Slashdot Mirror
Voting Machine Attacks Proven To Be Practical
An anonymous reader writes "Every time a bunch of academics show vulnerabilities in electronic voting machines, critics complain that the attacks aren't realistic, that attackers won't have access to source code, or design documents, or be able to manipulate the hardware, etc. So this time a bunch of computer scientists from UCSD, Michigan, and Princeton offered a rebuttal. They completely own the AVC Advantage using no access to source code or design documents (PDF), and deliver a complete working attack in a plug-in cartridge that could be used by anyone with a few private minutes with the machine. Moreover, they came up with some cool tricks to do this on a machine protected against traditional code injection attacks (the AVC processor will only execute instructions from ROM). The research was presented at this week's USENIX EVT."
They completely own the AVC Advantage using no access to source code or design documents
What do Source Code and Design Documents have to do with purchasing something?
What these "intellectuals" and "researchers" have to keep in mind, is that in reality, no one would ever dream of committing election fraud.
We all live in a utopia, where everyone has equal say, no one would ever coerce others and there's a kitten on every lap. That's why there are no such things as secret ballots. In every voting booth there will be three heavily armed guards who will watch you vote to ensure that you won't be doing anything you shouldn't do.
Have a cotton candy, drink your beer and turn on the TV. The shiny shiny is on again, you like that. You have always liked that.
</sarcasm>
Americans today committed egregious acts of democracy to elect the next failed administration and the next failed Congress.
In a fabulous upset, almost no-one could bring themselves to vote directly for either of the official candidates, instead opting for a write-in vote. Popular write-ins included "the black guy", "the old guy", "McCain from 2000" and "Tina Fey." The seventeen votes for "The Invisible Man" were tallied for Joe Biden. Several tons of Liquid Paper needed to be scraped off voting machines.
The winning candidate turned out to be Noneof Theabove, 46, of Dogshit, Nebraska. Apart from the Presidency, Mr Theabove won 72% of Congressional seats and all Senate seats up for election this year.
Mr Theabove's policies include drinking, shouting abuse at the television and inchoate existential despair. "He completely embodies the national mood," said Nate Silver of FiveThirtyEight.com, just before applying for a new job flipping burgers.
A majority of US soldiers in Afghanistan stated the place was "just fine, really" and they were learning to speak Pashto rather than returning. Canada looked south and snickered, though not very much as they still had Stephen Harper to cope with. The Kingdom of Mexico stated its "regret" today that it has had to close its borders to American refugees.
http://rocknerd.co.uk
deliver a complete working attack in a plug-in cartridge that could be used by anyone with a few private minutes with the machine.
It's not a bug! It's a feature!
Electronic bits do not have the quality of being static. Electronic votes can be changed without obvious physical evidence, and as long as they're purely electronic, it will always be like that.
Even an optical disk is more static than electronic bits that live in a database.
People need to demand paper ballots until electronic voting machines are all enhanced with built-in paper trails.
Check out my sysadmin blog!
The nations new electronic voting system helps Obama secure a landslide victory on his historic third term.
People say my sig is the best thing about me.
Or people can listen to a whistleblower who programmed voting machines that easily allowed fraud without a trace.
If you have something that you dont want anyone to know, maybe you shouldnt be doing it in the first place -Eric Schmidt
Copy/paste, some formatting, no tables. Extra carriage returns (sorry)... "Implementing the gadgets" section stripped off...
Abstract
A secure voting machine design must withstand new attacks
devised throughout its multi-decade service lifetime.
In this paper, we give a case study of the longterm
security of a voting machine, the Sequoia AVC
Advantage, whose design dates back to the early 80s.
The AVC Advantage was designed with promising security
features: its software is stored entirely in read-only
memory and the hardware refuses to execute instructions
fetched from RAM. Nevertheless, we demonstrate that an
attacker can induce the AVC Advantage to misbehave
in arbitrary ways--including changing the outcome of
an election--by means of a memory cartridge containing
a specially-formatted payload. Our attack makes essential
use of a recently-invented exploitation technique
called return-oriented programming, adapted here to the
Z80 processor. In return-oriented programming, short
snippets of benign code already present in the system
are combined to yield malicious behavior. Our results
demonstrate the relevance of recent ideas from systems
security to voting machine research, and vice versa. We
had no access either to source code or documentation beyond
that available on Sequoia's web site. We have created
a complete vote-stealing demonstration exploit and
verified that it works correctly on the actual hardware.
