Argentina Rewards Programmer Who Exposed E-Voting Vulnerabilities With A Complimentary Home Police Raid

from the shoot-all-the-messengers dept

An Argentinian programmer who was trying to do a good thing in exposing severe vulnerabilities in the country's e-voting system was rewarded for his actions -- with a police raid on his home. According to Argentinian news outlet La Nación, Joaquín Sorianello informed MSA, the company than makes the Vot.ar e-voting system, that the SSL certificates used by the system to encrypt transmissions between the voting stations and the central election office could be easily downloaded, allowing for potential voting fraud (or just a good old-fashioned DDOS attack).

Sorianello, who says he never received a phone call from MSA after reaching out to the company to report the flaw, suddenly found his home being raided by Argentinian police, who seized computers, Kindles, and numerous storage devices (from a Google translation of the source):

"The truth is amazing, you notify the company that they have a failure in their voting system and the next thing they do is (raid my home) instead of looking for the real culprits..."I'm just a programmer, I'm not a hacker." Sorianello told La Nacion that he contacted the police station in Caballito to corroborate the raid: "They said yes, but they could not tell me why or how it was going to take." He also said he did not receive any call from the company (after having told them about the flaw a week) ago."

Sorianello has pointed out to numerous news outlets that he's a programmer -- not a hacker, and if he had wanted to hack into the systems to cause damage, he certainly wouldn't have informed the company of the flaw first. He's also repeatedly pointed out that it was the protected @FraudeVotar Twitter account that published the core details of the e-voting internals, not him. That apparently didn't matter to the Argentinian legal system.

This isn't the first problem facing MSA and its e-voting technology, which is being used in Buenos Aires elections for the first time. Two weeks ago, the source code for the company's Vot.ar technology was leaked to Git.hub. A number of researchers also discovered that a smartphone with NFC capabilities (pretty common at this point) could be used to create a specialized e-ballot, capable of tricking the system into counting a single vote numerous times. And this is all before you realize that in many instances, the technology Argentina is using just doesn't appear to work very well:

"Earlier today, the Argentinian site La Política Online reported that 532 polling stations were unable to transmit their results electronically to the central electoral office, and had to be transported there physically for the 184,000 votes involved to be included in the final result. As the article points out, although this failure won't change the outcome of the election for the head of local government in Buenos Aires, it will make a difference to the allocation of seats in the legislature and community boards."

So not only is MSA's e-voting system completely open to several vectors of fraud and attack, it works so damn well you need to physically move the machines back to the central office to count the tallied votes. Meanwhile, Argentinian locals are claiming that the same Judge that thought it was a good idea to authorize the police raid on Sorianello's home, has also ordered Argentinian ISPs to block many of the websites where details on the e-voting flaws and source code can be found (like justpaste.it). Surely if you stop people from discussing the obvious flaws, the problem magically goes away, right? As we've seen with countless other e-voting scandals of this type, you can't operate a secure, successful e-voting system without trust. And you certainly don't gain the public's trust by shooting as many messengers as possible and playing a futile game of Whac-a-mole censorship with those who point out your system is utterly and painfully flawed. What you do successfully accomplish is make it perfectly clear that you appear to like the fact your electoral process can now be rigged.

Filed Under: argentina, arrest, blame the messenger, e-voting, joaquin sorianello, security, vot.ar, vulnerabilities
Companies: msa

If Virginia Elections Weren't Hacked, It's Only Because No One Tried

from the hey-that's-my-password dept

It's actually been a pretty long time since we last wrote about electronic voting machines and how insecure they are. Back in the 2005 to 2010 time frame, it was a regular topic of discussion around here, but there really hasn't been that much new information on that front in a while. However, earlier this week, Virginia decided to decertify a bunch of electronic voting machines after noting that the security on them was abysmal. As Jeremy Epstein notes in a detailed blog post about this issue:

If an election was held using the AVS WinVote, and it wasn’t hacked, it was only because no one tried. The vulnerabilities were so severe, and so trivial to exploit, that anyone with even a modicum of training could have succeeded. They didn’t need to be in the polling place – within a few hundred feet (e.g., in the parking lot) is easy, and within a half mile with a rudimentary antenna built using a Pringles can. Further, there are no logs or other records that would indicate if such a thing ever happened, so if an election was hacked any time in the past, we will never know.

