2024 Coffee County EMS Cybersecurity Report Updated 14 October 2026
Ben Cotton 4/17/2024
Table of Contents Summary of Findings..................................................................................................................................... 2 Qualifications ................................................................................................................................................ 2 Methodology and Tools ................................................................................................................................ 2 Coffee County EMS Disk Images ............................................................................................................... 2 Description of the Examined System .................................................................................................... 2 Forensic Images..................................................................................................................................... 3 Tools Utilized in the Analysis ..................................................................................................................... 3 Methodology............................................................................................................................................. 3 DHS Cyber Security Risks and Guidelines for Electronic Voting Systems ...................................................... 4 DHS Election Infrastructure Cyber Risk Assessment ............................................................................. 4 Department of Homeland Security Best Practices for Securing Election Systems.................................... 4 Software and Patch Management......................................................................................................... 5 Log Management .................................................................................................................................. 5 Network Segmentation ............................................................................................................................. 5 Block Suspicious Activity ........................................................................................................................... 5 Prevent Malware and Malicious Traffic ................................................................................................. 6 Disable Server Message Block v1 Protocol ........................................................................................... 6 Credential Management ........................................................................................................................... 6 Establish a Baseline for Host and Network Activity .................................................................................. 6 Network Baseline .................................................................................................................................. 6 Host Baseline......................................................................................................................................... 6 Coffee County EMS Cybersecurity Findings .................................................................................................. 7 Coffee County EMS Conformance with DHS Best Practices ...................................................................... 7 Coffee County EMS Software and Patch Management ......................................................................... 7 Network Segmentation ......................................................................................................................... 8 Block Suspicious Activity ..................................................................................................................... 10 Credential Management ......................................................................................................................... 12 Establish a Baseline for Host and Network Activity ................................................................................ 13 Network Baseline ................................................................................................................................ 13 Host Baseline Capabilities ................................................................................................................... 13
Summary of Findings Qualifications I have a master’s degree in information technology management from the University of Maryland University College. I have numerous technical certifications, including the Certified Information Systems Security Professional (CISSP), Microsoft Certified Professional (MCP), Network+, and Certified CyFIR Forensics and Incident Response Examiner. I have over twenty-seven (27) years of experience performing computer forensics and other digital systems analysis. I have over twenty (20) years of experience as an instructor of computer forensics and incident response. This experience includes thirteen (13) years of experience teaching students on the Guidance Software (now OpenText) EnCase Investigator and EnCase Enterprise software. I have testified as an expert witness in state courts, federal courts and before the United States Congress. I regularly lead engagements involving digital forensics and cyber security investigations for law firms, corporations, and government agencies. I am experienced with the digital acquisition of evidence under the Federal Rules of Evidence. I was retained by Stephanie Lambert Law to examine forensic images originating from Coffey County, Georgia and was provided access to the images by the engaging legal firm. Specific to this report, I was engaged to produce a report with respect to the cyber security status of the Coffee County Election Management System (EMS) used in the 2020 general election on 3 November 2020 and the subsequent recounts.
Methodology and Tools Coffee County EMS Disk Images Description of the Examined System The voting system used in Coffee County, Georgia for the 2020 General Election was the Dominion Democracy Suite 5.5A. The software for the Dominion Democracy Suite 5.5A was created by Dominion Voting Systems and certified by the Election Assistance Commission on 01/19/2019 under the VVSG 1.0 guidelinesi. A full listing of the tested, hence certified, components included to this report as Attachment XX - Dominion_D-Suite_5.5-A_Documentation_List. The Dominion Democracy Suite 5.5A, however, is not an operating system. The suite relies on commercial off the shelf (COTS) Dell computers running the Windows operating system to provide the operating system for the Democracy Suite application to run. The EMS can not run the suite without Microsoft windows. The EMS serves as the ‘brain’ of the election system and controls the creation of election definitions, the storage of election results, the adjudication process, the vote tabulation, and the reporting for all elections.
Based on the registry and file system metadata from the Coffee County EMS the Dominion Democracy Suite 5.5A was installed on 09/12/19 16:34:56 EST. In the case of the Coffee County EMS, the operating system was the Microsoft Windows 10 Professional and employed the Microsoft SQL server program to serve as the data server and repository for election data. Note: It should be noted that the Democracy Suite software does not prevent or protect either the operating system or the SQL data base from unauthorized access. The cyber protection for both the operating system and the SQL data base stems solely from the protections in place external to the Democracy Suite software. Note: The version of Windows 10 installed on the Coffee County EMS was not activated and raises question to the legality of using the Operating system in the course of business that is not properly licensed.
