Hacker News Reader

Comment by gruez | Hacker News Reader

>Even easier than hacking through router bugs is just setting up an imposter cell-phone “tower” near the voting machine; one commonly used brand of these, used by many police departments, is called “Stingray.”

am i too optimistic to assume that the voting machines at least use TLS?

View on HN

That's mostly irrelevant, since that only protects the integrity and confidentiality of that TCP connection. However, you can still exploit the vulnerabilities of all the services listening on the device. Separating voting machine networks from the internet is orthogonal to the problem of network protocol hardening between endpoints within this "separated" network.

That's not a very scalable hack.

As dnet mentioned, that only protects the session data -- never assume that the device is setup securely or even competently. There are plenty of stories out there about traffic controls that are hooked to unsecured Mifi devices. [1] There will be remote management ports or other ways to access the device.

The other thing where router hacking is productive is that the typical "secure connectivity" solution offered by carriers for this sort of application is MPLS. Compromising the router with something like this makes it even easier for a entity that compromises the network to identify the traffic that is of interest!

[1] https://arstechnica.com/information-technology/2014/08/resea...

Reply on news.ycombinator.com