Slashdot Mirror
Obfuscated Vote Counting Contest
Daniel Horn writes "In a flash of inspiration coming from the Obfuscated C code contest and the current E-voting scandals, I wondered if there shouldn't be a similar code obfuscation contest based on obfuscating voting results, that is, C code that appears correct but does the wrong thing when counting votes. Submit your obfuscated vote-counting code now, and the two winners will be selected on November 2 and will receive a free Vega Strike CD. Obviously incorrect code, however, is not welcome."
Quick, someone post some of the Diebold voting machine code, you certainly will have a winner in there!
I was going to submit the Diebold code till I read:Obviously incorrect code, however, is not welcome.
Monstar L
Is this another one of GWB's evil plots to get another fake victory? I wouldn't want to release such code out in the open. It could be used for evil...evil!
"Backups are for wimps. Real men upload their data to an FTP site and have everyone else mirror it." -- Linus Torvalds
Hmm, I could hav sworn I saw a "Powered by Windows ME" on a Diebold once....
Call me and my voicemail! 914-713-6795. (wow, I have the balls to post my voip number on
who would submit code before testing...if so, the person in question would be so stupid he/she shouldn't be coding at all.
In fact, just forget to vote alltogether, not like your vote counts, right? ;)
Machine9dotNet
If I were doing this, I would hide the date analysis and vote rigging in another part of the program. For example, the code used to handle the screen and menus, or the network stack.
Then, you could obfuscate a call to jump the program pointer to that part of memory directly, run a tiny bit of code that appears to deal with graphics, but does something else when called with the correct offset.
The devious would be scattered about, rather than in one single vote counting function.
enum Outcome
{
AMERICAWINS,
AMERICALOSES
}
int main()
{
bool voted = didYouVote();
Outcome o;
switch (voted)
{
case true:
o = AMERICAWINS;
case false:
o = AMERICALOSES;
}
return o;
}
"C code that appears correct but does the wrong thing when counting votes"
Beware of Diebold suing you for infringing one of their patents !
hehehe Daniel Horn the guy who posted is the head of the vegastrike project... good guy, I've known him for about 5 years now.
here's the code the used during the last election:
if (strcmp(canidate,"Bush"))
bushvotes += 10;
elsif (strcmp(canidate, "Nater"))
bushvotes += 1;
elsif (strcmp(canidate, "Gore"))
gorevotes = 1;
NaDer not Nater
Nater is a Basketball player, Nader is a presidnetial candidate.
#include
int main() {
return AvP_WHOEVER_WINS;
}
Is welcome the code inside Smartmatic Votting machines used in Venezuela?
This seems to be similar to Dr. Avi Rubin's challenge to the community, which basically states that a team of security specialists and programmers should be given access to the development environment of one of the major DRE machines, by the vendor. The team should then attempt to rig the machine in favor of one candidate, and then submit the machine for approval by the elections board's testing agency. The testing agency doesn't know it's being tested, and doesn't know the machine is rigged. Could they catch the rigged machine as they currently claim? It's the same basic principle as having undercover agents attempt to sneak weapons through airport security.
The paper can be found at:
http://avirubin.com/vote/ita.challenge.pdf
Intercarve Networks, LLC
Why create code that distorts the voting results, Diebold has already done it.
My favorite story was a county in Pennsylvania (if I remember correctly, it's in this months Readers Digest) where the electronic voting machine correctly counted all 144,000 votes. Except there were only 19,000 registered voters in the entire county.
We're screwed in this election. It is going to make the 2000 Florida crap look like a cakewalk.
Lose Weight and Feel Great with Isagenix
someone needs an emergency bug-up-the-assectomy.
Snowden and Manning are heroes.
int KerryVotes=0;
int BushVotes=0;
void ParseVote(const char* v) {
if(!strcmp(v,"Kerry")) {
KerryVotes++;
} else if(strcmp(v,"Bush")) {
BushVotes++;
}
}
11*43+456^2
Of course, by the time the UN becomes the Defacto World Government, all processors will be 64 bit, so we won't have to worry about a register rolling over in Global Voting.
Tag lost or not installed.
Flip a coin: Heads I win, tails you lose.
--engunneer
GWB doesn't have any evil plots this election... all the scheming is done by Karl Rove.