Forensic Images The security of the election data is primarily protected by the Microsoft Windows 10 Professional and Microsoft SQL server. Any compromise or unauthorized access to these two elements would place the election integrity at risk. Two forensic disk images were received from the Coffee County EMS. These disks were configured in a mirrored redundant array of independent disks (RAID) to form the operating system disk of the EMS. These disks were identified as SSA1722_CU01-EMS Server Mirror Disk1 (md5 Hash: 6b53078b3ea6bb4fbeb36b006e057470) and SSA1722_Mirror Disk2 (md5 Hash: 5228eb59ca40a75e770861fa5e6197e4). By definition, in a mirrored RAID configuration, each disk contains the same data and information. For the purposes of the analysis, the primary disk used for analysis was SSA1722_CU01-EMS Server Mirror Disk1 (md5 Hash: 6b53078b3ea6bb4fbeb36b006e057470).
Tools Utilized in the Analysis The following tools were utilized in the analysis of the Coffee County EMS: 1. EnCase Version 6.19 2. EnCase Version 22.1 3. EnCase Version 22.3 4. Digital Detective HstEx 5.2 5. Digital Detective NetAnalysis 3.2 6. Access Data FTK 7.5 7. Oracle Virtual Box 7.0 8. Registry Browser 3.0 9. Passware 2024.1.0 10. Magnet Axiom Cyber 10.0.0.48329
Methodology The cyber security analysis performed on the Coffee County EMS was in accordance with the established DOJ evidence handling procedures and followed court approved procedures for the examination of digital evidence, namely approved forensic tools were utilized to ensure that there were no changes or
modifications to the original evidence files. The original disk images were in the EnCase .E01 forensic image format. This format contains a series of checks and balances to ensure that the evidence file matches the bit for bit data that was imaged from the original disk removed from the EMS. A copy was made of each of these forensic image files and the copy was verified by hash that it was the same. Following verification of the forensic image, the copy was used for all analysis. This analysis included keyword searching, internet analysis, registry analysis, firewall analysis, network connectivity analysis, log analysis and forensic data extraction. For the purposes of demonstration, vulnerability scanning and screen capture illustration a virtual image of the EMS was created and launched in an isolated Virtual Box environment. Any findings from this analysis were subsequently validated on the forensic image with forensic tools.
DHS Cyber Security Risks and Guidelines for Electronic Voting Systems DHS Election Infrastructure Cyber Risk Assessment On July 28, 2020 DHS released an Election Infrastructure Cyber Risk Assessmentii. This sixteen (16) page document details the risks associated with the use of electronic voting systems and summarizes the findings in five (5) key findings: 1. Compromises to the integrity of state-level voter registration systems, the preparation of election data (e.g., ballot programming), vote aggregation systems, and election websites present particular risk to the ability of jurisdictions to conduct elections. 2. When proper mitigations and incident response plans are not in place, cyber attacks on the availability of state or local-level systems that support same day registration, vote center checkin, or provisional voting also have the potential to pose meaningful risk on the ability of jurisdictions to conduct elections. 3. While compromises to voting machine systems present a high consequence target for threat actors, the low likelihood of successful attacks at scale on voting machine systems during use means that there is lower risk of such incidents when compared to other infrastructure components of the election process. 4. U.S. election systems are comprised of diverse infrastructure and security controls, and many systems invest significantly in security. However, even jurisdictions that implement cybersecurity best practices are potentially vulnerable to cyber attack by sophisticated cyber actors, such as nation-state actors. 5. Disinformation campaigns conducted in concert with cyber attacks on election infrastructure can amplify disruptions of electoral processes and public distrust of election results. Four (4) of these five (5) findings deal directly with the cyber security postures of the voting systems. It should be noted that DHS also included the voter registration systems as an integral part of the electronic voting systems. A copy of this report is attached to this report as Attachment A - cisa-electioninfrastructure-cyber-risk-assessment_508.
Department of Homeland Security Best Practices for Securing Election Systems The Department of Homeland Security (DHS) has issued a number of findings and papers relevant to the status of cyber security of election systems.
On 11 November 2022 DHS issued it’s recommendation for Best Practices for Securing Election Systemsiii. A copy of these recommendations are included with this report as Attachment B - CISA Best Practices for Securing Election Systems. Within this report the DHS report recommended the following best practices, which harden enterprise networks and strengthen election infrastructure, at little or no cost:
Software and Patch Management Software and Patch Management is the process of applying updates to software and firmware to protect a system from newly discovered vulnerabilities. New vulnerabilities within systems are routinely discovered by operating system vendors, software developers and hackers on a weekly basis. These newly discovered vulnerabilities are addressed or fixed by Operating System and software developers by releasing fixes or ‘Patches’ that must be installed onto the systems that are effected. It is self evident that patching systems is an essential element to the cyber security posture of a system. Failure to patch or address known vulnerabilities increases the ease and probability that a computer system can/will be breached by unauthorized users.
