Slashdot Mirror
DC Internet Voting Trial Attacked 2 Different Ways
mtrachtenberg writes "University of Michigan Professor J. Alex Halderman and his team actually had two completely separate successful attacks on Washington, DC's internet voting experiment. The second path in was revealed by Halderman during testimony before the District of Columbia's Board of Elections and Ethics on Friday. Apparently, a router's master password had been left at the default setting, enabling Halderman to access the system by a completely different method than SQL injection. He presented photographs of a video stream from the voting offices. In addition, he found a file that had apparently been left on the test system contained the PINs of the 900+ voters who would have used the system in November. Others on the panel joined Halderman in pointing out that it was not just this specific implementation of internet voting that was insecure, but the entire concept of using today's internet for voting at all. When a DC official asked why internet voting could not be made secure when top government secrets were secure on the internet, Halderman responded that a big part of keeping government secrets secret was not allowing them to be stored on internet-connected computers. When a DC official asked the panel whether public key infrastructure couldn't allow secure internet voting, a panel member pointed out that the inventor of public key cryptography, MIT professor Ronald Rivest, was a signatory to the letter that had been sent to DC, urging officials there not to proceed with internet voting. Clips from the testimony are available on YouTube." Update: 10/09 19:24 GMT by T : Reader Cwix points out two newspaper stories noting these hearings: one in the Washington Post, the other at the Chicago Tribune. Thanks!
to mod me up to +5 informative, to show it does work perfectly!
When a DC official asked the panel whether public key infrastructure couldn't allow secure internet voting, a panel member pointed out that the inventor of public key cryptography, MIT professor Ronald Rivest, was a signatory to the letter that had been sent to DC, urging officials there not to proceed with internet voting.
Just another example of our government ignoring the facts in favor of doing whatever they want.
> the inventor of public key cryptography, MIT professor Ronald Rivest,
Rivest is a brilliant, very accomplished man, and was one of the inventors of one of the earliest and best-known public-key cryptosystems. But it's misleading to refer to him as "the" inventor of public-key cryptography in general. He co-invented RSA with Shamir and Adleman (several years after Cocks came up with it and kept it secret). But the concept of public-key cryptography was described before RSA, by such luminaries as Diffie, Hellman, and Merkle. He is certainly one of the pioneers of public-key crypto, and deserves acclaim for that, but is not "the" inventor of the concept.
Incidentally, much of Rivest's recent work is in the area of electronic voting (how to make it simultaneously accurate/auditable, privacy-preserving, and usable by non-technical people)--so he's not just speaking as a luminary in the field, but as someone who has studied this specific problem.
The youtube videos are all well and good.. heres a few links to written articles about this though
http://voices.washingtonpost.com/debonis/2010/10/prof_explains_how_dc_online_vo.html
http://www.chicagotribune.com/news/chi-ap-dc-dcelections-heari,0,541741.story
You are entitled to your own opinions, not your own facts.
It was a terminal server, not a router, and the previously-published attack was shell injection, not SQL injection.
-insert a witty something-
Electronic voting always seemed to me like a solution looking for a problem.
What, exactly, is it about paper ballots that makes electronic voting systems seem like such a better idea? Obviously it's easier to rig elections with electronic systems, which is a good reason to like electronic voting if you're a scumbag. Aside from the that, what reasons are there to replace a tried and true system that everybody already likes and prefers?
It seems like the entire ordeal was designed to fail.
These were all fairly common attack vectors and not nearly as lavish as the PS3 stack smash. (Seriously, who thinks of that attack vector). Even basic precautions and awareness of current threat models would have enabled them to harden their system from these things. To add insult to injury the left over data on the host and default passwords to expose it.
I wholly agree that internet voting is fucking scary, but it seems like this test setup was created just to make the idea shine.
"You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
In the long run, the number of votes cast would tend to be based on prevailing interest rates. If the winner's salary + bribes is $1 million, and the prevailing rate of interest is 2%, then spending $50 million would only get you prevailing interest. You should spend less, because there are risks to being an office holder, and you might also lose.
Ultimately, an options market should be built around the candidates, and we should dispense with voting and simply sell shares in each candidate. Insted of pork, they could just pay dividends.
Of course, on the way to this perfection there might be some problems with candidate derivatives being sold over the counter, and banks over-leveraging on a particular candidate that nobody thought would lose or get sick and die.
Nevertheless, we should proceed. I'll get in touch with the Grand Negis shortly...
