/test/ - Test Board

pt 3/5

High-level view of voting system

EMS [Election Management Systems]

Mid-level co's (Harp [vs Hart?], 30+ others) use vote co's hardware & software

Vote co's: ES&S, Hart, SGO Smartmatic, Dominion, Premier (Diebold), Tenex

Central counting: pollbooks/voter rolls, tabulation/reporting SW, unofficial/official DB [Stored in cloud!]

-> Clarity Elections, Tampa FL - owned by SCYTL, Barcelona. 28 states use this ENR [Election Night Reporting] system

Clarity servers in Frankfurt, DE. ex: Dallas, TX .csv d/l, created +6 TZ _east_ = Europe

+GCR, VR Systems, Arikkan

-> to Associated Press or Decision Desk HQ -> media

bug/malware in Scytl allows capturing creds reporting into system

Official db -> Sec of State, but doesn't really matter, can go (((unofficial)))->official

Found ways to change votes at:

- Voting place

- Tabulation SW (ex in KY)

- Unofficial db

- Election Mgmt Systems

- Clarity Elections (its a mess)

Dallas in 2018

credible people reporting they saw NGP VAN playing in these DBs

NGP VAN = Voter Analytics for Dems, ala Cambridge Analytics in 2016 but NGP VAN was ignored

look at history of primaries, draw relationships early voting to election day

algorithms based on primaries + early voting, predict what happens on election day

at end of early voting, "how many early votes needed to be +/- to win on Election Day?" projection

original votes from precinct sent via Flash memory cards

-> ES&S Operator at county level -> updating Clarity/AWS -> Scytl/cloud

ES&S Op has its own laptop, brought in/out of tabulation room during early voting/election day

observed taking a thumbdrive out of laptop and plugging in

we saw NGP VAN interacting with this stream

they want to get early votes and upload every single day

so they can upload and change their election day forecast

wtf was NGP VAN doing putting things into the stream? = timestamp mismatch (1000x)

Typical Scytl vulns

Typical Scytl vulns

QSnatch malware, inside Scytl staging, fake login, backdoor, exfil

Persistence: impossible to run needed FW updates, once infected full factory reset must be done on the device

Prove to yourself Scytl is hosted in Frankfurt, DE

scytl.com = 52.57.209.147 = ec2-52-57-209-147.eu-central-1.compute.amazonaws.com AMAZON-02 ASN16509 Germany https://bgpview.io/asn/16509

[11/22 update:

scytl.com has address 18.196.162.197

scytl.com has address 205.178.189.131

scytl.com mail is handled by 0 scytl-com.mail.protection.outlook.com.

197.162.196.18.in-addr.arpa domain name pointer ec2-18-196-162-197.eu-central-1.compute.amazonaws.com.

131.189.178.205.in-addr.arpa domain name pointer wf.networksolutions.com.

hosted on same AWS server:

scytl.com mysitepre.scytl.com socialmedia.scytl.com owa.scytl.com ppm.scytl.com mysite.scytl.com ots.scytl.com owasppre.scytl.com mielectionspro2014.scytl.com epropagande.scytl.com owasp.scytl.com test.scytl.com agm.scytl.com bck.scytl.com unauthorized.scytl.com mail3.scytl.com premi2014.scytl.com demo.scytl.com hrm.scytl.com alm.scytl.com edemocracy-experience.scytl.com inside.scytl.com smtp2.scytl.com dmspre.scytl.com

>>11740531 pb

scytl us = 107.180.228.13 dp-1f0253cda2.dreamhostps.com as of 1/20, before, it was on Amazon server-54-192-30-99.iad89.r.cloudfront.net...]

eu-central-1 = Europe (Frankfurt) Region in AWS https://docs aws amazon com/AWSCloudFormation/latest/UserGuide/cfn-sample-templates-eu-central-1 html