Defending the 2018 Midterm Elections from Foreign Adversaries

Architecture and Background

Election Buster is an open source tool created in 2014 to identify malicious domains masquerading as candidate webpages and voter registration systems.

Vulnerability Analysis

During 2016, fake domains were used to compromise credentials of a Democratic National Committee (DNC) IT services company, and foreign adversaries probed voter registration systems. The tool now cross-checks domain information against open source threat intelligence feeds, and uses a semi-autonomous scheme for identifying phundraising and false flag sites via ensembled data mining and deep learning techniques.

Exploitation and Demonstrations

We identified Russian nationals registering fake campaign sites, candidates deploying defensive—and offensive—measures against their opponents, and candidates unintentionally exposing sensitive PII to the public.

Remediation and Defensive Strategies

This talk provides an analysis of our 2016 Presidential Election data, and all data recently collected during the 2018 midterm elections. The talk also details technological and procedural measures that government offices and campaigns can use to defend themselves.