Hack of the D.C. Internet Voting Pilot -- Explained

[Bill Bored]

by J. Alex Halderman

-snip-

Within 36 hours of the system going live, our team had found and exploited a vulnerability that gave us almost total control of the server software, including the ability to change votes and reveal voters’ secret ballots. In this post, I’ll describe what we did, how we did it, and what it means for Internet voting.

-snip-

A small vulnerability, big consequences

We found a vulnerability in the way the system processes uploaded ballots. We confirmed the problem using our own test installation of the web application, and found that we could gain the same access privileges as the server application program itself, including read and write access to the encrypted ballots and database.

The problem, which geeks classify as a “shell-injection vulnerability,” has to do with the ballot upload procedure. When a voter follows the instructions and uploads a completed ballot as a PDF file, the server saves it as a temporary file and encrypts it using a command-line tool called GnuPG. Internally, the server executes the command gpg with the name of this temporary file as a parameter: gpg (…) /tmp/stream,28957,0.pdf.

We realized that although the server replaces the filename with an automatically generated name (“stream,28957,0” in this example), it keeps whatever file extension the voter provided. Instead of a file ending in “.pdf,” we could upload a file with a name that ended in almost any string we wanted, and this string would become part of the command the server executed. By formatting the string in a particular way, we could cause the server to execute commands on our behalf. For example, the filename “ballot.$(sleep 10)pdf” would cause the server to pause for ten seconds (executing the “sleep 10” command) before responding. In effect, this vulnerability allowed us to remotely log in to the server as a privileged user.

-snip-

Read more at:
http://www.freedom-to-tinker.com/blog/jhalderm/hacking-dc-internet-voting-pilot

[Bill Bored]

1. What this means for Internet voting:

From the same author:

"The specific vulnerability that we exploited is simple to fix, but it will be vastly more difficult to make the system secure. We’ve found a number of other problems in the system, and everything we’ve seen suggests that the design is brittle: one small mistake can completely compromise its security. I described above how a small error in file-extension handling left the system open to exploitation. If this particular problem had not existed, I’m confident that we would have found another way to attack the system.

"None of this will come as a surprise to Internet security experts, who are familiar with the many kinds of attacks that major web sites suffer from on a daily basis. It may someday be possible to build a secure method for submitting ballots over the Internet, but in the meantime, such systems should be presumed to be vulnerable based on the limitations of today’s security technology."

[Stevepol]

2. I'm not a computer expert, but what's the difference really between

internet voting and voting on machines which are also subject to the same sort of hacking and vulnerabilitieis?

The machines are most easily rigged or maliciously programmed or the vote totals maliciously altered by insiders but experts probably could do the same thing if they had access to the machines at any point.

What am I missing?

[demodonkey]

4. Very similar but it seems that internet voting is even MORE vulnerable and less traceable/auditable.

Internet voting has been described as 'DREs on steroids.'

Apparently the internet is wide open to a lot more attacks than so-called closed systems running in a county election office. Then, of course, with internet voting you are turning the private hardware and software of every voter using the system into a voting machine, along with whatever virus or malware it might contain.

Internet voting is very seductive to officials who see it as cheaper and easier for themselves.

Right now the vendors are pushing internet voting hard as a way to improve voting opportunities for far-flung military and the disabled; am sure that soon there will be a shift to touting it as "better" for all voters.

We must nip all this in the bud.

[hootinholler]

5. In a word, access.

On the net you can slam the system repeatedly. With DREs you have one shot and you need physical access to a smart card.

Don't get me wrong IMO, neither are acceptable substitutes for ink and paper.

-Hoot

[Bill Bored]

7. You don't necessarily need "physical access to a smart card." DREs and ballot scanners have PORTS!

These ports include Ethernet, RS-232 and USB. Any of these ports can be used to connect to anything (except a lever voting machine!) including the Internet.

[hootinholler]

8. But you still need physical access to the DRE

To connect something to it.

-Hoot

[Bill Bored]

9. But not for long. A few minutes would be long enough. nt

[eridani]

3. Please send this to your county auditors and SecStates

I did, and if I get a response, I'll post it.

[diva77]

6. I'd like to see someone ask the NASS to comment on this!!

:argh:

http://www.nass.org/

[Wilms]

10. kick

[Bill_Kelleher]

11. POSITIVE NEWS FOR INTERNET VOTING

Friends!

Don’t despair over the DC hacking. Here is a short list of positive news for Internet voting:

Pasadena Star News, Two Sunday editions
“Are you ready for Internet voting? For millions of Americans overseas, it's the only way to ensure their votes are counted”
http://www.pasadenastarnews.com/opinions/ci_16357185

Also, RE: CA Prop 14 (nonpartisan elections) and the future of CA politics
http://www.pasadenastarnews.com/ci_16172903?IADID

Both articles have excellent debates in the comments.


Op Ed News
“Does the DC Fiasco Damn Internet Voting?”
http://www.opednews.com/articles/Does-the-DC-Fiasco-Damn-In-by-William-J-Kellehe-101015-957.html


SSRN
“Scary Stories Fail to Stop Internet Voting”

Abstract:
Rather than using the results of scientific testing, and probability calculation, opponents of Internet voting have commonly resorted to telling scary stories about what might happen. In 2004 this tactic had spectacular success. The Department of Defense had already spent over $22,000,000 on an Internet voting project. It was ready to be used in the 2004 November election, but well publicized scary stories had it halted.

Since that time, state election officials, the military, and DoD have regained their reason, and Internet voting is coming back.

At, http://ssrn.com/author=1053589 (free download)

William J. Kelleher, Ph.D.
[e-mail]

[Bill Bored]

12. Spamming DU too? My, you must really be desperate to push Internet voting. Who R U working 4? nt

[Bill_Kelleher]

14. False Accusations, Uninformed Opinion

My message is simple: Internet voting can neutralize the power of Big Money over all US elections, and therefore over our government. Why not take just a moment to check out my article on OEN “Does the DC Fiasco Damn Internet Voting?”
http://www.opednews.com/articles/Does-the-DC-Fiasco-Damn-In-by-William-J-Kellehe-101015-957.html

and my recent comments at the Huffington Post: http://www.huffingtonpost.com/pearl-korn/citizens-united-an-assaul_b_772482.html

To learn even more, check this out:
Scary Stories Fail to Stop Internet Voting
http://ssrn.com/author=1053589

Nobody is giving me anything. I care about our democracy.

[Bill_Kelleher]

16. RE who is getting paid

The anonymous poster, WillYourVoteBCounted, is paid by the anti-Internet voting group, Verified Voting They have tons of money

[emlev]

13. Halderman testimony at D.C. hearing

Wish more people were paying attention to this story!

http://www.bradblog.com/?p=8118">BRAD BLOG story
Note: This story includes links to video of the hearing.

http://www.bradblog.com/?page_id=8117">Transcript of hearing

[Bill_Kelleher]

15. More than one side to this story

check out my OEN article (above) for another view on this hearing