1 Introduction
A secure voting machine design must withstand not only
the attacks known when it is created but also those invented
through the design's service lifetime. Because
the development, certification, and procurement cycle for
voting machines is unusually slow, the service lifetime
can be twenty or thirty years. It is unrealistic to hope
that any design, however good, will remain secure for so
long.1
In this paper, we give a case study of the long-term
security of a voting machine, the Sequoia AVC Advantage.
The hardware design of the AVC Advantage dates
back to the early 80s; recent variants, whose hardware
differs mainly in featuring a daughterboard enabling audio
voting for the blind [3], are still used in New Jersey,
Louisiana, and elsewhere. We study the 5.00D version
The AVC Advantage voting machine we studied.
(which does not include the daughterboard) in machines
decommissioned by Buncombe County, North Carolina,
and purchased by Andrew Appel through a government
auction site [2].
The AVC Advantage appears, in some respects, to offer
better security features than many of the other directrecording
electronic (DRE) voting machines that have
been studied in recent years. The hardware and software
were custom-designed and are specialized for use in a
DRE. The entire machine firmware (for version 5.00D)
fits on three 64kB EPROMs. The interface to voters
lacks the touchscreen and memory card reader common
in more recent designs. The software appears to contain
fewer memory errors, such as buffer overflows, than
some competing systems. Most interestingly, the AVC
Advantage motherboard contains circuitry disallowing
instruction fetches from RAM, making the AVC Advantage
a true Harvard-architecture machine.2
Nevertheless, we demonstrate that the AVC Advantage
can be induced to undertake arbitrary, attackerchosen
behavior by means of a memory cartridge containing
a specially-formatted payload. An attacker who
has access to the machine the night before an election can
use our techniques to affect the outcome of an election by
replacing the election program with another whose visible
behavior is nearly indistinguishable from the legitimate
program but that adds, removes, or changes votes
as the attacker wishes. Unlike those attacks described
1
in the (contemporaneous, independent) study by Appel
et al. [3, 4] that allow arbitrary computation to be induced,
our attack
1. What form of electronic voting could not be compromised?
2. What form of paper voting could not be compromised?
It may be that we must accept that no form of voting is "secure" in the sense of cannot be gamed.
At least, people have been gaming votes for as long as democracy has existed, so I don't know if they're going to stop just because we make it slightly less convenient.
Futurist Traditionalism
Here's what I'm trying to understand.
We have this great thing called Public Key Crypto and the PKI to go along with it.
If you presume a custom processor that will only execute code signed by an election commission, that would be a first step - the system won't run anything that hasn't been specifically approved for installation on the machine. There would be no more "last minute fixes" as we've seen in the past, where code was installed without being vetted by an election authority.
For that matter, require the software developers to store their code on a state or federal election repository, and only sign code that's been compiled on those systems, from that repository. Require that anyone who makes changes sign them with their private key and state the reason for the change.
For the results, take each ballot, strip off the identifying information, and encrypt it to the election commission, and sign it with a pre-deployed per-machine private key that's known. It would of course also be important to have a reliable time source for the device, to include that in the result file.
I would even envision that this would be a good purpose for a federal election agency - hosting the code for all certified voting systems, and being the "root of trust" that signs certificates for the state election commissions, which can then sign local and county commissions, which can then issue keys to individual election machines.
Some patches to an open-source OS, say Linux, a PKI infrastructure (along with some HSM modules to store keys) and a processor with an integrated crypto engine and TPM module would take care of all of this.
Banks do this kind of stuff all the time - what's so hard about it?
Give me a few private minutes with a paper ballot box and I can stuff it full of ballots for my candidate. That's an old-school hack.
Looks like return-oriented programming is a nice way to own various pieces of locked down hardware, eg. region-coded DVD drives, carrier-locked phones etc.
This is not a signature.
