On Friday an 11-year-old boy hacked into a replica of the Florida state election website and changed voting results found there in under 10 minutes.
DEFCON 26 featured an event where a group of children attempted to hack 13 imitation websites linked to voting in presidential battleground states.
The boy, who was identified by DEFCON officials as Emmett Brewer, accessed a replica of the Florida secretary of state’s website. He was one of about 50 children between the ages of eight and 16 who were taking part in the so-called “DEFCON Voting Machine Hacking Village”, a portion of which allowed kids the chance to manipulate party names, candidate names and vote count totals.
Nico Sell, the co-founder of the the non-profit r00tz Asylum, which teaches children how to become hackers and helped organize the event, said an 11 year old girl also managed to make changes to the same Florida replica website in about 15 minutes, tripling the number of votes found there.
Sell said more than 30 children hacked a variety of other similar state replica websites in under a half hour.
“These are very accurate replicas of all of the sites. These things should not be easy enough for an eight year old kid to hack within 30 minutes, it’s negligent for us as a society.”
About 50 children participated in the DEFCON hacking event for children on Friday and Saturday. More than 30 of them were able to hack into replicas of secretaries of states, where vote tallies are posted.
The National Association of Secretaries of State said it is “ready to work with civic-minded members of the DEFCON community wanting to become part of a proactive team effort to secure our elections”. But the organisation expressed skepticism over the hackers’ abilities to access the actual state websites.
“It would be extremely difficult to replicate these systems since many states use unique networks and custom-built databases with new and updated security protocols. While it is undeniable websites are vulnerable to hackers, election night reporting websites are only used to publish preliminary, unofficial results for the public and the media. The sites are not connected to vote counting equipment and could never change actual election results.”’
But Sell said the statement meant that the secretaries of states were not taking this seriously. Although it’s not the real voting results it’s the results that get released to the public. And that could cause complete chaos. site may be a replica "but the vulnerabilities that these kids were exploiting were not replicas, they’re the real thing”.