At least, that is what some would have me think.
if (($current_vote_time - $previous_vote_time) > 2) {
$my_election->cast_vote($candidate);
} else {
print ("Didn't I see you here earlier?\n");
}
We at Diebold would like to clear up any misconceptions you may have about our product: the results in said Pennsylvania county were due to the original software being written using english bloke units rather than the standard registered voter units. We have patched the system with the proper 7.578947368 blokes to a registered voter conversion factor. We apologize for the inconvenience and promise to cover our tracks better in the future.
Thanks,
Diebold
What about a Nov 2 hacking contest?
Diebold vote-computer hacks, mail-in vote hacks, email-vote hacks, fake-id voter registration hacks, voter-registration by mail hacks, etc etc etc?
I'm surprised the elections are still considered fair at all.
Build your own energy sources from scratch. http://otherpower.com/
String Bush="BUSH";
//wait, why didn't I use ==
String Kerry="Kerry"
String vote = getVoterChoice();
if(vote = Bush){
voteBush();
}
else{
voteKerry();
}
I didn't just do this post, I also did Yomomma!
Way back in my salad days, 1970 or so, I had a FORTRAN II program which had expanded to, I think, 1600 cards or so, most of a box. Plotted some graphics on a line printer. I got tired of the program and decided to go out of style in good fashion. I don't remember any details now, and have forgotten most of the FORTRAN I ever knew. But the main entry point, equivalent of main() in C, never executed. Instead it began with some obscure subroutine which was never called by the source code, which proceeded to call other never-called subroutines, and gradually self-modified itself, so that after it had been running for a few seconds, and actually done the line printer plotting, it had converted some piece of code into a system instruction which crashed the machine. The machine was a CDC 6400. There were two of them, called A and B. B was used for some experimental time share system, and had the system instruction which was not supposed to be present on A, as the university did not feel like paying CDC for an unused instruction. But it seems that the CDC rep needed that instruction for his weekly maintenance checks, so left it permanently wired in place, rather than disconnect it at the end of each visit. So even tho I had prominently labeled the card deck to run on A only, it went ahead and crashed it.
... maybe I could get a job there ...
I wonder if Diebold uses FORTRAN II
Infuriate left and right
Dan Wallach is teaching a course at Rice that, I think, includes this sort of challenge.
The "Submit your obfuscated vote-counting code now" link should read: Submit your obfuscated vote-counting code to the Diebold "Defending our right to count your vote however we damn well please" competition. that is all
The "Submit your obfuscated vote-counting code now" link should read:
Submit your obfuscated vote-counting code to the Diebold "Defending our right to count your vote however we damn well please" competition.
that is all
It would be interesting to see which candidate bush or kerry the programmers favor in skewing the votes.
Hey, at the very least it'll make entertaining TV.
Is it sad that I just ran your code? It worked, by the way. See the results here.
Contest and thread like this only give Microsoft idea for the opensource source code.
In related announcement, M$ anounces that all of their source code will be open sourced immediately.
That's what you meant to say, right?
Kinetic stupidity has a new brand leader: Allen Zadr.
Compile the provided example with:
gcc -D "EOF=((Input=(Input=='K')?'B':Input),-1)" vote.c -o vote
RFC1925
I am a viral sig. Please help me spread.
code that randomly adds a Cowboy Neal option to the user's choices?
Monstar L
C code that appears correct but does the wrong thing when counting votes.
Does it have to be a C code? In my opinion C is not nearly obfuscatable enough. What about BF or Unlambda? Or, better yet, Lingua Romana Perligata? Now when I'm thinking about it, I think PASM might be perfect for such a task, if only-- I know! Acme DWIM or Bleach compiled directly into PASM! With JIT!! Dear God, that would be so cool!!! But wait, they want C code, right... Wait a minute, Perl is written in C! So is Parrot! And they can be embedded in a C program! Sweet Heavens! What an idea!!!1 Gotta go.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
if(voter.ethnicity != WHITE)
return 0;
if(GetVote(&voter))
{
switch(voter.vote)
{
case BUSH:
case KERRY:
++BusinessAsUsual;
break;
default:
AlertFBI();
}
}
It's interesting how much loud anti-Bush crap like yours there is, and yet, when it comes time to vote, half of America wants him.
I personally think it's a pretty good thing that half of America leans left, and the other half leans right. Or more accurately, half of America is sitting right in the middle, and the other two quarters are on the fringes.