I worked as an Elections Clerk. I was the person who hired the Elections Judges (poll workers) and was phone triage on elections day when they didn't know what to do with a voter.
First, 99.99% of the EJs are good people, but there are also bad seeds. You must guard against the EJ's as much as the voter. We had an EJ voting every day of early voting, until the Alternate Judge discovered what he was doing and reported him to us. We reported him to the County Commissioners and County Prosecutor who declined to prosecute the person for whatever (probably politically motivated) reason.
With paper ballots, the fraud would be easier to spot statistically. But any EJ that could figure out how to upload a virus to their voting machine, and get it onto the tabulating machine, could possibly edit results in a way that would make it very hard to discover.
Second, an attacker could possibly find a way to defeat a tamper seal, or could break into the storage facility of the voting machines before election day, or I am sure there are a multitude of other attacks where someone could have a short time of unsupervised access to the voting machine that wouldn't be detected by tamper proof seals.
Best quote from the paper:
The absence of a paper audit trail means that the vote modification will not be detected.
... much less corrected.
You can have a very hackable machine with an immutable, hand-countable, voter-verified paper trail (i.e. printed ballots) and you'll be okay*, assuming multiple mutually-hostile parties are keeping an eye on the paper trail.
You can have a very difficult to compromise machine without a paper trail and you'll never know with certainty your results are accurate.
*There may be difficulties where a machine is needed to provide voter-verification, such as when reading back a filled-in printed ballot to a blind person. In most elections, the numbers of such ballots are less than the margin of victory. However, in some, such as the Florida Presidential race of 2000 or the Minnesota Senate race of 2008, this may not be the case. A way to handle this is for the read-back machine to be made, installed, and supervised independently of any machine that helps cast votes/print filled-in ballots.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Here's a system I can trust:
User uses a machine to prepare a printed ballot. In addition to printing the ballot the machine records a running tally. Of course, both are subject to fraud.
The user inspects the printed ballot. If the printed ballot is bogus it is invalidated and the user votes again. If the user is blind he has a trusted friend or a machine read the ballot back to him. If he uses a machine, it will be a machine developed independently from the ballot-printing machine. There is an opportunity for fraud by the friend or the ballot-readback machine but the odds of a successful collusion with the ballot-preparing machine are greatly reduced.
The user deposits the printed ballot in a ballot box just as he would a hand-filled-in ballot. In fact, some voters may choose to use a hand-filled-in ballot, although those voting in languages other than English or heavy-minority languages may be forced to use the ballot-marking machine, as might those who cannot see and who do not have someone with them.
The numbers collected by the ballot-preparation machine are unofficial and incomplete. They may have utility for spotting statistical anomalies in the official result, which of course would generate a recount.
The printed ballots are then counted, either locally or at a central location, by two machines, each developed independently and used by different teams of counters. If the results vary by enough to sway any race, a third count, probably by hand, will be done.
There, that's a system that
* I can trust, provided I can trust the people conducting the election**
* A system that has machine voting, or should I say, machine-assisted voting
**yeah yeah I know, "trust the people conducting the election" is probably impossible, but I can dream, can't I?
--
Advantages of such a system over manual-fill-in bubble-sheets:
* Arbitrary numbers of languages can be supported easily without wasting paper
* Arbitrary number of different elections can be held at the same location without wasting paper
Disadvantages:
* Cost
* Complexity
* Requires more poll watchers
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Here's a several trillion bucks and counting glaring example about how most reps and senators give not crap one what their constituents want: Public opposition including phone calls, faxes, emails, snail mails and buttonholing was running well over 90% against the casino bankers bailouts. Yet it passed, both under the shrub admin and continues today under the yomama admin. People just wanted normal bankruptcy to occur, let the real free markets sort out those ludicrous collateralized debt obligations and hedged derivatives bets and all those other pseudo financial "products" and other forms of mass leechery from the real working folks. People said in huge numbers "No, we don't need to offer millionaires and billionaires welfare when they bet wrong, they should eat their own megacapitalist dogfood..we'll deal with whatever happens, but don't subsidise those people". But nope, the US public got put on the hook to bail them out.
