Why Internet Voting is Insecure: a case study

1. Why Internet Voting is Insecure: a case study Barbara Simons

2. “Those who cast the votes decide nothing. Those who count the votes decide everything.”Joseph Stalin

4. Accenture chief named head of e-government • The Cabinet Office has announced that Ian Watmore, the UK managing director of IT services firm Accenture, is to become the head of e-government. In his new role, Watmore faces the task of delivering efficiency savings while improving the delivery of public services by joining up electronic government services around the needs of customers. • Network IT Week, May 25, 2004

5. A Fairy Tale • 2008 US election: H. Clinton vs J. Bush • 527 Americans hostage in Iran • Bush wants to invade • Clinton calls for negotiations • Country evenly divided • Internet voting throughout country

6. The Day before the Election • Email from White House warning of computer viruses and providing website for downloading anti-virus software • Millions download • Email not from WH and contains virus • Randomly selects small percentage of votes and changes them to Clinton if had been for Bush • Erases itself

7. Clinton wins • Millions vote before news of virus • Bush supporters demand new election • No legal provisions • Can’t determine which votes modified because of randomness • Iranian Govt? Democrats? Femi-Nazis? • Teenage hackers and computer scientists suspect • Military put on alert

8. How does the story end?

9. Is there a backup plan? • What happens if after election it is discovered that system may have been compromised? • Rerun election? On the same system??? • Ask those whose votes may have been compromised (if you can figure out who they are) to vote again? • What does this do to voter confidence?

10. E-voting is harder than e-commerce • Requires higher level of security • Democracy depends on voter confidence • Stakes exceedingly high • Hundreds of millions of dollars spent on US Presidency election • Small fraction would be exceedingly large bribe • More challenging • May be ok for my spouse to use my credit card, but no ok for my spouse to vote for me

11. E-voting hard • Unlike e-voting, denial of service attack on e-commerce may prevent some sales, but does not invalidate those that succeed • May be difficult to detect • Anonymity (US) makes impossible to determine if votes correctly counted • E-commerce failure can be corrected • Amazon sends another book

12. E-voting hard • How to detect failure? • Airplanes crash • Books not delivered • Outcome doesn’t match exit polls???

13. Secure Electronic Registration and Voting Experiment (SERVE) • $22M DoD project for ‘04 elections and primaries • 7 states - 50 counties in those states • Military and civilians living out of the country • http://www.serveusa.gov/public/aca.aspx

14. www.servesecurityreport.orgDavid JeffersonAvi RubinBarbara SimonsDavid Wagner

15. Conclusions • SERVE contains all security vulnerabilities of paperless touch screen voting machines • Internet- and PC-based systems make it vulnerable to many potentially catastrophic well known cyber attacks • Attacks could be large scale, launched by anyone from anywhere, including hostile countries

16. Conclusions • Impossible to estimate probability of successful cyber-attack on one election • Easy to perpetrate • In some cases software available on Internet • Major elections tempting targets • Vulnerabilities fundamental to architecture of Internet and of PC hardware and software in use today • Cannot be eliminated in the foreseeable future

17. Conclusions • Unable to recommend alternative involving Internet voting - all insecure • Could appear to work flawlessly • Lack of detected successful attacks does NOT prove that there were none • “Successful” trial could lead to slippery slope of larger scale, more vulnerable systems • Reluctantly recommend immediate shut down of SERVE - was done by DoD

18. SERVE System requirements for Voters • Windows 95(?), 98, 2000, …. • MS Explorer 5.5 & above or Netscape Navigator 6.x through 7. • Internet connection: dial-up modem, cable, DSL, LAN, WAN, etc. • Downloads an ActiveX component

19. SERVE (con’t) • Users responsible for maintaining the security of their computers, and • voting allowed from public computers with internet access (cybercafes) • Voting planned for a national election using proprietary software, secret testing, insecure clients, and an insecure network

20. SERVE (con’t) • What would have happened if election appeared to go smoothly in ‘04?

21. Major security problems • Software bugs (may or may not be security) • Insider attacks • Security vulnerabilities of client side of voting equipment • Denial of service attack • Automated vote buying/selling • Man in the middle

22. Software bugs

23. Software bugs • Could influence outcome of election • All software buggy • Security holes could be exploited by hackers • Election software is supposed to be certified whenever modifications made • Disincentive to fix bugs • Hard deadline of election • Testing and results are secret

24. Security Example • Vulnerability in Microsoft Windows Server 2003 software announced July 16, 2003 • Allow hacker to size control of machine and steal information, delete files, read email • Was supposed to be highly reliable and secure • Also impacts Windows 2000, NT, and XP • Could have been used to compromise some currently used election software

25. Insider attacks

26. Insider attacks • Anyone with access to vendor’s software, including programmers, executives, and custodians, could insert malicious software • Hacker may be able to insert malicious software • Malicious software, cleverly hidden, could be very hard to detect or locate

