EVEREST: Evaluation and Validation of Election-Related Equipment, Standards and Testing∗†
Total Page:16
File Type:pdf, Size:1020Kb
EVEREST: Evaluation and Validation of Election-Related Equipment, Standards and Testing∗† Final Report December 7, 2007 ∗ This report was prepared by teams from Pennsylvania State University, the University of Pennsylvania, and WebWise Security, Inc. as part of the EVEREST voting systems analysis project initiated by the Secretary of State of Ohio in the Winter of 2007. Unless otherwise indicated, all analyses detailed in this report were carried out at the home institutions between October 1, 2007 and December 7, 2007. † This report is released by Ohio Secretary of State Jennifer Brunner consistent with the Ohio Public Records Act, Ohio R.C. 149.43. The reader of this document is advised that any conduct intended to interfere with any election, including tampering with, defacing, impairing the use of , destroying, or otherwise changing a ballot, voting machine, marking device, or piece of tabulating equipment, is inconsistent with Ohio law and may result in a felony conviction under, among other sections, Ohio R.C. 3599.24 and 3599.27. Project Personnel Pennsylvania State University Team Patrick McDaniel, Principal Investigator & Team Lead Kevin Butler William Enck Harri Hursti Pennsylvania State University Pennsylvania State University Independent Contractor Steve McLaughlin Patrick Traynor Pennsylvania State University Pennsylvania State University University of Pennsylvania Team Matt Blaze, Team Lead Adam Aviv Pavol Cernˇ y´ Sandy Clark University of Pennsylvania University of Pennsylvania University of Pennsylvania Eric Cronin Gaurav Shah Micah Sherr University of Pennsylvania University of Pennsylvania University of Pennsylvania WebWise Security, Inc. Giovanni Vigna, Team Lead Richard Kemmerer Davide Balzarotti Greg Banks WebWise Security, Inc. WebWise Security, Inc. WebWise Security, Inc. Marco Cova Viktoria Felmetsger William Robertson WebWise Security, Inc. WebWise Security, Inc. WebWise Security, Inc. Fredrik Valeur WebWise Security, Inc. Policy and Document Consultants Joseph Lorenzo Hall Laura Quilter University of California, Berkeley University of California, Berkeley CONTENTS I Project Overview 1 1 Executive Summary 3 2 Overview 5 2.1 Report Structure ......................................... 5 2.1.1 Reading Recommendations .............................. 5 2.2 Evaluation Design ........................................ 6 2.3 Methodology .......................................... 6 2.3.1 Prior Studies ...................................... 7 2.4 Limitations ........................................... 8 2.5 Acknowledgments ....................................... 10 3 Threat Model 11 3.1 Reference Model ........................................ 11 3.1.1 Pre-Voting ....................................... 12 3.1.2 Voting .......................................... 13 3.1.3 Post-Voting ....................................... 14 3.2 Attacker Goals ......................................... 14 3.2.1 Producing Incorrect Vote Counts ............................ 15 3.2.2 Blocking Some or All Voters from Voting ....................... 15 3.2.3 Cast Doubt on the Legitimacy of the Election Results ................. 15 3.2.4 Delay the Results of the Election from Becoming Known ............... 16 3.2.5 Violating Ballot Secrecy ................................ 16 3.3 Potential Attackers ....................................... 17 3.3.1 Outsiders ........................................ 17 3.3.2 Voters .......................................... 18 3.3.3 Poll Workers ...................................... 19 3.3.4 Election Officials .................................... 20 3.3.5 Vendor Employees ................................... 20 3.4 Types of Attacks ........................................ 21 3.5 Procedures ............................................ 22 3.5.1 Ohio Procedures on Information Technology and Networking ............ 23 3.5.2 Mechanisms for Tamper Sealing ............................ 24 3.5.3 Chain-of-Custody Logs ................................. 25 3.5.4 Recounting Optical Scan Ballots ............................ 26 3.6 Software Engineering and Maintenance ............................ 26 iii II Analysis of the Election Systems & Software, Inc. Voting Systems 27 4 ES&S Executive Summary 29 5 ES&S System Overview 31 5.1 Architectural Overview ..................................... 31 5.2 System Components ...................................... 33 5.2.1 Unity .......................................... 33 5.2.2 iVotronic ........................................ 35 5.2.3 Real-Time Audit Log Printer .............................. 36 5.2.4 Personalized Electronic Ballot ............................. 37 5.2.5 PEB Reader ....................................... 