U.S. District Court Judge finally unsealed the Halderman

Posted on: July 6, 2023 at 08:45:26 CT

Report on the integrity of the 2020 general election in Georgia.

Security Analysis of Georgia’s
ImageCast X Ballot Marking Devices
https://storage.courtlistener.com/recap/gov.uscourts.gand.240678/gov.uscourts.gand.240678.1681.0.pdf

"1.1 Principal Findings
I show that the ICX suffers from critical vulnerabilities that can be exploited
to subvert all of its security mechanisms, including: user authentication, data
integrity protection, access control, privilege separation, audit logs, protective
counters, hash validation, and external firmware validation. I demonstrate that
these vulnerabilities provide multiple routes by which attackers can install malicious software on Georgia’s BMDs, either with temporary physical access or
remotely from election management systems (EMSs). I explain how such malware
can alter voters’ votes while subverting all of the procedural protections practiced
by the State, including acceptance testing, hash validation, logic and accuracy
testing, external firmware validation, and risk-limiting audits (RLAs).
The most serious vulnerabilities I discovered include the following:
1. Attackers can alter the QR codes on printed ballots to modify voters’ selections. Critically, voters have no practical way to confirm that the QR codes match their intent, but they are the only part of the ballot that the scanners
count. I demonstrate how the QR codes can be modified by compromising the
BMD printer (Section 5) or by installing malware on the BMD (Section 7)."

And there's more at the link.