Finally! Forensic Election Audit in Maricopa County (AZ) Begins Next Week

originally posted by: Boadicea
a reply to: tanstaafl
One of this things mentioned during the latest hearing is that the same password was used by everyone since the machine was put into service. So am I understanding correctly that because there was only one password used, ever, that they would not necessarily know the specific person?

Correct. That, all by itself, is such a massive security fail that it boggles the mind.

And would this include where any access originated?

To an extent. That kind of information can be obfuscated and even manipulated to show false information, but someone would have to know what they were doing. Technically inclined spooks could do it.

So could the logs tell them from where someone was accessing the machines? And how would that appear? Would the logs show a geographical location it was being accessed from? Or a specific computer the accessor was using?

It simply shows IP addresses. You can then find out where any particular IP address is allocated (down to a Company and/or physical location) with the right access.

And is it safe for me to assume it would also show if any information transmitted/downloaded during that access? But not necessarily the information transmitted/downloaded?

Correct. You could even determine file sizes, and depending on the log levels that were set, you could possibly see filenames. But not the data itself.

Sorry for all the questions... if you cannot/don't want to answer, that's fine. I'm just trying to understand it for myself!

No worries... I'm not a forensics expert, and may be a little off on some details...

originally posted by: network dude
a reply to: Boadicea
IP addresses can be used to identify the location of the intrusion, but VPN's can mask the locations and obfuscate the identity.

Correct. But if there really are serious white hats involved, then they likely own all of the VPN service providers, so they'd be able to 'unmask' everything.

originally posted by: Boadicea
a reply to: tanstaafl
is it possible there is more than one rat? (Well, of course it's possible! We're talking politics!!!)

To quote a fave...

"The waiting is the hardest part."

a reply to: tanstaafl

Thank you soooooooo much! And I'm sorry to be such a pain... I confess that I shamelessly pick other people's brains when I want/need to understand something. And here I go again...

Correct. You could even determine file sizes, and depending on the log levels that were set, you could possibly see filenames. But not the data itself.

My mind is spiraling now... what iffing...

So purely hypothetically speaking (LOL!), if someone accessed the machines early the morning of Election Day to download/upload 10,000 brand spanking new bogus voter registrations, would it be possible to cross reference data logs or something to match the transmission with the end result? Would it show exactly where that new data was download/uploaded (I'm not sure of the correct term here), as in directly to the voter registration database? Or would someone have to actually look at all that happened anywhere and everywhere on the system, and then identify and isolate a 10gb download on the router logs with a 10gb download at the same time on the registration database?

a reply to: tanstaafl


Thank you!

I was hoping you (or a one of a few others) would post this before I attempted again.

You accurately covered many of the main 'router' issues in less technical terms.

I've tried to make it non technical enough for consumption here before, and didn't do very well.

originally posted by: Boadicea
a reply to: tanstaafl
So purely hypothetically speaking (LOL!), if someone accessed the machines early the morning of Election Day to download/upload 10,000 brand spanking new bogus voter registrations, would it be possible to cross reference data logs or something to match the transmission with the end result?

It should be, again, assuming the logs are there and intact.

Would it show exactly where that new data was download/uploaded (I'm not sure of the correct term here), as in directly to the voter registration database?

No, more than likely it would simply be RDP access (think Remote Desktop), and the databsse file would be uploaded that way. All you'd see in the splunk/router logs is connections, IP addresses, and packet traffic, all date/time stamped of course

That said - I'm not exactly sure what may or may not be possible to someone with access to everything and skills that would make me look like a 2 yr old playing with a remote control.

Or would someone have to actually look at all that happened anywhere and everywhere on the system, and then identify and isolate a 10gb download on the router logs with a 10gb download at the same time on the registration database?

Nothing like that.

Now, these systems should absolutely have system level Auditing enabled, and that will provide a crap ton more information on who did what. But if everyone was using a single shared set of credentials, (username/password), then you couldn't nail anything down to an individual person.

a reply to: Boadicea


"Was this to me? One of what or who can be debunked"


'Debunked' in this case refers to absurd democrat claims that dominion machines must now be replaced due to potential alteration by ninjas, and that audit results can't be trusted because ninjas may have modified dominion data.

originally posted by: Nunyabizisit
a reply to: tanstaafl
I've tried to make it non technical enough for consumption here before, and didn't do very well.

Rotflmao! That is because my knowledge and skills are more general and higher level (higher in a sense of being less technical and more management level). I'm just a sysadmin, I manage a small shop, couple of VMWare hosts and less than a dozen virtual machines, a few switches, any our Watchguard perimeter firewall/intrusion detection/router device, a bunch of VoIP phones, etc...

I can manage some simple scripts, but I'm sure any competent programmer would either just have a good laugh or run away screaming if they got a look at any of the ones I've written.

a reply to: tanstaafl

I work in the software industry and see 100's of networks each year. There is one thing I have learned and expressed to all clients....

If they want in...they will get in.

Does not matter the security. Does not matter how much you pay. Does not matter how strong you think you security is.

If they want in...they will get in.

All of this talk just takes me back to 2015-2016 when the US government wanted to 'audit' the voting in all states. There were NSA intrusions. There were DHS intrusions. All swept away after 45 got in. Then when he tried to make sure security for voting was correct the commission he created was disbanded.

originally posted by: matafuchs
a reply to: tanstaafl

I work in the software industry and see 100's of networks each year. There is one thing I have learned and expressed to all clients....