27. Client side computer vulnerabilities

28. Security risks of computers not owned by voter • Attacker may install malicious software on computers in public locations, e.g. libraries, malls, cybercafes, etc. • Increased vulnerability for minorities and economically disadvantaged

29. Employer owned computer • 2001 study found 62% of major US corporations monitor employees’ Internet connections • > 1/3 store and review files on employee’s computer • Additional risk for those without home computers, i.e. economically disadvantaged and minorities

30. Voter’s Computer may be insecure • Computer software • Operating systems, games, multimedia applications, etc • Any could have malicious code • MS Excel 97 contained hidden flight simulator • Not found until after release of product

31. Remote attack on voter’s computer • Exploit security vulnerability on computer • Take control of voter’s computer via many different programs, e.g. PC Anywhere or BackOrifice • Home computers tend to have poorer security than corporate machines, and even corporate computers have been successfully attacked • Hackers can automate attacks to scans thousands or even millions for vulnerabilities

32. Viruses and Worms • Can install malicious code • 2001 Code Red worm infected 360,000 computers in 14 hrs • Sapphire/Slammer infected 90% of vulnerable hosts on Internet within 10 minutes • Brought down ATMs and caused flight delays • Verisign chart

33. Viruses and worms (con’t) • Virus checking software works only against previously known viruses • New worms and viruses spread quickly • Easy for programmer to write crude worm - modify code for known worm • Small scale worm selectively target smaller population could be hard to detect

34. How bad can worms be? • One set of experts estimated that small team of experienced programmers could in a few months’ time develop worm that could compromise majority of Internet connected computers within a few hours • Don’t know if would succeed on first attempt or how long would go undetected • Once computer infected, all bets are off

35. Denial of Service Attacks

36. Denial of Service (DoS) Attacks • Hacker overloads system so that voter can’t gain access • Distributed Denial of Service (DDoS): many machines collaborate to mount joint attack • “Zombies”: compromised machines • Automated tools widely available • Selective disenfranchisement

37. Examples of DDoS • CNN, Yahoo, eBay: Feb 2000 • Lone teenager not on US soil • Code Red worm contained code to mount DDoS attack on White House; deflected at last minute (2001) • Canadian Internet election disrupted by DoS Jan., 2003 • Mydoom?

38. Types of DoS Attacks • Flood the network so that it can’t be used • Overload web server’s computational resources so it can’t respond to voters • Repeated requests to initiate new SSL connections • Slow cryptographic protocol can be overwhelmed by enough zombie requests • Can’t defend against all possible DoS attacks

39. May not recognize DoS • ICANN election • People had problems registering • Many unable to vote near end • Machine capacity issue or DoS? • Can’t infer that there were no security problems • Some individuals voted multiple times

40. Automated Buying and Selling

41. Buying and selling • Provide credentials (passwords, etc) to purchaser who could then vote • Defense would be to limit number of votes from single web address • Not good defense, since proxy servers could make legitimate voters appear to come from same web address; AOL uses same IP addresses for all users • Buyer provide seller with modified version of ActiveX component that guarantees voter’s behavior

42. Man in the MiddleorSpoofing

43. Man in the Middle • Adversary interposes itself between legitimate communicating parties and simulates each party to the other • Achieved by: • Controlling client machine • Controlling local network • Controlling upstream network (eg ISP or foreign gov’t) • Spoofing voting server (voter thinks is communicating with correct server, but is not) • Attacking Domain Name Server to reroute traffic

44. Man in the Middle can compromise Privacy • Use of SSL (an encryption technology) cannot prevent, since man in the middle could act as SSL gateway, forwarding between voter and vote server unaltered • Decrypt and re-encrypt to observe results • Useful for • vote buying/selling • Selective disenfranchisement

45. Michigan Democratic Party’s Primary Internet Voting an Option

46. Problems with Brief of Mich Dem Party in support of Hearing Officer’s report • “Internet voting is secure” • Internet not secure - voting not secure • Several claims cannot be supported • No detection of successful attack doesn’t mean it never happened. It may have happened and been successful. • Detecting and foiling 100 attacks doesn’t mean that 10 or 100 haven’t been successful.

47. The Intrusion Detection System • “The IDS filters out and blocks unusual activity on the network, systems or applications.” • “While there have been attempted penetrations, the system has worked as designed, and has never been compromised.” (underlining in document)

48. Problems with IDS • IDS could potentially identify existence of known attack with particular signature, but could do absolutely nothing against new attack that did not look or smell like previous attack • IDS makes decent network monitoring devices for observing network behavior, and useful for after the fact forensics, but not that useful as security devices

49. Problems with IDS (con’t) • May detect attack, but not necessarily prevent or recover • DDoS might be detectable, but not stoppable by commercial product, especially if massive attack • FBI annual survey of Federal agencies 56% networks had been successfully intruded during previous years • If no obvious problems, will claim precautions worked, but doesn’t prove anything