Log Management Retaining and securing logs from both network devices (routers, switches, etc.) and individual computers (hosts) is essential to support triage, remediation and audits of cyber security events. These logs are critical in determining the impact of cyber security events and determine if a cyber security event actually occurred. DHS also recommended that all logging be implemented through Centralized Log Management which supports the following functions: 1. Forward collected logs from local hosts to a centralized log management server. This prevents threat actors (TA) from deleting local logs to cover up an intrusion and also preserves a copy of the logs in the event of a system failure on the local host. 2. Correlate logs from both network and local host devices. 3. Review both centralized and local log management practices to maximize efficiency and ensure the log retention for a minimum of one year. In addition to centralized log management, DHS recommended that the PowerShell program be updated to version 5.0 or above and that advanced PowerShell logging be enabled. PowerShell is a crossplatform command-line shell and scripting language that is a component of Microsoft Windows. CISA has observed threat actors, including advanced persistent threat (APT) actors, using PowerShell to hide their malicious activities. The advanced logging of the PowerShell activities enables the detection of unauthorized user activities.
Network Segmentation Proper network segmentation is an effective security mechanism to prevent an intruder from propagating exploits or laterally moving around an internal network. On a poorly segmented network, intruders are able to extend their impact to control critical devices, access databases or gain access to other sensitive data.
Block Suspicious Activity
Prevent Malware and Malicious Traffic Organizations should use antivirus, firewalls, host intrusion prevention systems, and other technologies to block malicious activity. This activity would include unwanted program execution, unauthorized network access, and unauthorized addition of network devices.
Disable Server Message Block v1 Protocol Server Message Block (SMB) protocol provides client applications with a controlled method for opening, reading, moving, creating and updating files on remote servers. The SMB v1 protocol has an extensive list of known vulnerabilities that allow unauthorized users to gain access to remote hosts and spread malware throughout a network. Specifically DHS recommends 1. Disable SMB v1 internally on each host. 2. Block all versions of SMB network boundary by blocking Transmission Control Protocol (TCP) port 445 with related protocols on User Datagram Protocol (UDP) ports 137 to 138 and TCP port 139.
Credential Management The implementation of unique usernames and unique passwords for each user account are critical to prevent unauthorized access and to ensure accountability for each user’s activities on the system and network. DHS recommended that election systems use and enforce password best practices, use multifactor authentication (MFA) and when possible use a local administration password solution to protect systems.
Establish a Baseline for Host and Network Activity “An organization's IT personnel are critical in determining what is and is not normal and expected host or network activity. With the appropriate tools, IT personnel are well positioned to determine whether observed anomalous activity warrants further investigation. During on-site engagements, CISA uses the following metrics to establish a baseline for expected network- and host-based activity:”
Network Baseline The network baseline should include: 1. 2. 3. 4. 5.
Specific metrics for user activity and bandwidth utilization. Authorized devices in the network. Network traffic analysis. Monitoring to ensure adherence with industry best practices. Analysis and alerting on abnormal activity.
Host Baseline DHS recommended that a baseline be created for each host variation in the environment. In practice this necessitates the following: 1. Hashes of the executable files on the system. 2. Documentation and controls for all remote access software. 3. An approved software list. Note: In election systems this software list is that software that is contained on the EAC VSS testing certificate.
4. Information on configurations and settings that can be used to automatically launch software after a reboot, scheduled tasks, and autorun programs. It follows, given the implementation of both the host and network baselines, that there should be processes and mechanisms to alert election officials if there are deviations to these baselines.
Coffee County EMS Cybersecurity Findings Coffee County EMS Conformance with DHS Best Practices The first phase of the cyber security analysis leveraged the DHS Best Practices for Securing Election Systems as the basis for evaluation.
Coffee County EMS Software and Patch Management Patch Management. An analysis of the installed patches for the Coffee County EMS was performed and determined that no patches had ever been installed since the Dominion Software was installed on 09/12/19 16:34:56 EST. Clearly there is no active patching of the operating system and thus does not meet (or even come close) to the DHS published best practices. The system vulnerabilities that are present on this system will be discussed further in this report.
AntiVirus Definition Updates Over four hundred fifty (450) thousand new malware threats are released each day.iv This is a huge number of new threats that are released each day. Systems are protected by antivirus programs that require updates to their antivirus definition files in order to keep up with these emerging threats and provide protection against malicious Figure 1-EMS Patch History programs executing on the system. In the case of the Coffee County EMS, Microsoft Defender was installed and active on the system. The antivirus definition file, however, had not been updated since the date of installation for the Dominion Democracy Suite. The date on the definition file installed at that time was created on 3/15/2019 at 23:32 EST, definition version 1.289.1302.0. At the time of the analysis the antivirus definition had not been updated for 1,752 days, simply put this server is vulnerable to over seven hundred eighty eight million, four hundred thousand (788,400,000) cyber threats and malware. It should be noted that Microsoft produces updated antivirus definition files that can be downloaded onto a thumb drive and then installed on air gapped systems or systems without internet access.
