Princeton Research Group Demonstrates Vote-Stealing and Virus Attacks on D

helderheid

(1000+ posts) Send PM | Profile | Ignore

Wed Sep-13-06 02:19 PM
Original message

Princeton Research Group Demonstrates Vote-Stealing and Virus Attacks on D

Princeton Research Group Demonstrates Vote-Stealing and Virus Attacks on DESI's AccuVote-TS

Ari Feldman, Alex Halderman and Ed Felten of Princeton's Center for IT Policy have released a paper and video that demonstrates a series of serious attacks against the DESI AccuVote-TS (used statewide in Maryland and Georgia). They were able to, with one-minute of physical access to this machine, inject "vote stealing" code that would completely erase all evidence of its presence after an election. They were also able to "infect" memory cards such that the malicious program could be distributed to a wide population of machines (given enough time).

Security Analysis of the Diebold AccuVote-TS Voting Machine http://itpolicy.princeton.edu/voting/
Executive Summary:

The Diebold AccuVote-TS and its newer relative the AccuVote-TSx are together the most widely deployed electronic voting platform in the United States <8>. In the November 2006 general election,
The Diebold AccuVote-TS voting machine in our lab these machines are scheduled to be used
in 357 counties representing nearly 10%
of registered voters.

This paper reports on our study of an AccuVote-TS, which we obtained from a private party. We analyzed the machine's hardware and software, performed experiments on it, and considered whether real election practices would leave it suitably secure. We found that the machine is vulnerable to a number of extremely serious attacks that undermine the accuracy and credibility of the vote counts it produces.

Computer scientists have generally been skeptical of voting systems of this type, Direct Recording Electronic (DRE), which are essentially general-purpose computers running specialized election software. Experience with computer systems of all kinds shows that it is exceedingly difficult to ensure the reliability and security of complex software or to detect and diagnose problems when they do occur. Yet DREs rely fundamentally on the correct and secure operation of complex software programs. Simply put, many computer scientists doubt that paperless DREs can be made reliable and secure, and they expect that any failures of such systems would likely go undetected.

Previous security studies of DREs affirm this skepticism, but to our knowledge ours is the first public study encompassing the hardware and software of a widely used DRE. The famous paper by Kohno, Stubblefield, Rubin, and Wallach studied a leaked version of the source code for parts of the Diebold AccuVote-TS software and found many design errors and vulnerabilities, which are generally confirmed by our study. Our study extends theirs by including the machine's hardware and operational details, by finding and describing several new and serious vulnerabilities, and by building working demonstrations of several security attacks.

Main Findings The main findings of our study are:

1. Malicious software running on a single voting machine can steal votes with little if any risk of detection. The malicious software can modify all of the records, audit logs, and counters kept by the voting machine, so that even careful forensic examination of these records will find nothing amiss. We have constructed demonstration software that carries out this vote-stealing attack.

2. Anyone who has physical access to a voting machine, or to a memory card that will later be inserted into a machine, can install said malicious software using a simple method that takes as little as one minute. In practice, poll workers and others often have unsupervised access to the machines.

3. AccuVote-TS machines are susceptible to voting-machine viruses � computer viruses that can spread malicious software automatically and invisibly from machine to machine during normal pre- and post-election activity. We have constructed a demonstration virus that spreads in this way, installing our demonstration vote-stealing program on every machine it infects.

4. While some of these problems can be eliminated by improving Diebold's software, others cannot be remedied without replacing the machines' hardware. Changes to election procedures would also be required to ensure security.

The details of our analysis appear in the full version of this paper .

http://itpolicy.princeton.edu/voting/ts-paper.pdf
Security Analysis of the Diebold AccuVote-TS Voting Machine http://itpolicy.princeton.edu/voting/