Attacking Helios: An authentication bug
Channel: Ben Smyth
Date: 2013-08-16

We identify a logical web application flaw in the Helios electronic voting system's authentication mechanism which can be exploited by TLS truncation attacks to cast votes on behalf of honest voters. In essence, our attack works by truncating the TLS connection which revokes authentication whilst notifying the voter that the sign-out procedure successfully completed, hence, the server believes that the voter is authenticated, but the voter does not. In this context, an adversary can use the voting terminal after honest voters to cast votes on their behalf. Using similar techniques, we are also able to take full control of Microsoft Live accounts (http://youtu.be/nyx8FnhCq7g) and gain temporary access to Google accounts (http://youtu.be/Ux_gE_6RuvU). 

Our results first appeared at Black Hat USA 2013 (https://www.blackhat.com/us-13/briefings.html) and, subsequently, at WOOT'13 (https://www.usenix.org/conference/woot13). A supporting research paper is available from the following URL: http://www.bensmyth.com/publications/2013-truncation-attacks-to-violate-beliefs/