Slashdot Mirror
Voting Machine Attacks Proven To Be Practical
An anonymous reader writes "Every time a bunch of academics show vulnerabilities in electronic voting machines, critics complain that the attacks aren't realistic, that attackers won't have access to source code, or design documents, or be able to manipulate the hardware, etc. So this time a bunch of computer scientists from UCSD, Michigan, and Princeton offered a rebuttal. They completely own the AVC Advantage using no access to source code or design documents (PDF), and deliver a complete working attack in a plug-in cartridge that could be used by anyone with a few private minutes with the machine. Moreover, they came up with some cool tricks to do this on a machine protected against traditional code injection attacks (the AVC processor will only execute instructions from ROM). The research was presented at this week's USENIX EVT."
Here's what I'm trying to understand.
We have this great thing called Public Key Crypto and the PKI to go along with it.
If you presume a custom processor that will only execute code signed by an election commission, that would be a first step - the system won't run anything that hasn't been specifically approved for installation on the machine. There would be no more "last minute fixes" as we've seen in the past, where code was installed without being vetted by an election authority.
For that matter, require the software developers to store their code on a state or federal election repository, and only sign code that's been compiled on those systems, from that repository. Require that anyone who makes changes sign them with their private key and state the reason for the change.
For the results, take each ballot, strip off the identifying information, and encrypt it to the election commission, and sign it with a pre-deployed per-machine private key that's known. It would of course also be important to have a reliable time source for the device, to include that in the result file.
I would even envision that this would be a good purpose for a federal election agency - hosting the code for all certified voting systems, and being the "root of trust" that signs certificates for the state election commissions, which can then sign local and county commissions, which can then issue keys to individual election machines.
Some patches to an open-source OS, say Linux, a PKI infrastructure (along with some HSM modules to store keys) and a processor with an integrated crypto engine and TPM module would take care of all of this.
Banks do this kind of stuff all the time - what's so hard about it?
It makes me wonder what you're hiding.
I have no incentive to hide anything as I'm not an employee of the Elections Board nor an office holder with a stake in the system. I became a poll worker because of the controversy surrounding this issue. I wanted to see for myself how the system worked. I came to it as a skeptic and after learning the procedures and seeing them in action have been convinced that the system is as secure as it can be expected to be.
How often has that happened in the history of American elections?
That is exactly the kind of dramatic detail that puts my fraud-detector on alert. "Look, it's so secure that it's even secure against problems you don't have!" Typical distraction.
So now you are complaining that the system is protected against disasters just because they rarely happen? Would you be happier with a system that left less of a paper trail?
As it happens, if you google "ballots lost in fire" you get a bunch of hits on the first page about fraud and failure related to electronic voting machines.
As I said, my experience is limited to the State of New York. In NYS we don't use direct electronic recording machines. You fill out a paper ballot that is then tabulated by an optical scanner. In the event of a disputed election the paper ballot is still around and any idiot can count it with the Mark I human eyeball.
The only part of our voting process that is "electronic" is the so-called "ballot marking device" that handicapped voters use. This is a machine that prints a paper ballot for those voters who are unable to write and have to rely on another interface (audio, sip and puff, foot pedals, etc.) The printed paper ballot is in the same format as the one that you would fill out as a non-handicapped voter and can be read by any human being.
Given the complete lack of transparency at all levels of any electronic voting system I am extremely suspicious of all of them
Evidently that's not all you are suspicious of, since you seem to think that I'm trying to hide something :)
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Yup. That's a good start.
I'd also love to see some kind of basic voter assessment to substantiate the vote as well. We all have a right to vote, but if yopur vote is based on fallicy or a complete lack of knowledge, you should not be allowed to register that vote.
My grandfather is a prime example of this. He's voted republican his entire life, nearly 70 years of going to the polls. I pointed out to him just before Obama's election that he couldn't, other than Right to Life and anti gun restriction, name a single Republican platform stance. Then i further asked him what his personal beliefs were on the top 25 debated items between the 2 parties. Of the 25 things, he chose the side the DEMOCRATS voiced support for. he didn't believe me, so i showed him the republican national website, and ran down the list (which took a while, it's not well organized). He voted straight democratic ticket. You see, the current Democratic platform is actually closer to what the Republicans had for a platform 50-60 years ago. He started voting replublican as a youth and then allways did, not paying ANY attention to the actual politics at stake. He figured about half his retired friends were doing the same thing...
If you can't name the candidate you're voting for, and at least 1 major platform stance out any 1 issue that candidate supports out of that candidates top 10 supported initiatives, you are not informed enough to effect MY future by registering your invalid votes. If you want to vote straight ticket, that's fine, name 3 platform stances of your party instead. If you can do that, you can vote, if not, either stay home, or only vote for the candidates you know something about. If uninformed people continue to vote, we'll need to bring voter certification back into play... (yes, I know it was used to discriminate in the past, but it would be VERY easy to ensure that did not happen in the future).
There is no contest in life for which the unprepared have the advantage.
I worked as an Elections Clerk. I was the person who hired the Elections Judges (poll workers) and was phone triage on elections day when they didn't know what to do with a voter.
First, 99.99% of the EJs are good people, but there are also bad seeds. You must guard against the EJ's as much as the voter. We had an EJ voting every day of early voting, until the Alternate Judge discovered what he was doing and reported him to us. We reported him to the County Commissioners and County Prosecutor who declined to prosecute the person for whatever (probably politically motivated) reason.
With paper ballots, the fraud would be easier to spot statistically. But any EJ that could figure out how to upload a virus to their voting machine, and get it onto the tabulating machine, could possibly edit results in a way that would make it very hard to discover.
Second, an attacker could possibly find a way to defeat a tamper seal, or could break into the storage facility of the voting machines before election day, or I am sure there are a multitude of other attacks where someone could have a short time of unsupervised access to the voting machine that wouldn't be detected by tamper proof seals.