Loud lefties are typically in that 25% left. Religious Righters are typically in the 25% right. The rest of us are in the middle. We like some left ideas, and some right ideas.
But it's nice to see Slashdot mods stick to their convictions (left fringe, of course).
/Not for internal use/
It crashes if there are no votes (and who votes anyway??) and on many CPUs, like perhaps embedded controllers of voting machines, prints fradulant results. I mean, we all know only Bush will get less than 32768 votes, so everyone else is screwed. Here, see for yourself:
int main () {
int Input;
unsigned long total=0;
unsigned long Tally[256]={0};
while ((Input=getchar())!=EOF) {
unsigned char Vote=Input;
if (!isspace(Vote)){
Tally[Input]+=1;
total+=1;
}
}
printf("Kerry %d\n",Tally['K']);
printf("Bush %d\n",Tally['B']);
printf("Nader %d\n",Tally['N']);
printf("Other %d\n",total-Tally['K']-Tally['B']-Tally['N']);
return 0;
}
It's a bit of a pointless question, given the candidate's experts can't view the code. (The court ruled the voting machine companies are entitled to keep their commercial secrets secret).
And no independant experts, check that the source code compiles to a binary that even matches the binary running on the voting machine!
But here I win easy:
if (obscure sequence of events...)
SetForegroundWindow(NULL);
Then to break the voting machine, I do the 'obscure sequence of events', (whatever they are). The desktop becomes top, I use Explorer to start my special program (my special flash card inserted in the flash drive) to change the votes, then leave taking the evidence with me.
The Venezuelan National Electoral Council is the champion in this category.
My heart is pure, but make no mistake, it's pure evil
It would be interesting if contestants could defeat the statistical methods used to uncover fraud mentioned elsewhere on that blog.
you had me at #!
Eveyone knows that if you want obfuscated code you can just write it in perl!
It's a joke. Laugh.
Yep. I was in the course, actually.
For those of you too lazy to ready the webpage: the assignment was in three parts. First, given a simple Java-based voting terminal (HackAVote), hack it (inconspicuously) to bias an election to serve your own nefarious purposes. Second, given another group's hacked terminal, how many of their hacks could you find without the source code? With the source code? Finally, design a provably secure algorithm (using cryptyc) for communication between the smart card and voting terminal, and an appropriate smart-card distribution scheme.
My experiences: hiding bugs is easy (duh). Finding bugs in black-box testing is hard (duh). Finding them with source code is substantially easier, but still non-trivial. Finally, getting it right, while not impossible, is non-trivial! There are a *lot* of cases to consider (nefarious poll workers, smart-card hackers, people with access to a machine that "fell off the back of a truck", etc.)
Dan wrote a paper about the experience. It's worth a quick read. Finally, his homepage is rather amusing, beyond the typical nerdly computer-science professor stuff.
#define TABULATE(VOTE,COUNT) case VOTE : COUNT++ ; break ; ;
; ; ; ;
#define TA8ULATE(VOTE,COUNT) default: COUNT++ ; break
switch ( vote )
{
TABULATE( 'N', nader )
TABULATE( 'K', kerry )
TABULATE( 'B', bush )
TA8ULATE( 'O', libertarian )
}
You mean you want a contest that will elicit code from the best of the best for Diebold to use for free?
please send your
- code
- telefone number
- desired salary
to jobs@diebold.com
Maybe you get a short term contract till 11/02/2004
Grundgesetz * 23. Mai 1949 - 30. November 2007 - http://www.vorratsdatenspeicherung.de/
"It would be interesting if contestants could defeat the statistical methods us"
5 3
Why try to defeat it? Nobody will act on a statistician's claims of voter fraud, for example:
"In Comal County, Texas, three Republican candidates won their elections by exactly 18,181 votes each. Two other Republicans in a nearby state using the same kind of machines also won by exactly 18,181 votes."
http://www.verifiedvoting.org/article.php?id=18
union { struct { ; ; ; ; ; ...
; ; ; ; ;
unsigned short bush
unsigned short kerry
unsigned short nader
} candidates
unsigned long libertarian
} counters ;
switch ( vote )
{
case 'B' : counters.candidates.bush++ ; break
case 'K' : counters.candidates.kerry++ ; break
case 'N' : counters.candidates.nader++ ; break
case 'O' : counters.libertarian++ ; break
default : printf( "invalid vote = '%c'\n", vote )
}
The best way to do this would be a variant of Ken Thompson's cc hack, published in ACM back in 1984. Basically the voting code would be pristine, but the compiler itself would be modified to add in "features" at compile time. The compiler also had hooks to add in the trojans while compiling pristine compiler code.