Figure 2-EMS Antivirus Definition Update Status
Log Management The collection and retention of logs is mandated by federal law and supplemented by state law. Given the nature of the interaction between the native operating system (Windows 10) and the voting software, it is essential to provide a complete logging of all aspects of the system. The Coffee County EMS had logging enabled for the Democracy Suite software, limited logging enabled for the Windows operating system and no logging (other than OS logging) for network activities using IPV 6 protocols. Basic windows operating system logging was enabled, however the maximum size of the retained logs for such critical logs as security (logs all user logins and security events), system (logs system events), application, and hardware (records the hardware events) was limited to twenty megabytes (20MB). All logs were set to overwrite the oldest log entries with newer log entries once the size limitation was reached. This size limitation on the log retention meant that the on the Coffee County EMS the oldest date of log entry for the security.evtx was 12/11/020 10:38:43 AM. All events covering the initial General Election for November 2020 were erased. There were other windows logging collection enabled, but with the exception of the powershell logging, these logs were limited to only one megabyte (1MB). The powershell logging was limited to fifteen megabytes (15MB) and only contained events from 12/11/2020. Once again there were no existing log entries that covered the initial time period for the 2020 General Election.
Figure 3-Security.evtx Settings
It is clear from the analysis of the Coffee County EMS that the implemented logging is operationally ineffective. There is not enough data storage to cover election time periods and not enough data collected to effectively determine if there was unauthorized access to the system. Furthermore, it is clear from the analysis of the Coffee County EMS that there was no capability enabled to forward the logs collected to a centralized location or security information and event management (SEIM) as recommended by the DHS best practices nor was there any evidence that any network data was monitored. This failure directly impacts the ability to retain log data when the log file size limitation is reached, prevents the correlation between host and network based artifacts, and prevents any visibility into detecting rogue devices on the network. It is critical that the log storage default settings on the system be changed to a minimum of 200 GB in order to effectively capture and retain the log data for the entire time period of an election.
Network Segmentation The design of the voting system includes the functional capability to scan ballots, ingest ballots to the EMS for tabulation, adjudicate ballots that the computer cannot accurately interpret, and report election results. To accomplish the designed roles and tasks there are typically multiple computing devices networked together that permit connections and the transmission of data across that network to automate the voting data collection and processing. By design this process requires that the EMS server (which stores data, tabulates votes provides access to the election databases and ballot images, and reports election results) be connected to a network. Analysis of the security logs from the EMS Server definitively proves that the Coffee County EMS Server accepted remote network connections from other systems on a local network and was networked.
The Coffee County EMS server had the following network devices configured at the time the forensic image was preserved: Network Name
Network Device
Local Area Connection* 1
ROOT\KDNIC\0000
Local Area Connection* 2
SWD\MSRRAS\MS_SSTPMINIPORT
Ethernet 2
PCI\VEN_8086&DEV_15BB&SUBSYS_09421028&REV_10\3&11583659&0&FE
Local Area Connection* 3
SWD\MSRRAS\MS_AGILEVPNMINIPORT
Local Area Connection* 4
SWD\MSRRAS\MS_L2TPMINIPORT
Local Area Connection* 5
SWD\MSRRAS\MS_PPTPMINIPORT
Local Area Connection* 6
SWD\MSRRAS\MS_PPPOEMINIPORT
Local Area Connection* 7
SWD\MSRRAS\MS_NDISWANIP
Local Area Connection* 8
SWD\MSRRAS\MS_NDISWANIPV6
Local Area Connection* 9
SWD\MSRRAS\MS_NDISWANBH
isatap.{C8A00DF2-59374860-9AD4-0630893F3D9E}
SWD\IP_TUNNEL_VBUS\ISATAP_0
Date of Last Configuration Modification 12 Sep 2019, 16:49:54 (12 Sep 2019, 20:49:54 GMT) 02 Dec 2020, 17:13:40 (02 Dec 2020, 22:13:40 GMT) 02 Dec 2020, 17:13:41 (02 Dec 2020, 22:13:41 GMT) 02 Dec 2020, 17:13:41 (02 Dec 2020, 22:13:41 GMT) 02 Dec 2020, 17:13:41 (02 Dec 2020, 22:13:41 GMT) 02 Dec 2020, 17:13:41 (02 Dec 2020, 22:13:41 GMT) 02 Dec 2020, 17:13:41 (02 Dec 2020, 22:13:41 GMT) 02 Dec 2020, 17:13:41 (02 Dec 2020, 22:13:41 GMT) 02 Dec 2020, 17:13:41 (02 Dec 2020, 22:13:41 GMT) 02 Dec 2020, 17:13:41 (02 Dec 2020, 22:13:41 GMT) 07 Jan 2021, 12:30:35 (07 Jan 2021, 17:30:35 GMT)