It's that bad. The headline grabbing line that many news sites have run with is the unchangeable WEP encryption key used on the machines was "abcde." Meaning it was crazy easy for people to hack into (even if you didn't know the password originally, it would not be difficult to figure that out just by monitoring the system). But that's just the start. Other massive problems, explained by Epstein:

• The system hasn’t been patched since 2004 (which we knew). What we didn’t know is that the system is running a whole bunch of open ports with active services. The report specifically notes that ports 135/tcp, 139/tcp, 445/tcp, 3389/tcp, 6000/tcp and 16001/tcp are all running unpatched services. (Layman’s explanation: the voting machines aren’t just voting machines, they’re also servers happy to give you whatever files you ask for, and various other things, if only you ask. Think of them as an extra disk drive on the network, that just happens to hold all of the votes.) (Obdisclosure: In retrospect, I *probably* could have figured this out a few years ago when I had supervised access to a WinVote with a shell prompt, but I didn’t think of checking.)
• The system has a weak set of controls – it’s easy to get to a DOS prompt (which we knew). What we didn’t know is that the administrator password seems to be hardwired to “admin”.
• The database is a very obsolete version of Microsoft Access, and uses a very weak encryption key (which I knew a couple years ago, but didn’t want to disclose – the key is “shoup”, as also disclosed in the VITA report). What we didn’t know is that there are no controls on changing the database – if you copy the database to a separate machine, which is easy to do given the file services described above, edit the votes, and put it back, it’s happy as can be, and there are no controls to detect that the tampering occurred.
• The USB ports and other physical connections are only marginally physically protected from tampering. What we didn’t know is that there’s no protections once you plug something into one of these ports. What this means is that someone with even a few minutes unsupervised with one of the machines could doubtless replace the software, modify results, etc. This is by far the hardest of the attacks that VITA identified, so it’s almost irrelevant given how severe the other problems are.

And, as Epstein notes, the Virginia Information Technology Agency figured all of this out on its own -- in other words, it wasn't given the source code for these machines. That means, pretty much anyone probably could have figured out the same things. Epstein makes it clear just how easy this process is:

1. Take your laptop to a polling place, and sit outside in the parking lot.
2. Use a free sniffer to capture the traffic, and use that to figure out the WEP password (which VITA did for us).
3. Connect to the voting machine over WiFi.
4. If asked for a password, the administrator password is “admin” (VITA provided that).
5. Download the Microsoft Access database using Windows Explorer.
6. Use a free tool to extract the hardwired key (“shoup”), which VITA also did for us.
7. Use Microsoft Access to add, delete, or change any of the votes in the database.
8. Upload the modified copy of the Microsoft Access database back to the voting machine.
9. Wait for the election results to be published.

As he points out, the only bits that might take some sort of technical expertise is extracting the passwords, but that's not that hard, and the kind of thing that lots of script kiddies have figured out how to do with free online tools for ages. Epstein points out that the Diebold machines that everyone mocked a decade ago were "100 times more secure" than these WinVote machines.

Because there's an election coming up, apparently some election officials were against decertifying these machines:

Richard Herrington, secretary of the Fairfax City Electoral Board, said he was unconvinced that WINVote machines were risky enough to warrant decertification.

“No matter how much time, money and effort we could put into a device or a system to make it as secure as possible, there is always the possibility that someone else would put in the time, money and effort to exploit that system,” he said.

Richard Herrington is both right and wrong. Yes, it's true that almost any system will have security vulnerabilities, but he's ridiculously, laughably wrong, in suggesting that these machines are likely secure enough. These machines don't require a sophisticated hacker (especially now that the VITA revealed all the necessary passwords). Basically anyone can change the votes however they want based on the information that has been revealed.

For years, whenever we'd point to concerns and problems with e-voting machines, people would argue that it was just conspiracy theories and that these machines were mostly "secure enough." Yet, time and time again, we've discovered that the machines weren't even the tiniest bit secure -- and this is just the most egregious example so far.

