Hac k- a- Vote : Studying Se c ur ity Issue s with E - Voting Da - PowerPoint PPT Presentation

Hac k- a- Vote : Studying Se c ur ity Issue s with E - Voting Da n Wa lla c h Ric e Unive rsity Collabor ator s: Jo na tha n Ba nne t Da vid W. Pric e Alg is Rudys Justin Sing e r

Pe r c e ption vs. r e ality Pe r c e ption vs. r e ality � Vo te r fe e ls tha t � Vo te wa s c o unte d � Vo te wa s priva te � No b o dy e lse c a n vo te mo re tha n o nc e � No b o dy c a n a lte r o the rs’ vo te s � Pe o ple b e lie ve tha t the ma c hine wo rks c o rre c tly � T he se ha ve to do with pe rc e ptio n It is also impor tant that the se pe r c e ptions ar e tr ue .

Re lianc e on c e r tific ation I nde pe nde nt T e sting Autho ritie s � Allo we d to se e the c o de � No b o dy e lse lo o ks � Ce rtify sa tisfa c tio n o f F E C sta nda rds � Re q uire d b y ma ny sta te s Re sult: “F aith- base d voting”

Inspir ation Ha ve a n e -vo ting syste m to “de mo nstra te ” inside r fla ws � Orig ina l ide a fro m Da vid Dill � Orig ina l c o de b y Da vid W. Pric e � Writte n summe r 2003 � Ab o ut 2000 line s o f Ja va Unne c e ssa ry a fte r Die b o ld finding s

Se c ond applic ation? Ho w a b o ut in-c la ss use ? � Old pro je c t: “sma rt c a rd so da � ma c hine ” 1) de sig n & fo rma lly mo de l c rypto pro to c o l 2) swa p with o the r g ro ups 3) imple me nt with re a l c a rds � Re a l sma rt c a rds a re pa inful

Hac k- a- Vote pr oje c t Re mo ve “c he a ting ” c o de ~150 line s, mo stly in o ne file T hre e pha se a ssig nme nt 1) Be e vil (2 we e ks) 2) Be a n I T A (1 we e k) 3) De sig n / fo rma lly mo de l b e tte r ve rsio n o f Die b o ld sma rtc a rd (2.5 we e ks)

Be e vil? � Stude nts’ ro le : c o rrupt de ve lo pe r inside ve ndo r � Co de must still pa ss te sts � “Minima l” c o de c ha ng e s � Multiple ha c ks e nc o ura g e d � Co de sho uld a ppe a r “no rma l” De live rable s: Co de + Writte n Re po rt

Be an IT A? � Swa p c o de fro m g ro ups � E ve ry g ro up a udits two ve rsio ns � Ho no r c o de : no running diff � I mpe rfe c t simula tio n o f re a l I T As � Stude nt fa milia rity with c o de � Sma lle r c o de b a se De live rable s: Writte n Re po rt

Be tte r smar tc ar d pr otoc ols? � L e c ture s ha ve pre pa re d stude nts yptyc fo r pro to c o l mo de lling � c r � (Re la tive ly) usa b le type c he c ke r c ryptyc .c s.de pa ul.e du De live rable s: Mo de l + Writte n Re po rt

Die bold’s smar t c ar d pr otoc ol d is ( 8 byte s ) My passwor T e rmina l Ca rd “Okay” Ar e you valid? “Yup” Canc e l your se lf, ple ase . “Okay”

nte rCivic e Sla te e Hac k- a- Vote softwar nspira tio n: Ha rt I I

e Slate pr otoc ol (hope fully) Valid? 1234 ne twor k Pin: 1234 Base station Voting mac hine … Pin: 1234

Hac k- a- Vote live de mo

Hac k- a- Vote de sign

Hac k- a- Vote de sign

Hac k- a- Vote de sign

Hac k- a- Vote de sign

Wide gamut of attac ks � Ma nipula te e le c tio n re sults � Vio la te vo te r a no nymity � Cra sh / Do S vo ting ma c hine

Cle ve r hac ks � Ove rlo a d equals() / hashCode() � Va ria b le with sa me na me a s c la ss � Unusua l c o ntro l flo ws � Re use c o nsta nts in the c o de � Ne two rk po rt: 1776 � Use a s b a c kdo o r PI N � “Sta rt o ve r” a lso sub mits a vo te

De e pe r hac ks � We a k ra ndo m numb e r g e ne ra to r � E a sie r to g ue ss va lid PI Ns � RNG fo r vo te shuffle se e de d with te rmina l I D � Atta c ke r c a n undo shuffle � Only c he a t if te rmina l I D > 2 � L e ss like ly to o c c ur in te sting

Did the IT As c atc h the hac ks? Ha c k Atte mpts F ound F ound onc e twic e Mo dify a lre a dy- 6 6 5 c a st vo te s Ca st multiple 7 7 6 vo te s Vio la te vo te r 4 3 2 a no nymity De nia l o f se rvic e 4 3 2

Implic ations for r e al IT As � Ca n re a l I T As do b e tte r? + T he y c a n run diff + T he y c a n pe rfo rm “pa ra lle l te sting ” – Co de b a se s a re muc h la rg e r – Are the y e xpe c ting T ro ja n Ho rse s? – Ho w c lo se ly do the y re a d the c o de ? � Ve ry little suppo rt fro m to o ls

Uglie r issue s for c e r tific ation � T o o lc ha in ta mpe ring (T ho mpso n) � T a mpe ring with “e mb e dde d” OS � Audite d c o de = a c tua l c o de in ma c hine ?

Public ity I E E E S e c urity & Privac y, Jan/ F e b 2004 � Re printe d in Co mpute r Use r � Sto ry o n lo c a l T V ne ws � I mpa c t o n ve ndo rs / I T As?

Choose Hac k- a- Vote ! ic e .e du/ ~dwallac h / c o urse s/ www.c s.r c o mp527_f2003/ vo te pro je c t.html BSD-style lic e nse T rust us, it wo rks fine