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
... I don't understand why people are so up and up about the voting system given that
1) The vast majority of the public is too stupid to make any kind of sound decision about many issues
2) Most candidates can only get anywhere by money
3) You can never get rid of or mitigate the influence of money on politics since corporations are what makes the world go round.
4) Until their is something of a mass movement/revolt so that the power of corporations are reigned in, voting is irrelevant.
In Annie Hall, Woody Allen is stuck in line behind an obnoxious guy pontificating about the work of media critic and scholar Marshall McLuhan
Evidently, sometimes it is.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
There's an even bigger problem: selling votes.
If I'm allowed to vote at home criminals can use threats and/or bribes to convince me to vote in their presence so they can be sure that I voted exactly how they wanted.
That's why vote must always be strictly secret and voters must always have plausible deniability about their choices. E.g. in most modern democracies voters are prohibited from taking photos inside the voting booth for exactly this reason: so anyone else cannot be sure of their votes, and threats and bribes to influence elections become much less effective.
There's a hidden treasure in Python 3.x: __prepare__()
A democracy means there is a vote to either directly approve laws (direct democracy) or to elect representatives to do the same (representative democracy). Republic literally means ruled by the public, not by a monarch or a non-elected supreme rule. America is a representative democracy that limits government power with a constitution, but since that constitution can be changed by democratic action, you cannot say that it isn't a democracy. We could do away with the constitution in another constitutional convention and replace it with another if we so chose.
Just because you read Atlas Shrugged yesterday doesn't mean shit to anyone else. Crawl back over the Drudge Report, where you can eat up the talking points regurgitation with the rest of the libertarian zombies.
What about all those "botnets" you see in the news?
Strength of cryptographic algorithms, etc., is completely irrelevant when people vote by visiting a web page using their home PC.
No sig today...
f it could, this would be known well in advance, since it's trivial to compare the proof with the code to see if they differ, and trivial to inspect a proof to see if the code could do that.
Really? You can somehow walk up to a computer and know the code on it is the same code that other people inspected?
That is...implausible to say the least.
This is because, of course, security certifications don't protect against the people installing the software. At all. Not a single one of them is even slightly designed to let users verify things administrators have done.
Seriously, you sound so knowledgeable, but somehow you think there's a way to walk up and verify that computers have had the software installed on them that you think they've had installed on them, and nothing else. That is so cute.
No, nobody can tamper with it, that's why I've stipulated so much bloody security. Machines that are input-only (where the voter registration office adds users) have mandatory access control, as do the voting machines themselves (by definition, since that is part of what A1 means). The counting system is essentially output only from the users perspective and therefore has no user account to crack. Input over the network would be via IPSec-utilized certificates with both client and server validating each other. Since the server has a pre-programmed list of acceptable voting machines, additional machines cannot be added in.
And, of course, nowhere in the list is there any way, nor can there be any way, to stop someone from sitting down at one of the machines and using a dozen of public keys to vote. (Which, as I pointed out, anyone working in a vote registration office can get.)
Because that is not, in any sense, 'tampering' with the machine.
Now, you'll probably assert they'd have to each vote individually, limiting their effect to a couple of dozen votes before they'd obviously be caught, because of the magical software you're sure will be there.
I will point out that, in no circumstances, would any TCSEC requirement restrict doing thousands of perfectly valid inputs in a few seconds, although obviously that could be an additional requirement of the system. TCSEC systems verify input. Ten thousand votes with public keys attached are correct input.
I will also point out that A1 security ranking is, um, impossible without physical security...and they get tested after being installed. You can't stick a computer in a box, pull it out six months later, and claim it's A1 security, unless you had someone watching the box at all times.
And note you've added at least two other computers to each polling site. And each voting computer needs some way to read the public key, so you've added a barcode reader, at least, to them.
To actually install A1-level security computers, you would spend millions of dollars per site.
Which makes the whole thing rather idiotic to start with, as we could never afford it, on top of the problem that A1 security is not designed to protect against a) programmer/administrative tampering (Which is what we're fucking talking about when we talk about tampering...we're not assuming voters figure it out.), and b) there's a rather obvious hole in the system of assigning public keys, so people can have entirely, utterly, completely 'valid' inputs that rig an election.
Here are the three specific security issues I've pointed out, that do not exist under paper voting. Please explain how your system catches them:
a) The person who loads the software onto a machine alters it before doing so.
b) Someone in the voter registration office adds extra voters to the roles, and takes their public keys, and they and others vote multiple times when they enter the booth. (This actually is fixable.) c) b, but with one poll worker also helping them. Perhaps by, when setting up the computers, they simply set one up in another room, so someone can
If corporations are people, aren't stockholders guilty of slavery?