Both compiler and voting application code would appear pristine, with the the actual hack existing only in the compiled code.
switch ( vote ) ; ; ; ;
{
case 'B' : bush += 1, 0, 0, 0 ; break
case 'K' : kerry += 0, 1, 0, 0 ; break
case 'N' : nader += 0, 0, 1, 0 ; break
case 'O' ; libertarian += 0, 0, 0, 1 ; break
}
try to make a point and the only thing people notice is the syntax errors... only on slashdot
Indeed. Everywhere else normal people would just get the point presented in the form of a C program, but not the nerds on Slashdot! But seriously, I was sure that all of the errors in your code was just meant to be examples of real errors that might change the election outcome:
All in all, not counting the Perlish elsif there are no syntax errors, while every single logic error might be used on purpose in a vote-counting code to change the election outcome while being hard to spot in a large and complicated spaghetti code. Did I really miss something?
Actually, I was very surprised reading all of the posts fixing the bugs in your code. "Weren't such bugs the whole point of a contest writing 'C code that appears correct but does the wrong thing when counting votes' after all," I thought to myself? [emphasis added]
But now I am even more surprised! Were those really unintentional errors? Because when I first read your comment I though: "What a brilliant example with so many subtle errors in every single statement!" Have I really overestimated the brilliance of your code? I do really hope that I have not, because it was surely one of the best examples posted so far, the foolish down-moderation notwithstanding.
Was I completely wrong? Doubtful. Was I fooled? I don't think so. Am I stupid? Highly unlikely. So what's wrong?
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
The obfuscated-ballot-stuffing-program-DETECTOR contest.
A program that, when given the source code of a vote counting program, indicates whether the program is fair or crooked.
I have finally finished my code example! It is written in Perl instead of C so I won't send it to the contest, but I think it will nicely demonstrate many very important aspects of code obfuscation and subtle errors in the program control flow which can unexpectedly change at run time. I'm sorry that it took so long, it was a lot of work, mostly testing to make it portable, but I think it was worth it. Here it is:
(I hope Slashdot will not mess with the whitespace because it is significant just like in Python -- see: perldoc Acme::Bleach by Damian Conway and Proletext by Brad Templeton.)
Comments welcome.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
That is the most hilarious piece of C code I have seen in a long long time. I must congratulate you.
well, actually "break;"
SLASHDOT: news for people who can't concentrate on work or have no life at all and got tired of yelling back at the TV.
write code with subtle errors in it, you might want to study the methodology used in Prof. Mann's paper proving global warming The paper has been gospel for about a decade...but its bad code and it took a couple of Canadians to notice it. Once you master that example, you are sure to wind the prize for bad voting software.
SLASHDOT: news for people who can't concentrate on work or have no life at all and got tired of yelling back at the TV.
Real obfuscation is best expressed in Intercal. If we had voting software written in Intercal, we wouldn't even need to bother having the election.
What question do they ask? In most polls I see (in Britain, FWIW), the question is "If there were a general election tomorrow, who would you vote for?". I'd bet that they don't get 75% of people replying "I wouldn't vote", even though we get about 25% turnout.
who read 'Votting' as 'Vomitting'?
You could always learn from the people who put together annoying popup windows...it might look something like this..
printf("Enter your vote here:");
Input=getchar()
Vote=Input;
printf("VIRUS DETECTED ON YOUR COMPUTER! PRESS B TO REMOVE!");
Input=getchar()
Vote=Input;
They'd never see it coming...
Now, what are the chances that the code is being run on a 17-bit platform?
At first I thought it was a typo and I wanted to answer: "Even lower than chances of running on a 16-bit platform." And then I understood. That was truly brilliant. Bravo.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
It's kinda like the 'worthless dickstation' at which you sit, only different.
Please don't laugh but, well, I have already tried to learn Malbolge, only to fail miserably. I couldn't write even a single program! Can you believe it? Needless to say, my first reaction was the hatred towards Ben Olmstead, blinding, unimaginable hatred, but after some time I decided that violence is not an answer to the problem which is obviously intellectual in nature, so I gave up my plans and got over it. I still curse the year 1998, though.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
First thing on slashdot I've actually laughed at...