Filed Under: avs winvote, e-voting, electronic voting, hacked, passwords, security, virginia

Displaced NJ Voters Told To Email Ballot Requests To A Hotmail Account

from the you've-absolutely-got-to-be-kidding-me dept

The election day news is coming in rather fast today, but we're already seeing reports of voting issues. There's some viral videos floating around showing voting machines acting up. This, of course, can be added to the long history of voting machine nonsense we've written about in the past. But adding to the the confusion is that a great section of the East Coast is still recovering from Hurricane Sandy.

You may have seen the news over the past few days that displaced New Jersey voters are being allowed to (sorta) vote via email. Or, rather, they would be allowed to vote via email if the state's election officials could manage to act like they know what they're doing. Instead, reports indicate massive amounts of people have been unable to request ballots at the email addresses originally provided. This is causing frustration and confusion across the state, but the real absurdity shows up in Essex County.

Aware of the problems with the official e-mail system, Essex County Clerk Christopher Durkin suggested an alternative option: "Displaced voters can email a request for a ballot at cj_durkin@hotmail.com," according to a post on the Facebook page of the town of West Orange, NJ. Interestingly, security researcher Ashkan Soltani notes that Durkin's Hotmail address has his mother's maiden name as a "password recovery" question. This means that anyone who can figure out Durkin's mother's maiden name could seize control of his Hotmail account and intercept voters' official ballot requests.

I'll be clear in saying that I understand that the situation in New Jersey is a difficult one and I'm sure election officials there are simply trying to do their best under the circumstances. Unfortunately, Durkin's best appears to suck. You simply cannot put something of such importance (voting) in the hands of someone who cannot either provide a working and secure email address for ballot access or, at the very least, take the most trivial security steps on another email address. We all want every citizen to be able to have their voice heard, but not at the cost of massive security risks.

Filed Under: e-voting, email, new jersey, security

Cause For Concern: 'Experimental' Patches Applied To Ohio Voting Machines Without Certification

from the seriously? dept

Update: Just as this post went out, the ruling was released—the judge has rejected the claims.

While we've covered e-voting issues for years, it really did seem like the issues with e-voting machines were less this year than in the past. Except... maybe not. ES&S, the largest vendor of e-voting machines, who has a long and scary history of problems with their machines, is embroiled in yet another controversy, in which Ohio's Secretary of State, Jon Husted, had the company install "experimental" software patches on ES&S vote counting machines (not the voting machines themselves, but the tabulators). The software is uncertified and likely violates the law.

Husted's office has not inspired confidence with its responses to these charges:

The Secretary of State’s office has been evasive and contradictory in response to questions about the minor seeming change that involved converting results from xml to csv format. Apparently, by calling the software “experimental,” Husted was attempting to avoid any approval, review or testing of the new software. But as the federal Elections Assistance Commission titled a memo back in February , “Software and Firmware modifications are not de minimis changes.”

In the meantime, a court is set to rule on the challenge to the software any time now, and a ruling against the software patches could make counting the votes tonight a more complicated process -- but considering the concerns, a reasonable solution. Today, the judge rejected the challenge to the software.

Oh, and while this story is making the rounds, we have no idea what to make of the video of an e-voting machine that votes for Romney if you click on Romney or Obama. There have been some questions as to whether the video was real, but reporters have confirmed that the machine (in Pennsylvania) has been "taken off line." The writeup on that one suggests it's not just a touch screen calibration issue, because the guy who filmed it said that if you touch other candidates, the same offset doesn't happen.