37 5.2.6 Compact Flash Cards .................................. 38 5.2.7 Communication Pack .................................. 38 5.2.8 Model 100 ....................................... 38 5.2.9 PCMCIA Memory Cards ................................ 39 5.2.10 Model 650 ....................................... 39 5.2.11 Zip Disks ........................................ 39 5.2.12 AutoMARK Voter Assist Terminal ........................... 39 5.3 Election Procedures ....................................... 40 5.3.1 Preparation ....................................... 40 5.3.2 Touchscreen (DRE) Voting ............................... 40 5.3.3 Precinct-Based Optical Scan Voting .......................... 41 5.3.4 Centrally Counted Optical Scan Voting ........................ 42 5.4 Software Versions ........................................ 42 5.5 Unity Acronyms and File Extensions .............................. 44 6 ES&S Systemic and Architectural Issues 49 6.1 Ineffective Access Control ................................... 49 6.1.1 iVotronic passwords and PEB-based access controls ................. 50 6.1.2 Physical security, locks and seals ............................ 52 6.2 Critical Errors in Input Processing ............................... 53 6.2.1 Unity .......................................... 53 6.2.2 iVotronic ........................................ 54 6.3 Ineffectively Protected Software and Firmware ........................ 54 6.3.1 iVotronic firmware ................................... 54 6.3.2 Unity software ..................................... 55 6.3.3 M100 firmware ..................................... 56 6.3.4 Viral propagation .................................... 56 6.4 Ineffective Cryptography and Data Authentication ....................... 57 6.4.1 Unauthenticated M100 data .............................. 57 6.4.2 Ineffective iVotronic cryptography ........................... 57 6.4.3 Poor data validation of precinct results in Unity .................... 58 6.5 Procedural Mitigations ..................................... 58 7 ES&S Specific Weaknesses and their Implications 59 7.1 Unity .............................................. 59 7.1.1 Unity ERM buffer overflow when reading a Master PEB ............... 59 7.1.2 Data from M100 can cause a buffer overflow in Unity ................. 60 7.1.3 Unity accepts memory media with unauthorized precinct results ........... 60 7.1.4 Integrity of data on a PCMCIA card is not protected ................. 61 7.1.5 Processing audit data can cause a buffer overflow of a global variable ........ 61 7.1.6 Unity decrypts a PEB using the EQC from the PEB .................. 62 7.1.7 Unity contains large pieces of duplicated code ..................... 62 7.1.8 Unity contains many small buffer overflows ...................... 63 7.1.9 SQL injection to bypass authentication in EDM, ESSIM, and Audit Manager .... 63 7.1.10 An M100 PCMCIA card can be read multiple times without warning ........ 63 7.1.11 Assumptions on the environment for Unity are unspecified .............. 64 7.1.12 iVotronic Image Manager bundled with vulnerable Java Runtime Environment ... 64 7.2 iVotronic ............................................ 65 7.2.1 Election encryption/decryption key is recoverable from a PEB ............ 65 7.2.2 PEBs may be emulated using infrared-capable devices ................ 65 7.2.3 PEB Emulators can read and/or write arbitrary data on a PEB ............ 66 7.2.4 Emulated PEBs permit multiple votes ......................... 66 7.2.5 Buffer overflow in poll opening process is exploitable ................. 67 7.2.6 Buffer overflow in “Hotspot” image processing is exploitable ............. 67 7.2.7 Buffer overflow in Supervisor iVotronic initialization process is exploitable ..... 68 7.2.8 Service Menu Mode in iVotronic does not require properly configured PEB ..... 69 7.2.9 (Emulated) Initialization PEB can close polls and reset passwords .......... 69 7.2.10 (Emulated) Factory QA PEBs bypass all password checks .............. 69 7.2.11 (Emulated) Factory QA PEB can clear a terminal, erasing all vote and audit data .. 70 7.2.12 (Emulated) Factory QA PEB can lock a terminal ................... 71 7.2.13 iVotronic touchscreens can be miscalibrated to deny certain ballot selections ..... 71 7.2.14 Connection to RTAL/VVPAT printer is physically unprotected ............ 71 7.2.15 Audit data is insufficiently randomized ........................ 73 7.2.16 VVPAT barcodes contain timestamps ......................... 73 7.2.17 VVPAT barcodes contain vote information ...................... 73 7.2.18 Accuracy testing mode detectable ........................... 75 7.3 M100 .............................................. 75 7.3.1 The M100 does not password protect the procedure for firmware uploads ...... 75 7.3.2 The M100 does not perform cryptographic