HOLY SHIT everybody, the VOTING MACHINES have been HACKED and I have PROOF

HAMMER SCORECARD, a thread

I'm a DevOps Engineer (I don't know what that means so don't ask) that's been around for almost a decade, and love to watch the ITSEC circle-jerk from the sidelines

I'm gonna try and break this down into layman's terms, per the general requests of several Twitter comments, so people can better understand what's going on here.

I argue that the technical details are largely irrelevant, and more of a distraction than anything.

It doesn't *actually* make sense, so don't worry if you don't get it.

FUD, I argue, is the main point.

So, Anon drops a couple links to @we_have_risen's Tweet citing a source code leak. All roads seem to come back to this Tweet eventually. (Prove me wrong)

It's noteworthy that @GenFlynn appears to be a follower of his, though I see he wisely follows lots of people

So far, no claim is being made - just hints.

Most of the screenshots are from SpiderFoot, an OSINT platform that does automatic intel-gathering. If you've dealt with automated results before, you know there's can be a lot of chaff to sift through - even ignoring false positives.

If you've ever dealt with email marketing and your organization's emails seem to keep ending up in peoples' spam folder, you also know how automated flagging/blocking just seems to wreak havoc occasionally, and it takes a week of emailing support teams to unfuck

Classic internet scammer trick: show 'em something like "WARNING" in red letters, followed by some inscrutable nonsense.

Clearly, this is bad. We need someone smarter than us.

Create a "problem", then offer yourself as the solution.

Classic hax04ing/tradecraft.

What is a "Malicious Affiliate", though?

My imagination immediately conjures something like "Russian Asset" - itself perhaps an oft-misapplied term.

It does sound scary though, doesn't it?

A "Malicious Affiliate" is when someone registers a similar domain to trick your customers into thinking they're on your site when they're actually on a bad look-alike

So, one can imagine it's a Good Thing that major players are blocking these domains:

Not sure re: naturopaths

See all these "Blocked by [whatever]" on "autodiscover.{domain}"?

That's because Trump uses Microsoft Office 365 and HRC has her own email servers! Just kidding.

Anyways, this all appears to be routine plumbing.

Sidebar: "selector{n}._domainkey.{domain}" are DNS entries for DKIM, an email security/anti-spam measure.

It's based on public-key cryptography, explained in sufficient depth here (4 min read): https://medium.com/@vrypan/explaining-public-key-cryptography-to-non-geeks-f0994b3c2d5

The DKIM entries in DNS help us fetch the right key.

Sub-sidebar: DKIM helps tie your domain (not your IP) to your reputation, somewhat mitigating spam issues that plague multitenant systems.

i.e., when you and a spammer rent the same server and your emails get flagged as coming from a spammer's server.

Tied to name, not number

Anyway, now come the dArK wEb SiTeS, half of which (predictably) didn't work. Those that did went to some carding forums and a french weed site IIRC.

That last address isn't even valid.

At any rate, the purported information wasn't there when I checked

Maybe they took it down

Here we see more generic findings - some passwords have been leaked, and devices are showing up on a popular is-my-shit-exposed-to-the-internet database

Their httpd's, a.k.a. HTTP daemons, a.k.a. webservers - are in fact exposed to the internet

Might be good or bad. Probs good.

So, we've proved nothing so far, other than generating some traffic to Dominion's exposed devices.

Kinda like that Jim Watkins critter directing all the #SaveTheChildren folks to the same servers he hosted kiddie porn on or whatever

That is if any of it is to be believed.

The real clue, I believe, lies in the last sentence of the second-to-last post on one of the 4chan threads:

HAMMER and SCORECARD are in all-caps, which sounds like NSA programs, so let's roll with it.

I haven't found a consistent, credible technical description of its capabilities - most of them are low-quality, nonsense descriptions of the "hacks the IP address" variety.

Alternatively, it's described as using a super-sekret, proprietary method far too complicated for you, dear listener, to understand.

But let's accept for a moment that both HAMMER and SCORECARD do exist and can alter vote reporting in whatever fashion - because it's the worst-case scenario and also #xkeyscore

Now pretend the Worst Person Ever - Trump and/or Obama - your choice - have control over this system

RUMINT says that the Biden camp has maintained private VPN access to this device, which might be one of those weird half-truths where he still has access to part of " http://supersekretdashboard.gov " or something, so let's toss him in there too. And Soros, Clinton & Bush, for good measure

What do you get?

Some weird NSA voting video game where they (personally, of course) stay up all night adjusting votes in different districts, all the while trying to avoid each other knowing or making anyone suspicious?

X to Doubt.

It's certainly a plausible story on some levels, though the "evidence" presented thus far is neither damning nor substantiates the specific claims made.

Check the logs, if they exist.

(That's also a tricky subject for a number of reasons I can get into later)

If it's a problem with internet transmission between states and feds, call it in. Have the governors Tweet out the results for all to see. Who cares at this point, honestly?

Scanning or tabulation? Recount (assuming no physical tampering since the start of the election)

There's a nearly-infinite well of mistrust to dig into here, but the specific path doesn't matter - the outcome is that a group of people (e.g., courts) other than We The People are deciding the election.

It's counting, kids.

If done correctly, does not require a call to Legal

In the absence of credible and specific information showing *anything*, this whole story seems like nothing more than disinformation and FUD, so I'm erring on the side of trusting the system (lmao)

So, unless criminal charges and forensic evidence are forthcoming, LAW AND ORDER!