Filed Under: e-voting, ohio
Companies: es&s

New Jersey To Let 'Displaced' Voters Use Electronic Voting... If They Give Up Secrecy & Return A Hardcopy

from the details,-details dept

Given the still ongoing recovery from Hurricane Sandy in the northeast, New Jersey has decided to deal with potential problems with Tuesday's election by declaring that "displaced" voters can qualify to submit ballots the same way overseas members of the armed services can -- via email or fax, followed up with a hardcopy. They're also allowing early voting, more provisional voting and absentee voting, but the ability to submit by email is generating plenty of attention. Some, like professor Richard Hasen, who is an "election law" expert, worries about the security of such a system, and whether or not ballots could get hacked or lost. Professor Andrew Appel, who has done work with e-voting systems in the past, worries about two things. First, the loss of the secret ballot when you vote this way:

We see already one problem: The loss of the secret ballot. At many times in the 20th century, NJ political machines put such intense pressure on voters that the secret ballot was an important protection. In 2012 it’s in the news that some corporations are pressuring their employees to vote in certain ways. The secret ballot is still critical to the functioning of democracy.

But, he's also worried about the unclear nature of the announcement (pdf), in which it is not emphasized that anyone who votes this way must also submit a hardcopy. He notes that the directive about allowing displaced voters to vote this way left out the line about submitting the hardcopy, and the law is not clear what happens to votes where the hardcopy is not sent as well. The fear then, is that these votes will wind up in court.

Then things really get murky: The statute doesn’t say what happens if the hardcopy is not received, except that the county superintendent of elections must investigate. It’s not difficult to imagine that these ballots will end up in court.

I urge the Lieutenant Governor to issue a revised order, clarifying that displaced voters must immediately follow up by mailing hardcopy identical to their e-mailed ballot–or risk having their votes thrown out.

It does sound like officials in New Jersey now understand this and intend to be much clearer about it, but it is raising reasonable concerns.

Finally, well-known e-voting critic (and New Jersey resident) Ed Felten has actually taken a much more "it's not great, but given the situation, it's okay" type of position.

I am in no way a fan of online voting. Just last week I hosted an online symposium where experts talked about the many barriers to secure online voting. But under these circumstances I can understand why the State has taken the steps it has. The email+hardcopy approach will undermine ballot secrecy, and inevitably some voters will forfeit their votes by failing to submit the follow-on hardcopy ballot correctly. But at the same time, the state is allowing citizens who are facing a tough situation a greater chance to cast their votes. I would strongly oppose any long-term move toward online voting, but I can see the point of allowing limited email+hardcopy voting for displaced voters under these very unusual circumstances.

If the voting in New Jersey turns out weird tomorrow, the conspiracy theories are never going to stop...

Filed Under: e-voting, election, new jersey, privacy, secret ballot

Hackable Irish E-Voting Machines That Cost 54 Million Euros Sold For Scrap: 9 Euros A Piece

from the buy-high,-sell-low dept

For years, we've been pointing out the massive problems of e-voting, and governments' general blindness to the security risks. Of course, beyond the basic fear of fraud, there should have also been concerns about wasting taxpayer money. Apparently those concerns didn't amount to much in Ireland. As Slashdot highlights, Ireland spent €54 million on 7,500 e-voting machines. However, after realizing that there was no way to secure them from being hacked, the government has sold them off for scrap for a grand total of €70,000, or approximately €9 per machine. On the bright side, at least they weren't completely worthless...

Filed Under: e-voting, ireland, voting machines

The Details On How To Elect Futurama's Bender To Whatever Election Is Using Online Voting

from the bite-my-shiny-metal-ass dept

Back in October of 2010, we wrote about how some "hackers" had broken into a test of the Washington DC e-voting system, and had managed to have the system play the University of Michigan "fight song" every time people voted -- University of Michigan being where the researchers (led by e-voting security expert J. Alex Halderman) were from. A day later, we discussed some more details of the hack, noting how just a tiny vulnerability could take down the integrity of the entire system.

It's been a bit of time since then, but Halderman has released the academic paper they wrote about the experience, which is now getting some new attention, including the fact that, beyond playing the UMich fight song, they also installed their own slate of "fictional" candidates, including Bender from Futurama, who is presumably running on a Kill All Humans platform.

The full paper has some other interesting tidbits, as well, including the fact that they didn't just hack into the e-voting machines... but also accessed the security cameras watching the e-voting servers, which were left open to public access. I'm not kidding. While that might not seem like such a big deal, as the researchers noted, it was actually really useful:

These webcams may have been intended to increase security by allowing remote surveillance of the server room, but in practice, since they were unsecured, they had the potential to leak information that would be extremely useful to attackers. Malicious intruders viewing the cameras could learn which server architectures were deployed, identify individuals with access to the facility in order to mount social engineering attacks, and learn the pattern of security patrols in the server room. We used them to gauge whether the network administrators had discovered our attacks—when they did, their body language became noticeably more agitated.

