Contest To Hack Brazilian Voting Machines

An anonymous reader writes "Brazilian elections went electronic many years ago, with very fast results but a few complaints from losers, of course. Next month, 10 teams that accepted the challenge will have access to hardware and software (Google translation; original in Portuguese) for the amount of time they requested (from one hour to four days). Some will try to break the vote's secrecy and some will try to throw in malicious code to change the entered votes without leaving traces."

Comments

why is electronic voting so hard?

[timmarhy]

I've never understood how, on a technical level, electronic voting has failed so hard in many countries. write a simple app that writes the vote to a flat text file, then reads the recorded result back to the voter for them to confirm, and store a hash of the result seperately. encrypt all the drives, lock down the hardware in each location with steel boxes and armed gaurds if needed.

transport the results out of the voting location with the votes and hashs seperately and count then use the hash to verify that the count wasn't tampered with in transit etc.

Hacking an election: easier than it sounds

[fgouget]

A lot of people seem to believe that hacking an election that uses electronic voting machines is so hard it's the stuff of science fiction.

However some time ago I came across an article describing how an unknown group hacked the Vodafone-Panafon cell-phone system. To me this hack conclusively proves that these groups have the technical and financial resources necessary to steal an electronic voting election.

Consider:

• They tapped the cellphones of Greece's prime minister and over 100 high-ranking dignitaries. All people for whom security is important and who would have noticed if something was amiss.
• They hacked into Vodafone's switches: equipment that's rarer and more expensive than voting machines.
• They had to hot-patch the software in memory since these switches are almost never rebooted. No such trickery is needed for voting machines.
• They also had to ensure their hacks would evade detection and survive the regular software upgrades. In particular these upgrades perform checksums on the running software to ensure the starting point is as expected. But hey had countermeasures to avoid detection by these checksums. Not an issue you have if you hack the voting machines at the right time before the election.
• To evade detection they also had to make sure none of their activity would be visible in any of the audit logs.
• Yet, they remained undetected for over 6 months and where only detected by chance. In an election your hack only has to remain undetected for one day, then it can wipe itself clean and you've won.
• The group who performed this hack was never identified.