Slashdot Mirror
Internet Voting Hack Alters PDF Ballots In Transmission
msm1267 (2804139) writes Threats to the integrity of Internet voting have been a major factor in keeping the practice to a bare minimum in the United States. On the heels of the recent midterm elections, researchers at Galois, a computer science research and development firm in Portland, Ore., sent another reminder to decision makers and voters that things still aren't where they should be. Researchers Daniel M. Zimmerman and Joseph R. Kiniry published a paper called 'Modifying an Off-the-Shelf Wireless Router for PDF Ballot Tampering' that explains an attack against common home routers that would allow a hacker to intercept a PDF ballot and use another technique to modify a ballot before sending it along to an election authority. The attack relies on a hacker first replacing the embedded Linux firmware running on a home router. Once a hacker is able to sit in the traffic stream, they will be able to intercept a ballot in traffic and modify code strings representing votes and candidates within the PDF to change the submitted votes.
Why isn't that referenced? E2E encryption eliminates this, assuming the user is not an idiot.
Clearly, this would never happen outside of an academic setting. Who would bother?
Does it matter, who?
so how about not running an http server but instead using an https connection? Here, solved this one for you.
You can't handle the truth.
No computer is suited for elections. They need constant verification, which they are not getting.
And I sure do hear a lot of people saying, *I didn't vote for that!*, more than usual, but I don't expect anything to come of it. Everybody is just too conditioned to write off such talk as crazy.
“He’s not deformed, he’s just drunk!”
I do PDF processing using a server class rack mount machine. Damn, if I could have known that I could have used a cheap off-the-shelf router to do this, I could have had a raise..
Clearly, this would never happen outside of an academic setting. Who would bother?
Does it matter, who?
The outcome of elections are worth billions to vested interest groups. $4 billion was donated to candidates and PACs in the months preceding the election on November 4th. Many, many, people would "bother".
Seriously?
Whats wrong with paper?
Lots of systems for automatically dealing with it. Unique and irrefutable record. Easy to recount. Don't like one machine? Design a better one to scan and count. People really pissed off? Count those SOBs one at a time in front of a crowd on a big-screen TV.
Ballot boxes are easily placed out in the open; they're easily observed and tracked by as many people as would like to. The entire way through the process.
Lots of very large, modern democracies just use paper. Including your neighbours up north. X marks the spot.
Crazy.
..don't panic
E2E encryption likely won't work. The router would set it self up as a proxy to allow a man in the middle attack. But you might be able to use encryption of the ballot itself, not it's transmission layer to avoid a problem. However this would be a pain in the ass since now the user has to somehow assign passwords and stuff.
Some drink at the fountain of knowledge. Others just gargle.
When you keep the divisions within the margin of error, it is very easy to push the results one way or the other without raising suspicion, and any possible evidence is very easy to hide, or destroy, as the case may be. But without that, it is not difficult to trace means and motive, and only one conclusion can be drawn. Why should I ever give the authorities the benefit of the doubt? Isn't 10,000 years of precedence enough?
“He’s not deformed, he’s just drunk!”
How is this even noteworthy technologically? He's assuming he can modify the router firmware. "If I completely replace the software handling my data, I can change the data!" Seriously? That's the dumbest, most obvious thing possible.
$_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
2. covertly install functioning hacked firmware on the wireless routers of a significant percentage of the citizenry
That's already been done in the real world. It looks like it was done on a budget that's trivial compared to the value of modifying votes.
Otherwise known as the "voting machine company was too stupid to implement SSL" attack?
Or, for email, the "what idiot thinks email is secure without local S/MIME or PGP signatures" attack. Seriously, on-wire tampering is the least if your worries if you're *emailing* ballots around.
is what's wrong with paper. Long lines in poor neighborhoods. Broken machines. Polling places closing hours early when you know people can't take time off to vote
You'll never see voting day a national holiday because the powers that be don't want the lower caste voting. Progressives do though, and we're trying to come up with ways to combat voter suppression. From the progressive standpoint who cares if it gets hacked? The paper vote has already been hacked so to hell by voter suppression that things can't get any worse.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
If this can happen at home router level, think what can be done at the ISP. This is not an issue of router security, because your traffic can be intercepted with other techniques, this points to a much larger problem that electronic voting results can be changed in transit and they travel over open internet. Who can change packets in transit, let's see:
* US government (NSA, FBI, or any other agency with full access)
* Government sponsored hackers (Russia, China, etc...)
* Your ISP (Comcast, Verizon, etc)
* Backbone ISP (Level3, Sprint, MCI, etc)
* Non government sponsored hackers (Anonymous,...)
The traffic should be secured end-to-end - both authenticated and encrypted (the latter for privacy reasons).