In Part 1 of this series on the explosive testimony and demonstration of University of Michigan Professor Dr. J Alex Halderman in the federal lawsuit Curling v. Raffensperger, The Gateway Pundit covered more in-depth the ease of exploiting the “BIC pen hack” and, further, the simple and inexpensive creation of voter, poll-worker, and, most importantly, technician Smart cards to attack the Dominion ICX BMD or ballot marking device.
But there was much more revealed in Judge Totenberg’s courtroom regarding the vulnerabilities of these electronic voting devices.
To summarize Part 1, Dr. Halderman was able to use a simple BIC ball-point pen to reboot a Dominion ICX BMD by simply inserting it into the power button on the back of the machine and hold it down for five seconds. This rebooted the machine into Safe Mode and allowed Super User access, granting the attacker almost unlimited abilities to manipulate data on the machine.
Professor Halderman was also able to use a Smart card purchased for $10 online and a $20 USB Smart card Reader from Amazon to program voter cards that could be used over and over again, county-wide. He also made a poll-worker card and, most importantly, a technician card that would also grant “Super User access.”
We learned that commands to manipulate the Dominion ICX BMD could be automated – simply insert the card and it will do the rest. Further, nothing was needed that wasn’t public information to complete the programming.
These cards would require some expertise to program, but once the counterfeit cards are made, anyone could insert it into the machine and exploit the vulnerability automatically.
Here again is the transcript from the court hearing and Professor Halderman’s testimony.
But there has to be a way that these attacks could be detected, right? Not necessarily.
No Evidence of Exploitation
Dr. Halderman then demonstrated how he can delete portions of the system’s audit log in order to delete any evidence that he had accessed and modified the system. Dr. Halderman testified:
Professor Halderman: “So now I’m back in the technician menu…and what I’m going to do is I’m going to go to the file manager and open the ICX’s audit log file. This is one of the log files that the machine creates, and I’m going to open it with the on-screen text editor.
What I have just done with the technician card is I have loaded this technician card with the automated commands that I want to run in a way that they appear in the audit log. But I’m going to open the audit log and edit it with the on-screen text editor.
I’m actually going to highlight a portion that came from my card and hit the cut button to move it to the machine’s clipboard. And I’m going to save the audit log just to show you that I can delete portions of the audit log with the on-screen text editor.
Dr. Halderman described it as deleting log entries “that would otherwise be evidence of some malfeasance.” He can cover his tracks from anyone being able to discover the access he had and what he was able to do to the Dominion ICX BMDs.
Seemingly for demonstrative purposes, Dr. Halderman performed each step manually, but he testified that it can be done “programmatically”. Insert the card and let the machine do the rest. He also testified that he can quickly insert a command that would “take the other automated commands out of the log file that were copied from my technician card and execute them.”
The Bash Bunny
Next, Dr. Halderman demonstrated perhaps the most serious of the vulnerability exploits, in this author’s opinion, at least.
The following demonstration was not done live in court, but rather through a continuous video recording utilizing the Fulton County Dominion ICX BMD (ballot marking device). This video was played live before the court.
The “attacker” in the video reached behind the printer that accompanies the Dominion ICX BMD and unplugged the USB cable and plugged in what is called a Bash Bunny. The device looks like a big USB stick, but with the Bash Bunny, the “attacker” is “able to load it with a sequence of commands that it will then send to the device as if it were a keyboard.”
“…The Bash Bunny will start driving the device, and you can see that it is moving through a sequence of things on the screen. This is the USB device controlling it.
And it is going to go through and modify settings, as I describe in the report. It is going to then open a terminal, get superuser access, and take steps to install malicious software that is stored on that same USB device.
Now, the USB — the malicious software is a version of the ICX application that we have — we have extracted from the machine and slightly modified it to add some malicious functionality. And the Bash Bunny device is installing the malicious version of the application on the machine and replacing the version that regularly would function.”
All of this was done automatically. The “attacker” simply plugged in the USB device and it completed its installation and replacement of the software in less than two minutes. Once the Bash Bunny is programmed, there is no special skill required to initiate this attack.
The Bash Bunny costs about $100 and can be utilized without removing or tampering with any of the seals on the Dominion ICX BMD. As Dr. Halderman testified, an “attacker” can utilize a cable coming off the printer to connect the Bash Bunny rather than removing a seal and connecting it directly to the Dominion ICX BMD. That connection is not typically sealed, according to Dr. Halderman.
Part 3 of this series will follow.
During the testimony of Dr. Halderman, attorney David Oles was not permitted to ask any questions of Dr. Halderman. Oles represents co-plaintiff Ricardo Davis of VoterGA.org. Yesterday, The Gateway Pundit reported that Oles was able to get proffers submitted to the court regarding Dr. Halderman and Dr. Philip Stark’s testimonies.
The trial that includes this explosive testimony and live demonstration is currently underway in the Northern District of Georgia in Judge Amy Totenberg’s court.