Figure 4-EMS Network Configurations
The Coffee County EMS was configured as a fixed IPV4 address of 192.168.100.10. This interface also was associated with IPV6 address “fe80::953:9e05:7e6:6b41”. The other network interfaces were programed to obtain a DHCP address automatically. The EMS server routinely accepted both user authenticated and anonymous remote network connections from an endpoint with the hostname ICC01 which was assigned an IPV4 address of 192.168.100.12 and an IPV6 Address of fe80::a1f7:d1b8:79fd:1aff Network segmentation is a network security technique that divides a network into smaller, distinct subnetworks that enable network teams to compartmentalize the sub-networks and deliver unique security controls and services to each sub-network. With respect to the Dominion Voting systems network a different strategy is Figure 5 - EMS Registry Entries for Network Connections utilized, namely network isolation. Properly configured network isolation prevents network communications from accessing the internet or other networks exterior to the voting system networks. The security of an isolated network is only ensured, however, if that isolation can be maintained. The most common vulnerability of an isolated network is known as an “Island Hopping” attack. Island hopping occurs when a device external to the isolated network is able to connect to a device internal to the network through indirect or direct communications. A simple example of this Island Hopping technique is through the use of wireless 802.11x wi-fi rogue device that is either
connected into the isolated network via a LAN connection or connected through a wi-fi connection to a device that exists internal to the isolated network. This rogue device then allows unauthorized access to the voting system network and provides an unauthorized data infiltration and exfiltration path to the systems and databases located on that network. Based on my analysis of Dominion Voting system Dell COTS hardware, the network cards on the motherboards also contain embedded wi-fi capability. Misconfiguration or malicious action of these embedded devices will enable the connections necessary to effectively execute an Island Hopping attack on the isolated network. It should be noted, however, that only the ethernet network interface had a configured network profile in the OS registry. There is no evidence that any technology existed in the Coffee County voting system network that would have had the ability to detect any unauthorized rogue devices or communications. It is critical that a packet capture (PCAP) capability be added to the election network in order to preserve and detect the presence of unauthorized devices and remote access capabilities.
Block Suspicious Activity In order to protect a system from suspicious or malicious activity it is necessary to address activity at both the program execution and network level
Program Execution – Malware Detection and Prevention The front line of defense for a computing system is a good quality antivirus program that is properly configured with up to date antivirus definitions. As previously discussed in this report, over four hundred fifty (450) thousand new malware threats are released each day.v This is a huge number of new threats that are released each day and updated antivirus definitions are required to ensure that malware can be detected and then blocked. If the antivirus program does not detect malware it will not block malicious programs from exploiting the system. In the case of the Coffee County EMS, it did have a good quality antivirus (Microsoft Defender) installed. The antivirus definition file, however, had not been ever updated. At the time of the analysis the antivirus definition had not been updated for 1,752 days, leaving this server vulnerable to over seven hundred eighty eight million, four hundred thousand (788,400,000) cyber threats and malware. Given this lack of current updated antivirus definitions, there is no effective capability to detect and block malware or malicious exploits on the EMS.
Firewall Rules The Coffee County EMS employed the Windows Advanced Firewall capability as a firewall. There is no indication that there was a programable gateway router in the network that was capable of additional network detection and blocking capabilities. Based on a review of the settings for the firewall rules, no effective limitation on access to file stores, access to the SQL Server, remote management, remote access or other preventive measures were noted.
Figure 8-EMS Firewall Rules Inbound
Figure 9-EMS Firewall Outbound Rules -Remote Assistance
Figure 7-EMS Firewall Rules Inbound RDP Not Enabled
Figure 6-EMS Firewall Rules - Outbound
Disable Server Message Block v1 Protocol The SMB v1 Protocol was enabled on the Coffee County EMS Server. Port 445 was not blocked for either private or public networks.
