DC Internet Voting Trial Attacked 2 Different Ways

mtrachtenberg writes "University of Michigan Professor J. Alex Halderman and his team actually had two completely separate successful attacks on Washington, DC's internet voting experiment. The second path in was revealed by Halderman during testimony before the District of Columbia's Board of Elections and Ethics on Friday. Apparently, a router's master password had been left at the default setting, enabling Halderman to access the system by a completely different method than SQL injection. He presented photographs of a video stream from the voting offices. In addition, he found a file that had apparently been left on the test system contained the PINs of the 900+ voters who would have used the system in November. Others on the panel joined Halderman in pointing out that it was not just this specific implementation of internet voting that was insecure, but the entire concept of using today's internet for voting at all. When a DC official asked why internet voting could not be made secure when top government secrets were secure on the internet, Halderman responded that a big part of keeping government secrets secret was not allowing them to be stored on internet-connected computers. When a DC official asked the panel whether public key infrastructure couldn't allow secure internet voting, a panel member pointed out that the inventor of public key cryptography, MIT professor Ronald Rivest, was a signatory to the letter that had been sent to DC, urging officials there not to proceed with internet voting. Clips from the testimony are available on YouTube." Update: 10/09 19:24 GMT by T : Reader Cwix points out two newspaper stories noting these hearings: one in the Washington Post, the other at the Chicago Tribune. Thanks!

Comments

Facts don't matter

[webnut77]

When a DC official asked the panel whether public key infrastructure couldn't allow secure internet voting, a panel member pointed out that the inventor of public key cryptography, MIT professor Ronald Rivest, was a signatory to the letter that had been sent to DC, urging officials there not to proceed with internet voting.

Just another example of our government ignoring the facts in favor of doing whatever they want.

Re:Facts don't matter

[_Sharp'r_]

Why then are they making voting machines less secure than ATMs?

You clearly don't understand enough about ATMs if you think they are more secure than voting machines.

Most ATMs are just barely secure enough to keep the cash from walking away as long as someone can keep a physical eye on the machine (something somewhat inhibited for voting machines by private voting requirements). ATMs generally do a decent job of recording and reporting transactions to a remote server so that when money invariably is stolen (physically or electronically) it can eventually be taken from the correct legally accountable bank account.

A variety of ATMs suffer from default passwords that aren't changed, physical cabinet keys that aren't unique, eavesdropping attacks in the form of card skimmers and cameras, unencrypted transmissions, insecure operating systems, administrative backdoors, etc...

ATMs and voting machines suffer from what are essentially illusions of security that rely on no one smart enough to bypass them having the real desire and resources to do so. When voting machines determine how real power in large amounts is distributed (say, in national elections), they can't hope to stand up to what's at stake unless they are simple enough to be essentially transparent in function to the public.

Re:Facts don't matter

[HungryHobo]

ATM's are fairly hardened, at least in comparison to most voting machines.
If anything they should learn more from gaming machines. many states have extremely strict rules for how gaming machines have to be auditable(to make sure the casino is following state regulations), hardened in very specific ways and in general vastly more secure than any voting machine I've ever heard of.

and yet when it comes time to buy voting machines do they think to apply roughly the same regulations?
god no.
Instead they get a 100 buck POS wraped in a neat but insecure case which the company charges a few grand for.

it should be perfectly possible with proper crypto, hardened terminals and proper security to make electronic voting(in person, not over the net, but on that count you're only contending with mail votes) at least as secure as voting on a piece of dead tree if not slightly better and a lot more efficient/accurate.
you decrease the risk of some of the more traditional forms of tampering(like ballot boxes mysteriously appearing in the counting room) and if done properly get only a slightly increased risk of computerized shenanigans.

Re:Facts don't matter

[Sique]

Electronic voting still can't solve a simple thing:

To make each vote proven unique and untrackable at the same time.

With paper it's easy. Each piece of paper is unique by virtue of being a real object. Electronic votes are data, and data is limitless copyable, so the only way to warrant a piece of data is unique is giving it a unique ID, at which moment it becomes trackable.

