The following article is from the New Scientist (1st Aug) about Hacking an electronic voting system which contains an interview with Feng Hao.
At security conference DEF CON in Las Vegas last week, security researchers proved that it is possible to access and change votes on the same voting machines used in US elections in the time it takes to watch a movie. Some of the hacks were even carried out wirelessly.
DEF CON purchased thirty voting machines from eBay and government auctions for the event. Ninety minutes after participants were let loose the first machines started to fall, with vote rigging and Rickrolling coming soon afterwards.
One of the machines was still using Windows XP, and so an exploit that has been known since 2003 allowed people to get remote access through its Wi-Fi system. This meant that the votes could be changed from anywhere.
Other exploits involved prying open mechanical locks covering USB ports or spotting the uncovered USB ports on the back. One team then simply plugged in a mouse and keyboard to gain control of the machine.
Go open source?
Rarely do voting machines get put through a test like this. Despite DEF CON hosting many hacking events over the past 25 years, this is the first time they’ve hosted one specifically for voting machines. Manufacturers do their own testing, but few make the code or machines available for researchers or the general public to look over.
“If you make your code open source, any vulnerabilities that are found can be sorted before election day, which is good for democracy but not necessarily for the manufacturer’s reputation,” says Steve Schneider, the Director of Surrey Centre for Cybersecurity.
To counteract this governments could announce that they will only buy voting machines with open source software. That way a competitor can’t gain an advantage by being less transparent than another.
“One possible solution is to have end-to-end verifiability,” says Feng Hao at Newcastle University. This uses similar techniques to those used in encryption to give voters a verifiable receipt of their vote. If the vote or the machine is tampered with then the receipt won’t match the public record of votes cast, indicating that the system has been compromised.
published on: 2 August 2017