Figure 10-SMBv1 Currently Enabled on EMS
Credential Management The Coffee County EMS server contained fifteen (15) user accounts on the system. The usernames for these accounts were not reflective of individual users, rather they were reflective of functions within the computer or the Dominion Voting System. Twelve (12) of these usernames and credentials were created concurrently with the installation of the Dominion Voting Suite Software. Eleven of these twelve accounts never had the passwords changed since they were created. A review of the SAM registry file proved that accounts shared a common password. One account was changed on 12/14/2020. Prior to this password change it appears that this account also utilized the common shared password. Three (3) passwords were associated with the operating system and were created on 9/12/2019 when the Dominion Voting Suite software was installed. These three accounts did not require a password, but were disabled. One of these accounts was a local administrator account. The extensive use of usernames that are not uniquely attributable to a specific individual coupled with the use of a common shared password has totally gutted the ability of investigators or election officials to determine individual accountability for actions taken during an election. This egregious negation of the effectiveness of usernames and passwords totally bypasses the cyber security basis for requiring a username and password combination in the first place. Analysis of the remote network logon activity from the EMS server’s security.evtx log indicates that in 99% of the successful remote logins, a username and password was not required. There were 3,445 remote network logons contained in the logs of the EMS. Of these 3,445 logins, 3,411 were “Anonymous Logins”. This means that 99% of the remote logins to the EMS server did not provide a username or login to access the assets of the server. 34 of the remote network logins were logins using the emsadmin account. The login times for this user’s remote logins were analyzed and compared with the local EMS console login times for the same user. The results of this analysis determined that there were times when one user was active on a local
console when someone using the same username remotely logged into the EMS via a network connection.
Figure 11-Remote Network Logon - Anonymous
Figure 12-Remote Network Login - EMSADMIN
Establish a Baseline for Host and Network Activity Network Baseline Analysis of the Coffee County EMS determined that there is no capability to establish a network baseline. This includes no evidence that would indicate that there is any capability to monitor or alert on: 1. 2. 3. 4. 5. 6.
Specific metrics user activity and bandwidth utilization. Authorized or unauthorized devices in the network traffic. Network traffic analysis. Monitoring to ensure adherence with industry best practices. Analysis and alerting on abnormal activity. Analysis or alerting on any data that is transmitted outside of the Voting System network.
Host Baseline Capabilities Hashes of the executable files on the system. A list of the hashes for a subset of the Dominion Voting System software is established during the EAC testing and certification process. This however is not all of the executable programs (.exe, .com, etc), drivers (.dll) and other file types that can execute code, load additional device drivers or modify the settings of the host computer. Analysis of the Coffee County EMS determined that one thousand nine hundred ninety one (1,991) executable files were created after the installation of the Dominion Voting System on 9/12/2019. One thousand one hundred seven (1,107) executable files were modified after the installation of the Dominion Voting System on 9/12/2019. Since the modification and addition of executable files on a voting system is prohibited by the EAC, had there been any
effective monitoring of the files on the accredited system this system should have been decertified for use in elections.
Documentation and controls for all remote access software. A limited set of documentation exists for certain remote access software by virtue of the EAC testing and certification process. This documentation, however, is clearly lacking in other critical areas such as the remote use of the Dominion advanced programming interface (API) during the use of the Dominion Voting System operation. This API leveraged port 80 of the EMS server one thousand three hundred forty (1,340) times from 9/18/2020 to 1/7/2021. These API entries are contained in the IIS logs which indicate network access.
An approved software list. The approved software list for a Dominion Democracy Suite 5.5A voting system is established by the EAC certification and testing process. The list can be found on the EAC.gov website at the following link:
Figure 13-SSMS Default Login Configuration
https://www.eac.gov/sites/default/files/voting_system/files/ATTACHMENT_A__Dominion_Voting_Systems_D-Suite_5.0-A_FIPS_MOD_Test_Plan_-_As_Run.pdf. While this process establishes the approved software for the voting system, the Coffee County EMS contained software that was not contained on the approved list. Most notable was the Microsoft SQL Server Management Studio (SSMS) 17. This application is free and easily downloaded from the Microsoft site. SSMS provided both remote and local access to the SQL Server and election database hosted on the EMS server. This access to the backend of the election database is full read/write/execute access to every election database, table, stored procedure and function. This would include modifying the tables that contain tabulated vote counts, final election results and ballot definitions. The SMSS logon on the EMS was defaulted to Windows Authentication. Windows authentication allows the current user (if a member of one of three security groups) to simply select connect from the logon screen and be granted full access to the database without supplying any additional passwords or authentications. When coupled with the shared common usernames and shared passwords for the accounts, this software provides a huge vulnerability with virtually little or no detection and accountability. As previously discussed, there are three thousand ninety eight (3,098) executable files that were created or modified after the installation of the Dominion Voting Suite software. These files could not have been authorized to be on the system as they were not present during the EAC certification and testing process.
Information on configurations and settings that can be used to automatically launch software after a reboot, scheduled tasks, and autorun programs. Based on the analysis of the Coffee County EMS, there was no information on the approved configurations or settings that could be used to automatically launch software. The EMS server operating system was a Windows 10 Pro version of the Microsoft Windows operating system. As such it inherently had the ability to autorun selected programs on startup, schedule tasks and modify startup registry settings. As examined, there were three (3) programs scheduled to automatically start on reboot. These programs were Java Update Scheduler, Microsoft OneDrive, and the Windows Defender notification icon. There were seventy four (74) scheduled tasks on the EMS. The Coffee County EMS also had a Microsoft ISATAP network adaptor installed and active on the system. The Microsoft ISATAP device is used to help enterprises transition to an IPv6 infrastructure. The ISATAP adapter encapsulates IPv6 packets by using an IPv4 header. This functionality enables the client to transport IPv6 traffic over an IPv4 infrastructure. What is notable about this particular instance is that it was installed onto the EMS at 27 Nov 2019, 11:29:22.