Either way, the entire thing suggests just how insecure e-voting can be, and the paper suggests these are fundamental, systematic problems with any e-voting approach these days, rather than just a poor implementation.

Filed Under: alex halderman, bender, dc, e-voting, hacking, security, university of michigan

Washington DC Pulls Down Internet Voting Trial After Hackers Program It To Play UMich Fight Song

from the usability-issues dept

There are many who believe that there is simply no secure and safe way to conduct voting over the internet. However, it hasn't stopped the government from trying. Washington DC was getting ready to test an internet voting initiative for overseas soldiers, when the system was pulled down last week initially claiming "usability issues," and then saying that they shut it down to "to incorporate feedback received from the testing community." You see, it turned out that the testing community included a professor at University of Michigan who "unleashed" his students on the system, and it didn't take them long to set it up so that, every time you voted, the University of Michigan fight song, "Hail to the Victors," played. Oddly, no one names the Michigan professor, but it seems likely that it was Alex Halderman, who has long been closely associated with various e-voting security issues. In the meantime, it appears that DC will not be allowing internet voting for the upcoming elections...

Filed Under: alex halderman, e-voting, online voting, university of michigan, washington dc

Why Isn't There A Central Database Of E-Voting Problems?

from the seems-like-a-no-brainer dept

For many years, we've been reporting on stories of e-voting malfunctions, mainly from Diebold/Premier, ES&S and Sequoia. For a sampling of such stories click on any of the following links: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25. And that's just the first 25 I found (there are lots more), and only cover stories that I actually covered. I'm sure plenty more glitch-infused elections have happened. Given all these glitches and errors, and a seeming lack of followthrough to make sure they don't happen again, a group is asking Congress to authorize a public national database of e-voting election problems.

The really scary part is that the researchers who wrote the report note that many of the problems are repeats -- a problem happens in one location, but another voting district uses the same machines configured in the same problematic way in another election, totally unaware of the problems it will cause. It's still amazing that after nearly a decade of examples of problems with e-voting, just how little has been done to fix these machines.

Filed Under: database, e-voting, problems
Companies: diebold, es&s, premier, sequoia

Election Watcher Files Affidavit Saying He Saw Sequoia Employee Illegally Connect To E-Voting Tabulator

from the that-can't-be-good dept

lavi d points us to a report from Jim March, on the Tucson Free Unix Group email list, claiming that he witnessed potentially illegal activity in observing part of the Arizona mail-in vote scanning operation in Maricopa County. He summarizes the issue thusly:

Basically, we caught Maricopa County elections in a felony today - cross-wiring the central tabulator to a non-secure laptop owned by Sequoia Voting Systems, complete with cellular modem card in there and live. And I couldn't get a picture. Need a micro-cam of some sort to get the proof. See also my affidavit filed with our attorney today.

Remember: by law, the central tabulator system on what's supposed to be an isolated local network is completely unpatched - it's not allowed to be modified in any way since the day it shipped in 2006 or 2007. Even if the Sequoia tech didn't cross-connect the cellmodem to the Ethernet (and both appeared to be live), he could have easily "pwned" the "secure" systems with any number of ancient script-kiddy exploits.

He then includes the affidavit he filed. Basically, he spotted a Sequoia employee hooked into the central tabulator, via an ethernet cable from his own laptop, and he saw that the laptop had an EVDO card from Sprint -- and that, apparently, is a big no-no, as explained. When he asked to take a photograph of this, he was denied and was told that he was being disruptive. Now, there's no suggestion here that anything nefarious was going on, but that this central machine, which is supposed to be kept away from the internet, was exposed in a way that it should not have been. At the very least, this raises serious questions about the security of those machines.

Filed Under: arizona, e-voting, elections, jim march, maricopa county
Companies: sequoia