If they want in...they will get in.

No argument here.

originally posted by: tanstaafl

originally posted by: Nunyabizisit
a reply to: tanstaafl
I've tried to make it non technical enough for consumption here before, and didn't do very well.

Rotflmao! That is because my knowledge and skills are more general and higher level (higher in a sense of being less technical and more management level). I'm just a sysadmin, I manage a small shop, couple of VMWare hosts and less than a dozen virtual machines, a few switches, any our Watchguard perimeter firewall/intrusion detection/router device, a bunch of VoIP phones, etc...

I can manage some simple scripts, but I'm sure any competent programmer would either just have a good laugh or run away screaming if they got a look at any of the ones I've written.

Am pretty similar, except haven't managed my own machines for quite a while now.

And I specialized in Citrix/HyperV instead of VMWare (just due to clients I was serving).

originally posted by: Nunyabizisit
Am pretty similar, except haven't managed my own machines for quite a while now.

Yeah, I'd delegate that... if there was someone to delegate it to. I'm a one man shop for this small company (50-90 employees over the last 22 years).

And I specialized in Citrix/HyperV instead of VMWare (just due to clients I was serving).

Been thinking of switching to Hyper-V... may do that the next time the licenses and/or servers need a refresh...

a reply to: Nunyabizisit

Thank you -- that makes sense now.

I wasn't sure what to make of it at first. I had too much in my head!

a reply to: Boadicea

One thing about the intrusion possibility is that the machines were not supposed to be connected to the internet at all. And each machine has a "mac" address associated with the network port. It's specific to each machine, and none are the same, so if a voting machine was tied to the network at the time of election, the routers should have that data stored in the log files. All that is needed to cause a really, really large stink is to find ONE voting machine tied to the internet during election time.

I have a feeling that is why the routers aren't being turned over.

originally posted by: network dude
a reply to: Boadicea

One thing about the intrusion possibility is that the machines were not supposed to be connected to the internet at all. And each machine has a "mac" address associated with the network port. It's specific to each machine, and none are the same, so if a voting machine was tied to the network at the time of election, the routers should have that data stored in the log files. All that is needed to cause a really, really large stink is to find ONE voting machine tied to the internet during election time.

I have a feeling that is why the routers aren't being turned over.

THIS ^^^

AND

There is also suspicion in some circles that there were internal breaches of some sort.

Router logs can point directly to the perpetrator(s) in that case.

Example: the 'external' breach from Fountain Hills discovered on election day was initially reported as having been done by a recently terminated I.T. contractor for government.

Though that bit was quickly removed from the few news reports on that subject.

It initial news was accurate, it is very likely that bad guy earlier breached internally, or did from government provided remote access.

Gaining access this way would have avoided passing through DMZ/Edge, where 99% of security monitoring takes place in most organizations, but evidence of such would still be available through the router logs.

And I'm nowhere near as knowledgeable about networks as you two, but if Mike Lindell has the election data he claims to have, all the packet captures of every hacked voting machine and every altered vote, and the county router records happen to match, wouldn't that also be a big deal?

originally posted by: IndieA
And I'm nowhere near as knowledgeable about networks as you two, but if Mike Lindell has the election data he claims to have, all the packet captures of every hacked voting machine and every altered vote, and the county router records happen to match, wouldn't that also be a big deal?

I don't think he actually made that claim (technical differences).

Though his wording seemed intentionally ambiguous on the details, and reporters have embellished even further.

Would be easier to believe after skilled folks actually get access to his data.

He probably has something, but doubt it is as complete as your post implies.

No way to tell until actually looking at the data.

Same as actually looking at ballots.






ETA:

But yes, if he has what you indicated, it is Hiroshima, and war is effectively won.

Oh my golly gee whillickers! There's much to post, and I'm reading as I post, so I may not excerpt much. These are all from Gateway Pundit... I'll follow up with more as I find it. Let's start here:

Biden DOJ Steps In – Issues Guidelines Cautioning States Performing Audits of Election Results

ABC News reported:

The Justice Department on Wednesday released guidance intended to caution states embarking on so-called post-election ‘audits’ of vote counts for the 2020 presidential election that they must not run afoul of federal voting laws.

The guidance, previously previewed last month by Attorney General Merrick Garland in his policy address on voting rights, outlines federal statutes that the department says elections officials must adhere to during such “audits,” such as preserving all federal elections materials and making sure they’re not tampered with.

“This document sets down a marker that says the Justice Department is concerned about this, and we will be following this closely,” a DOJ official told reporters on a media conference call Wednesday.

Oh the lollylolz!!!

It's getting away from them... teeheehee!

More from ABC:

DOJ issues guidance cautioning states on so-called election 'audits'

a reply to: Boadicea

They're getting ascared !!

And this is what "getting away from them" looks like:

Michigan Hero Sheriff is Digging into Dominion Machines – Barry County Clerk Claims There Were No Issues but Lawyers Up

‘Over my dead body,’ Michigan clerk says as investigator seeks to question her about Dominion voting machines

Executive Committee of Dane County Wisconsin Republican Party Votes Unanimously to Support Rep. Brandtjen’s Proposed Forensic Audit

LAA Voter Integrity Project: 157,299 Illegal Ballots Cast in Wisconsin Presidential Election

Breaking: Maryland Voter Integrity Group Finds Serious Anomalies in Four Maryland Counties

It's looking like election audits are almost as infectious as the Delta variant...