The EMS had a WAN Miniport (IKEv2) driver installed on the system. While not uncommon, this device driver was installed on 02 Dec 2020, 17:13:41.
Unprotected Encryption Keys I determined that there was a flagrant failure to protect the election encryption and decryption keys within the election database. The DVS Democracy Suite utilizes a combination of a Rijndael Key, a Rijndael Vector, a Hash-based Message Authentication Code (HMAC) and a x509 security certificate to encrypt, decrypt and authenticate data. This data includes code signing, data signing, communications, and tabulator results from ICC or ICP2 components. The protection of election encryption and decryption keys is prominently described by DVS within Democracy Suite Technical Data Package documents as the mitigation for the risk of a malicious actor tampering with the election database, election result files, scanned ballot images, device audit logs, device log reports, ballot definitions and other critical elements that could allow authorized or unauthorized parties, to alter the outcome of an
election without detection. These keys have been left unprotected on the election database and are in plain text as shown below:
Figure 14 - Unprotected Coffee County Keys in SQL Database
As configured on the Coffee County EMS, the only barrier to access these keys is the Windows-log-in. This log in obviously would not prevent a malicious insider from changing results. A non-insider could easily bypass the Windows log-in feature in about 5 minutes with well-known hacking techniques available on the internet. Given the cyber security vulnerabilities, including the sharing of passwords between user accounts, access to these encryption elements is easily obtained. The encryption elements are stored in the MS SQL election database and are easily retrieved with a simple SQL query. Simply put, this is like a bank having the most secure vault in the world, touting how secure it is to the public and then taping the combination in large font type on the wall next to the vault door. Anyone with local or remote access to the system, including authorized or unauthorized users, can obtain the certificates and keys and once obtained the entire election can be compromised. A simple example of the exploitation of these keys would be the modification of the results and .dvd files that are transmitted or copied from the ICC scanners and the ICP2 tabulators prior to the ingestion of these files into the EMS for counting. By leveraging the decryption/encryption keys it is possible to script a program that would automatically change the contents of the ICP2 tabulator .dvd files, results.txt and cast vote records files prior to ingestion into the EMS. This altered vote count would not be logged as an intrusion or an error. Simply put, it would not be detected on the EMS.
Multiple Versions of Code Compilers Present on the System Contained on the Coffee County EMS are computer programs designed to create or modify executable files through a command line interface (CLI) by any user on the system or through automated calls by programs installed on the system. Specifically there were twenty two (22) copies of ten (10) unique versions of the Microsoft msbuild.exe code compiler.
Msbuild.exe Hash: 3b2790718535d05f209a542d05575dda Msbuild.exe Hash: 3c03b4467059c385b175aeaacc228391 Msbuild.exe Hash: 88144380e37cea1e1fd2aee3568bb27e Msbuild.exe Hash: 88de8fbbd91803eef67064b39d702650 Msbuild.exe Hash: 8dbf81c4ad4a899790bd325bed966aff Msbuild.exe Hash: 913f5dbfb11f4d590670821e4da28c2b Msbuild.exe Hash: 9e40eeeb04222dfa5f2f43f39b171ba3 Msbuild.exe Hash: fc6370d7bd71895b795da0fb75c26985 Msbuild.exe Hash: 2c245a6ed1e1ff435b600b5dfc7325f0 Msbuild.exe Hash: 51d2251c0f2169505665389a7e178c41 The msbuild.exe files are legitimate files that are published by Microsoft, but within the cyber security world are categorized as a living off the land binary. This means it is a trusted, digitally signed Microsoft application but is used by unauthorized users to bypass traditional security filters through a few main methods: •
•
•
Inline Code Execution: An attacker can craft a malicious .csproj file that contains custom C# or VB.NET code tucked inside a <UsingTask> element. When msbuild.exe processes that file, it compiles and runs that arbitrary code directly in memory. Application Whitelisting Bypass: Since msbuild.exe is a trusted Microsoft application, security policies like AppLocker or Windows Defender Application Control (WDAC) often allow it to run by default. Threat actors use it to execute payloads that would otherwise be blocked. Fileless Execution: Because the code compiles and executes inside the context of the trusted msbuild.exe process without generating a separate malicious .exe file on the hard drive, it can easily slip past basic antivirus scans.