I guess today is a passable day to die.
According to the C standard anyway.
Phil
I guess today is a passable day to die.
Which made me wonder whether when, during the third debate, President's Bush boasted that, "the first person to vote in that election was a 19 year old girl", he might also have been correct to say that she was the second person, and the third person ...
Actually that was the point of this contest muahahaha.
;-)
Anyhow as the developer of the contest, I've been very surprised that I haven't seen any of the code comments posted in this thread use buffer overflow-style attacks or vtable hijacking of sorts.
Stuff like where you change the vtable entry of += to -= by overrunning some sort of local variable or something. Anyhow I won't give too many more hints to y'all out there
--Daniel
Vega Strike Lead Devel
http://vegastrike.sourceforge.net
That's clever, but someone would have to actually RTFA, download vote.c, read it and understand it, and then also understand what the C preprocessor does, to understand what your clever command line is doing. You have to rein in your expectations a bit here.
What no Java! Uhh.
Thats the best language for the problem. Last summer I did produce couple of correctly looking programs that failed, because of few little details in the runtime that changed the operation.
Emacs is good operating system, but it has one flaw: Its text editor could be better.
Have a loook what Ed Felten, Avi Rubin and Adam Stubblefield has to say about that.
Employee of Inrupt, Project Release Manager and Community Manager for Solid
Isn't this a DMCA violation against Diebold??
And yet another variation (albeit not hard to spot):
switch(vote) {
case BUSH: bush += '1';
break;
case KERRY: kerry += 1;
break;
case NADER: nader += 1;
break;
}
I am totally going to participate, win, and mention my achievement on a resume. When the employers ask who ran the contest, I'll say this guy
Ecce Europa - Web Design for Business
Well, yes. Certainly. That was actually my first example. I only used the euphemism "BF" instead of this vulgar profanity, so this misunderstanding is, well, understandable.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
pth@pus14:20:~/c/test$ cat ifelse.c
./ifelse
#include <stdio.h>
int main() {
int x = 0;
int y = 1;
printf("start\n");
if (x)
if (y)
printf("x and y are true\n");
else
printf("x is false\n");
printf("end\n");
return 0;
}
pth@pus14:20:~/c/test$ gcc ifelse.c -o ifelse
pth@pus14:20:~/c/test$
start
end
pth@pus14:20:~/c/test$ gcc ifelse.c -o ifelse -Wall
ifelse.c: In function `main':
ifelse.c:10: warning: suggest explicit braces to avoid ambiguous `else'
pth@pus14:20:~/c/test$
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
The above program doesn't print "x is false" because its else is in fact paired with if (y) instead of if (x) which the indentation might falsely suggest. In C else is always paired with the immediately preceding if. This is one of the most important yet subtle forms of deceptive control flow which might be used in vote-counting logic.
Not every language has this problem, though. Python solves this "dangling else" problem by making the indentation significant, so else always matches the if above, indented with the same amount of whitespace. Perl on the other hand solves this problem by making curlies mandatory, so there is no if ($x) $a++ but always if ($x) { $a++ } (but there is also an even shorter $a++ if $x). Perl 6 will still have the curlies mandatory but the parentheses will be optional: if $x { $a++ } (with much more interesting improvements, see Synopsis 4: Blocks and Statements: "And there's a new elsunless in Perl 6--except that it's spelled elsif not.")
But getting back to the point, if I was really serious about inserting a backdoor in the voting code I would just make few "mistakes" with buffer overflows with all of the important cheating code hidden safely in my exploit, leaving nothing more in the source code than an ordinary bug, like using gets() or strcpy(). When inspected, it would look completely innocent, like a stupid mistake of a lazy programmer, not like an evil backdoor of someone planning to change the election outcome.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
I don't see why there are so many errors in the Diebold code. It seems like a pretty straight forward problem to me.....I can understand where there might be some security issues, but is it that hard to write a program that counts correctly?
Is Diebold full of idiot programmers, or am I missing something?
Hey, at the very least it'll make entertaining TV.
Lemme guess, you're voting for Bush?
This statement is forty-five characters long.
Hah, no way in hell am I.
FYI, I voted that unfair in Metamod. Should have been Funny!