In the United States, the computers that were used for counting votes in the elections appear to have had a significant vulnerability that was likely used to manipulate the results. The systems sold by Essvote included outdated remote access software.
The Election-machines are not the terminals that receive votes from citizens. On the contrary, they are located in the central election offices of each prefecture, and in some cases, include software that automatically schedules all the country's terminals. They also collect and aggregate all votes from the terminals.
According to a report by Motherboard, Essvote admitted that it had used the PcAnywhere program, a remote management program, on some of its systems between 2000 and 2006. In the same report, while Essvote initially denied using the program, it later claimed that although PcAnywhere was included in its systems, no one knew of its existence, and therefore it could not have been used. The systems were used in many states, and in 2006, at least 60% of the votes were counted through those systems.
In 2006, hackers stole the source code of PcAnywhere, which was not disclosed until 2012, when one of the hackers published part of the code online, where Symantec admitted the theft. Shortly later, security researchers discovered a vulnerability in the program that allowed access to computers running the program without any authentication. At that time, 150,000 computers were exposed to this vulnerability.
What is worrying is the fact that Symantec, the company that created PcAnywhere, refused to speak specifically with Motherboard about the security and reliability of the program, as well as about new bugs that may have been found.
“Όταν μια εταιρεία που είναι υπεύθυνη για παραπάνω από τους μισούς ψήφους των ΗΠΑ αρνείται να απαντήσει κάποιες βασικές ερωτήσεις σχετικά με την ασφάλεια που παρέχει, κάτι πρέπει να κρύβει.”