These programs are not found as part of approved and certified Voting System Platform software that is listed on the EAC’s Scope of Certification posted on the EAC’s website and renders the protections of the EAC application baseline and the logic and accuracy tests mute as new executable files can be created, ran and manipulated by users and applications in real runtime without detection. There is clear forensic evidence that executable files were created and/or modified during the course of conducting the 2020 primary and general elections. It is extremely problematic that election officials use the EAC requirements for an established baseline as the justification for not updating the antivirus definitions and other cyber security protections, while on the other hand permitting thousands of executable files to be created and modified. This system should have been decertified for use in elections when even one executable file was modified or created that was not on the approved EAC software baseline list.
Extensive Usage of Vulnerable Advanced Programming Interface Calls
Description of The Finding Each of the Dominion Software EMS systems acts as an active web server. This was also the case for the Coffee County EMS. Analysis of web server logs from multiple separate Dominion Election Management Systems (EMS) revealed the presence of a distinctive legacy .NET User-Agent header: Mozilla/4.0 (compatible; MSIE 6.0; Windows 6.2.9200.0; MS .NET Remoting; MS .NET CLR 4.0.30319.42000) This is not a normal browser signature — it is the exact header automatically generated by Microsoft’s deprecated .NET Remoting framework when making HTTP-based remote procedure calls. Further investigation determined that this exact header is also hard-coded into exploit code linked to ysoserial.net, a well-known offensive security tool that generates deserialization payloads specifically designed to exploit unsafe object deserialization in .NET applications. ysoserial.net explicitly uses this User-Agent string in its exploit code to deliver malicious gadget chains that, when processed by vulnerable .NET Remoting endpoints (such as Dominion’s RemoteFileManager.soap), allow an attacker to execute arbitrary commands on the server without authentication or payload execution logging. Simply put, given the state of the cyber security protections and monitoring, this exploit would not be detected or logged on any of the Dominion Voting Sytems.
Technical Explanation Our forensic analysis of the multiple Coffee County EMS used in the 2020 election reveals evidence consistent with a remote code execution (RCE) attack via the legacy .NET. Remoting flaws in the Democracy Suite EMS as evidenced by multiple calls from October 2020 through January 2021. These HTTP POSTs to the unauthenticated /emsapplicationserver/RemoteFileManager.soap endpoint featured the signature User-Agent (Mozilla/4.0 (compatible; MSIE 6.0; Windows 6.2.9200.0; MS .NET Remoting; MS .NET CLR 4.0.30319.42000) from internal IPv6 addresses on the US based systems and IPV4 addresses on the Puerto Rico systems. The DVS.DemocracySuite.RemoteServerProvider.dll exposes dangerous remote functions like StartRemoteProcess for command execution, RemoteSaveFile for malware uploads, and file manipulations, all susceptible to ysoserial.net deserialization exploits enabling credential-free code injection; a static MSCOREE.DLL link with trailing JMP suggests tampering to evade security. This is consistent with pre-2013 whistleblower claims of result-altering backdoors, accounts for the unpatched Windows 8/.NET 4.6 setup lacking firewalls, logging, and monitoring—critically vulnerable in 2020—and echoes 2020 audit patterns (e.g., Mesa County) involving Remoting-based log wipes and data tampering via interconnected devices. Of specific notice is the fact that this vulnerable exploit did not appear in the older Democracy Voting Suite 5.0 that was used in pre-2020 elections that we examined, only in the Democracy Voting Suite 5.5x versions that were used in the 2020 and later elections.
It is clear from publicly available Dominion emails released as part of an investigation by Sheriff Dar Leaf that Dominion Voting systems had employed encrypted tunneling, VPN’s, and virtual machine functionality to provide remote access to internal voting networks in different jurisdictions. Access via this type of architecture would appear in voting system logs as local NATed IP addresses within the voting network.
CVE - Code Execution Vulnerability This vulnerability .NET Framework Remote Code Execution Vulnerability - A remote code execution vulnerability exists when the Microsoft .NET Framework processes untrusted input. An attacker who successfully exploited this vulnerability in software using the .NET framework could take control of an affected system. An attacker could then install programs; view, change, or delete data; read memory resident data, manipulate memory resident data or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The security alert below details the vulnerability: Sep 12, 2017 - CVE-2017-8759 https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2017-8759
National Vulnerability Database listing for CVE-2017-8759 https://nvd.nist.gov/vuln/detail/cve-2017-8759
i
https://www.eac.gov/voting-equipment/democracy-suite-55-modification https://www.cisa.gov/sites/default/files/publications/cisa-election-infrastructure-cyber-risk-assessment_508.pdf, Dated 28 July 2020 ii
iii
https://www.cisa.gov/news-events/news/best-practices-securing-election-systems, Dated 11 November 2022. https://www.av-test.org/en/statistics/malware/ v https://www.av-test.org/en/statistics/malware/ iv