Re:Facts don't matter

[Joce640k]

We're talking about internet voting, not voting machines. ie. People voting from their botnet-ridden home PCs.

What's to stop a party from releasing a virus which triggers once on election day then deletes itself from disk? Such a virus could subvert the entire process, regardless of public keys, SSL, whatever.

Re:Facts don't matter

[DavidTC]

And while paper ballots are not trackable at the vote level, you can physically keep track of them and know where they are at all times. You can sit there and watch the box, you can watch people add and remove things to the box. You can see the 'vote container' without actually seeing the votes, and know that no one can actually change the votes without adding or replacing or removing them from the container, which you could see.

There's no way to do that with electronic voting. The votes can be tampered with without detection, because you're handing the entire ballot box to people every time they vote, where upon they take it into the booth with them and do whatever to it.

Moreover, the people voting can't actually see their vote to start with.

It's just insecure in so many ways, the entire concept is insecure. It's a lot like DRM, in fact...the fact they currently get broken by stupid security issues is sorta masking the fact the entire idea is stupid and unworkable.

Electronic voting, incidentally, is a form of DRM. Except it's DRM where the programmers and system designers have motive to break it also, stopped only by a third party that doesn't understand any of this. So yeah.

To quote Douglas Adams, 'their fundamental design flaws are completely hidden by their superficial design flaws.' The problem isn't any specific security flaws discovered at any specific time, the problem is the idea of non-physical voting, period, full stop, because all the methods we have to stop fraud are via paying attention to physical objects.

A solution to a problem that doesn't exist

[Anonymous Coward]

Electronic voting always seemed to me like a solution looking for a problem.

What, exactly, is it about paper ballots that makes electronic voting systems seem like such a better idea? Obviously it's easier to rig elections with electronic systems, which is a good reason to like electronic voting if you're a scumbag. Aside from the that, what reasons are there to replace a tried and true system that everybody already likes and prefers?

Re:A solution to a problem that doesn't exist

[NiteMair]

Obviously it's easier to rig elections with electronic systems, which is a good reason to like electronic voting if you're a scumbag.

I think you answered your own question there...

Re:A solution to a problem that doesn't exist

[jd]

Obviously it's easier to rig elections with electronic systems

Extraordinary claims require extraordinary proofs.

Let us say you have an electronic ballot system, where the voter's registration card has a public encryption key. The ballot is then encrypted using that key. The corresponding private key is in a central computer, with no record linking it to the public key (thus preserving anonymity). This allows the central computer to verify that any one encryption key is used once and only once (one person cannot cast more than one vote), and that no vote that is counted comes from a person without a valid encryption key (so all votes are from people). Let us also say that observers and election officials are supplied with crytographic hashes of the unencrypted ballots at the time of the vote being cast. The total number of votes tallied at the end must equal the total number of cryptographic hashes if no fraud was perpetrated. Since the hash will uniquely identify the cast vote (without identifying what any individual voted), stolen votes (votes injected into the system by an attacker) would be readily identifiable as they would not match a hash. Fraudulent votes could then be eliminated and replaced with the real ones in a semi-automated recount.

We now have three things that cannot be tested with any paper ballot and one corrective action that cannot be achieved by paper ballot.

If you want to show that it is easier to rig an electronic election, find a way you could rig the above system that would be easier than an election official substituting a real ballot box with a pre-stuffed one (something that actually happened in the 2000 election) or that would be easier than an election official "losing" thousands of votes behind office furnishings (something that actually happened in the 2004 election).

The above system is not perfect, but show me that it isn't better. It may be that paper ballots are better, but that doesn't mean it is "obvious". Oh, and as for dodgy software (as happened with Diebold), let's say the election system used a CC EAL7 (Orange Book A1) rated platform, that the software AND submitted proof was open to independent scrutiny, that all networking was encrypted and run over a virtual circuit (so it can't be tampered with and can't be DDoSed) and that both NIST scrutiny and independent scrutiny had certified the systems as secure, politically agnostic, reliable, fault-tolerant and robust.

