Drew Springall @_aaspring_

Security Researcher. (opinions are my own) aaspring.com Joined January 2015

Tweets

260
Followers

378
Following

74
Likes

19

@

3 years ago

Update: 20+ leading experts in cybersecurity and elections just wrote to @MITREcorp CEO Jason Providakes urging him to retract MITRE's dangerously mistaken report. dropbox.com/s/kujr9uqchwcf… Signers include @RonRivest @schneierblog @matthew_d_green @ejsebes @robertgraham @philipbstark

0 196 408 59K 35

View Details

@jhalderm 5/5 If written today, we would include references to later-events (Coffee Co GA, Mesa Co CO, others' public discoveries, etc) plus our further-improved understanding of the vulns/weaknesses/etc. @jhalderm and I will be updating and submitting for peer-review later this summer.

1 1 12 697 0

View Details

Drew Springall @_aaspring_

3 years ago

@jhalderm 4/5 the report you see is ~2 years old (filed Jul2021) and reflects understanding/knowledge at that time but everything is still valid and correct. We asked the vendor to point-out any technical inaccuracies or misunderstandings over a year and a half ago and have heard nothing.

1 3 11 937 1

View Details

Drew Springall @_aaspring_

3 years ago

1/5 The report @jhalderm and I wrote after discovering/PoC-ing the many exploitable vulnerabilities in the Dominion Voting Systems' ImageCast X system is now public. storage.courtlistener.com/recap/gov.usco…

2 11 24 2K 3

View Details

Drew Springall @_aaspring_

3 years ago

Great work protecting everyone from "offensive content" there @twitter.

0 0 1 392 0

View Details

Drew Springall @_aaspring_

3 years ago

@GabrielSterling @MITREcorp @jhalderm @realMikeLindell @MarilynRMarks1

1 1 8 206 0

View Details

Drew Springall @_aaspring_

4 years ago

@umbernhard @braden_crimmins I don't see how it could be viewed as an unrealistic threat. There's an open-world of possibilities for obtaining identity. Could be small-scale (counter allows few before/after) or large-scale (all-day surveillance footage allows entire polling place).

0 0 0 0 0

View Details

J. Alex Halderman @jhalderm

4 years ago

1/ Colleagues and I have found a serious privacy flaw that affects Dominion ICP and ICE ballot scanners. We've already informed Dominion, CISA, EAC, and state officials, and we've created a site to help officials and the public understand the issue: DVSorder.org

35 249 370 0 29

View Details

Drew Springall @_aaspring_

4 years ago

4/4 We'd be excited to work with election officials to see whether other systems have similar vulns and how to best defend. Many people have made many claims about election security and the best way to sort true from false is to perform serious technical analysis.

2 5 18 0 0

View Details

Drew Springall @_aaspring_

4 years ago

3/ We only tested two software versions of a single EAC-certified system (as part of a pre-2020 lawsuit in GA). The vendor didn't give us or CISA access to test other versions or their claimed fixes. It also hasn't publicly stated what other versions share these vulns (if any).

1 5 14 0 0

View Details

Drew Springall @_aaspring_

4 years ago

1/4 @jhalderm and I investigated the security of the Dominion ImageCast X BMD used in Georgia and our findings aren't pretty. @CISAgov just published an advisory about vulnerabilities we found and I hope the full report we sent them will be available soon. cisa.gov/uscert/ics/adv…

7 22 36 0 7

View Details

Drew Springall @_aaspring_

5 years ago

Well that looks...not good. Someone might wanna check on the @hbomax integration testing infrastructure.

1 0 1 0 0

View Details

J. Alex Halderman @jhalderm

5 years ago

Here's my analysis of what happened in Antrim County, Michigan, during the November election: michigan.gov/sos/0,4670,7-1… Full report: michigan.gov/documents/sos/…

14 26 54 0 6

View Details

Drew Springall @_aaspring_

5 years ago

@matthew_d_green @jiceman What if it was explicitly and knowingly turned-on for COVID contact tracing via ENS? I can envision Android <11 users not checking whether History was already on (?History-only doesn't report?). support.google.com/android/answer… support.google.com/accounts/answe…