GM and Chrysler, again, decades of getting it wrong in the auto industry, all the chance in the world for management, unions and investors to get it right..nope, they kept screwing up. People really didn't want to bail them out, again in huge numbers, just let them go bankrupt like normal, but, the quasi bailout happened anyway, and now we have some precedent that the executive branch can just seize corporations and run them. Seems like we fought a big fat war over that economic and governmental "blend" two generations ago, we were against that back then, and actually hung some of the high level proponents after that war. Now, it is *policy*, despite most folks being against it.
Look at the dumb wars..I sincerely doubt there is even close to a majority opinion anymore to continue these wars....but they still go on.
The bottom line is "government" doesn't give a rat's ass what "the people" want, they just go ahead and do whatever they want to do, or what they have been bribed and blackmailed into doing.. I can't give you an exact date when it happened, but voting and "representative democracy" has been broken on many levels for a long, long time now.
Now I still vote, inertia mostly and all, but I think it stopped having much meaning at the larger scales. Local elections I think your vote can make a little difference, at state and above levels though, you have your choice of the globalist screw the middle class party that subsidizes a.b and c over there at your expense, or the globalist screw the middle class party, who subsidizes x,y and z over thataway, again at your expense.
I *wish* it was different, really, I sincerely do, but not seeing it. Until such a time as the two corrupt major parties are abandoned or outlawed for major racketeering, just not seeing things getting any better. Just way too corrupt, for way too long now, it is just "business as usual", and neither party has any incentive to eliminate themselves or the other party, because they are equally corrupt, so they just are never going to go there.
My big hope, really..I hope the USA does a USSR and just dissolves as a bad idea, past prime, with no bloody revolutions. I want some real honest choice. If a regional bloc or state wants joe government to run all aspects of their lives, cradle to grave, and stay taxed at 90% with a herd of commissars overseeing them all the time...swell, let them try that, see how it works. If another wants just about no government at all, private everything, no rules except ferengi "profit at all costs!", fine, let them try that and see what happens.
Somewhere, some state or group of previous states will go "gee..ya know..the original Constitution and bill of rights actually seems well thought out..wonder what will happen if we really, REALLY follow those guidelines and not just lie about it all the time??". THAT place I *will* move to, even if I have to fight every step of the way there.
First, 99.99% of the EJs are good people, but there are also bad seeds. You must guard against the EJ's as much as the voter.
Indeed you must. In my state there are four of us, representing at least two different political parties. It seems unlikely to me that you could get four randomly assigned people from different political parties to all agree to rig an election.
We had an EJ voting every day of early voting, until the Alternate Judge discovered what he was doing and reported him to us.
Sounds like the system worked if he got caught. My only question would be why did it take so long? Our machines have always kept a running count of the votes cast that day that must match up with the number of people we've signed in. There are two different people who handle the signing in process (one who handles the poll book and the other who keeps a running handwritten list of the people who have voted thus far) so it wouldn't be easy to do a fake sign in to keep the numbers matching. If you tried this at my polling place I would know about it pretty quickly as I always make a point of checking the running total throughout the day.
We reported him to the County Commissioners and County Prosecutor who declined to prosecute the person for whatever (probably politically motivated) reason.
Well, that's bullshit right there. As far as I'm concerned messing with the electoral process should be regarded as a felony and punished accordingly.
But any EJ that could figure out how to upload a virus to their voting machine, and get it onto the tabulating machine, could possibly edit results in a way that would make it very hard to discover.
They could, but the machines are randomly audited and you have no way of knowing if yours is going to be one of them or not. I don't know what else you can do to protect the system at this point. You could audit every single machine but that would require manpower and resources that most Election Boards just don't have.
Second, an attacker could possibly find a way to defeat a tamper seal, or could break into the storage facility of the voting machines before election day, or I am sure there are a multitude of other attacks where someone could have a short time of unsupervised access to the voting machine that wouldn't be detected by tamper proof seals.
You've got an awful lot of "coulds" there. People could do any number of things. All you can do is make the system as secure as possible. At least with regards to New York State I haven't seen any glaring holes in the security of our electoral process or anything that I would do differently if I was in charge of the whole show.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.