacking Village,” which allowed kids as young as 8 to take a shot at  stealing a simulated election. 

Nico Sell, co-founder of the non-profit r00tz Asylum, told the PBS NewsHour that these kids were able to hack sites that were exactly like those used for official elections in the United States. “These are very accurate replicas of all of the sites. These  things should not be easy enough for an 8-year-old kid to hack within 30  minutes, it’s negligent for us as a society,” Sell says. Sell said that when they first tried a similar challenge last year,  adult hackers were able to crack the websites in under five minutes. “So this year we decided to bring the voting village to the kids as well,” she said.   

However, the government is not ready to admit that they are using such vulnerable technology to conduct their elections. The National Association of Secretaries of State issued a statement saying that they were “ready  to work with civic-minded members of the DEFCON community wanting to  become part of a proactive team effort to secure our elections.” 

However, they also claimed that it is not possible to replicate an actual government election website. 

“It would be extremely difficult to replicate these systems since  many states utilize unique networks and custom-built databases with new  and updated security protocols. While it is undeniable websites are  vulnerable to hackers, election night reporting websites are only used  to publish preliminary, unofficial results for the public and the media.  The sites are not connected to vote-counting equipment and could never  change actual election results,”’ the statement read.

 In other words, they claim that they will still be able to retain the  actual results, even if a legitimate election website happens to be  tampered with. Sell pointed out that the response from election  officials shows that they either don’t understand or don’t care about  the chaos that can be caused by false election results being published,  even if they are corrected after the fact. 

“To me, that statement says that the secretaries of states are  not taking this seriously. Although it’s not the real voting results  it’s the results that get released to the public. And that could cause  complete chaos. The site may be a replica but the vulnerabilities that  these kids were exploiting were not replicas, they’re the real thing. I  think the general public does not understand how large a threat this is,  and how serious a situation that we’re in right now with our  democracy,” she said. 

Furthermore, Matt Blaze, a professor at the University of  Pennsylvania and one of the organizers of the “hacking village,” said  that these replica websites were actually designed to be more difficult  to hack than the official government sites. “It’s not surprising that these precocious, bright kids would be  able to do it because the websites that are on the internet are  vulnerable, we know they are vulnerable. What was interesting is just  how utterly quickly they were able to do it,” he said. 

Adult hackers were also able to break into actual voting machines during the convention. It has long been an open secret that election websites and even  voting machines are extremely vulnerable to hacking.

In fact, a study at  the Argonne National Laboratory in Illinois developed a hack to  manipulate voting machines just before the 2012 elections. The researchers who developed the hack were actually able to hijack a Diebold Accuvote TS electronic voting machine, one of the most popular voting systems at the time. 

Two of the lead researchers in the study were able to demonstrate a  number of different ways that voting machines could be hacked. They used  a $1.29 microprocessor and a circuit board that costs about $8, along  with a $15 remote control. 

They demonstrated that the cheap hack worked from over a half-mile away. “When the voter hits the ‘vote now’ button to register his votes,  we can blank the screen and then go back and vote differently and the  voter will be unaware that this has happened. Spend an extra four bucks  and get a better lock, you don’t have to have state-of-the-art security,  but you can do some things where it takes at least a little bit of  skill to get in,” Johnson said. As far as how easy the hack is, Johnson told Popsci that “I’ve been to high school science fairs where the kids had more sophisticated microprocessor projects.”