Again, these are all criteria you can look for in an electronic system, but not a single one of them applies to a manual system. The current system is run by party stooges, for a start. That automatically creates means, motive and opportunity for electoral fraud. Independent international observers have tried to monitor US elections but were blocked from doing so, so independent scrutiny is impossible. Reliability is obviously false, given that electoral fraud has happened on a fairly substantial scale in the past (hence the interest by international observers).

Now, if you meant "the proposed electronic system is open to fraud", then I'd agree with you. It's the generic that I'm not happy with, as it's possible to show that there's examples of superior electronic systems even if they're not ones that would likely be deployed in practice.

Re:A solution to a problem that doesn't exist

[feenberg]

Maybe sweeps are in November because that is when the elections are? Anyway the problem with electronic voting is not only that it is hard to do right, but also that it is impossible to show the average voter that it has been done right. With paper ballots and each party having a representative at the polling place and at the counting, voters are willing to believe the count is accurate. The offer to examine the source code is less convincing. Saying that the source code has been examined by someone paid for by the company that wrote the code is nothing at all.

Re:Please use internet voting

[TheP4st]

Troll or not, Anomynous Coward do have a valid point.

Votes simply don't matter...

[blahplusplus]

... I don't understand why people are so up and up about the voting system given that

1) The vast majority of the public is too stupid to make any kind of sound decision about many issues
2) Most candidates can only get anywhere by money
3) You can never get rid of or mitigate the influence of money on politics since corporations are what makes the world go round.
4) Until their is something of a mass movement/revolt so that the power of corporations are reigned in, voting is irrelevant.

Re:Votes simply don't matter...

[copponex]

Yeah. Fuck democracy. It's not like keeping the voting system accessible by the public has any meaning. What's the difference between North Korea and America? Why, just a little cuisine and weather, right?

1) The vast majority of the public is too stupid to make any kind of sound decision about many issues

Go fuck yourself. Seriously.

2) Most candidates can only get anywhere by money

Martin Luther King? Desmond Tutu? Ghandi? There have been many political leaders, who didn't necessarily enter politics, who were able to force the state to change because the truth was no longer concealable. You cannot govern a population that does not want to be governed by you. Their desire to hold on to their positions of power is both a blessing and a curse. Even in communist China popular will has given way to reforms because the ruling party didn't want to be overthrown. There are some examples of states supported by outside powers, or in power because that state is under threat from other states, but especially in the developed Western world, the citizens of a nation determine their destiny.

3) You can never get rid of or mitigate the influence of money on politics since corporations are what makes the world go round.

Bullshit. People are what make the world go around. Do you really think life would stop tomorrow of AT&T and Exxon didn't exist? Civilization existed for thousands of years before the corporation. They are a human invention, not some magical organization that's any better or worse than any other hierarchy. But keep swallowing that line like an obedient intellectual prostitute.

4) Until their is something of a mass movement/revolt so that the power of corporations are reigned in, voting is irrelevant.

Bullshit. Countries around the world have voted to kick corporations out. Unfortunately, when they do, the United States often assassinates their leader or overthrows their democratic government through coups or terror campaigns. If you are an American citizen, you are one of the most powerful people on earth, because you have a vote that can change the way the world operates. But you've accepted the reality they sold to you, not out of struggle or just giving up because you don't have the strength to continue fighting, but because accepting that belief enables you to act immorally and pretend that it doesn't matter. You're nothing more than a sell out.

Democracy is a device that ensures we shall be governed no better than we deserve. -George Bernard Shaw

Re:Please use internet voting

[Miseph]

Question: if we use internet voting, will that impede voter intimidation, ballot stuffing, creative counting or any of the other traditional methods of rigging elections proudly used in this country since the 18th century? Because if so, I've been informed it doesn't matter what I vote, and if not then I've been informed it still doesn't.