Penetration Test Report (PrincetonUni): Princeton University   Diebold AccuVote TS

ArevisedversionofthispaperwaspublishedinProc.2007USENIX/ACCURATEElectronicVotingTechnologyWorkshop(EVT’07),
August2007.Fortheworkshoppaperandvideosofdemonstrationattacks,seehttp://citp.princeton.edu/voting.
Security Analysis of the Diebold AccuVote-TS Voting Machine
ArielJ.Feldman*,J.AlexHalderman*,andEdwardW.Felten*,†
*CenterforInformationTechnologyPolicyandDept.ofComputerScience,PrincetonUniversity
†WoodrowWilsonSchoolofPublicandInternationalAffairs,PrincetonUniversity
{ajfeldma,jhalderm,felten}@cs.princeton.edu
September13,2006
Abstract
ThispaperpresentsafullyindependentsecuritystudyofaDieboldAccuVote-TSvotingmachine,
including its hardware and software. We obtained the machine from a private party. Analysis of the
machine,inlightofrealelectionprocedures,showsthatitisvulnerabletoextremelyseriousattacks. For
example,anattackerwhogetsphysicalaccesstoamachineoritsremovablememorycardforaslittle
asoneminutecouldinstallmaliciouscode;maliciouscodeonamachinecouldstealvotesundetectably,
modifyingallrecords,logs,andcounterstobeconsistentwiththefraudulentvotecountitcreates. An
attackercouldalsocreatemaliciouscodethatspreadsautomaticallyandsilentlyfrommachinetomachine
duringnormalelectionactivities—avoting-machinevirus. Wehaveconstructedworkingdemonstrations
oftheseattacksinourlab. Mitigatingthesethreatswillrequirechangestothevotingmachine’shardware
andsoftwareandtheadoptionofmorerigorouselectionprocedures.
1 Introduction
The Diebold AccuVote-TS and its newer relative the AccuVote-TSx are together the most widely de-
ployed electronic voting platform in the United States [8]. In the November 2006 general election,
thesemachinesarescheduledtobeusedin357
countiesrepresentingnearly10%ofregistered
voters. Approximately half these counties—
includingallofMarylandandGeorgia—will
employ the AccuVote-TS model. More than
33,000 of the TS machines are in service na-
tionwide.
This paper reports on our study of an
AccuVote-TS,whichweobtainedfromapri-
vate party. We analyzed the machine’s hard-
wareandsoftware,performedexperimentson
it,andconsideredwhetherrealelectionprac-
ticeswouldleaveitsuitablysecure. Wefound
thatthemachineisvulnerabletoanumberof
extremelyseriousattacksthatunderminethe
accuracyandcredibilityofthevotecountsit
produces. TheDieboldAccuVote-TSvotingmachineinourlab
Computer scientists have generally been skeptical of voting systems of this type, Direct Recording
Electronic(DRE),whichareessentiallygeneral-purposecomputersrunningspecializedelectionsoftware.
Experiencewithcomputersystemsofallkindsshowsthatitisexceedinglydifficulttoensurethereliability
andsecurityofcomplexsoftwareortodetectanddiagnoseproblemswhentheydooccur. YetDREsrely
fundamentallyonthecorrectandsecureoperationofcomplexsoftwareprograms. Simplyput,manycomputer
scientistsdoubtthatpaperlessDREscanbemadereliableandsecure,andtheyexpectthatanyfailuresof
suchsystemswouldlikelygoundetected.
PrevioussecuritystudiesofDREsaffirmthisskepticism(e.g.,[4,14,17,24,30]),buttoourknowledge
oursisthefirstpublicstudyencompassingthehardwareandsoftwareofawidelyusedDRE.Thefamous
paperbyKohno,Stubblefield,Rubin,andWallach[17]studiedaleakedversionofthesourcecodeforparts
oftheDieboldAccuVote-TSsoftwareandfoundmanydesignerrorsandvulnerabilities,whicharegenerally
confirmedbyourstudy. Ourstudyextendstheirsbyincludingthemachine’shardwareandoperationaldetails,
byfindinganddescribingseveralnewandseriousvulnerabilities,andbybuildingworkingdemonstrationsof
severalsecurityattacks.
MainFindings Themainfindingsofourstudyare:
1. Malicioussoftwarerunningonasinglevotingmachinecanstealvoteswithlittleifanyriskofdetection.
The malicious software can modify all of the records, audit logs, and counters kept by the voting
machine,sothatevencarefulforensicexaminationoftheserecordswillfindnothingamiss. Wehave
constructeddemonstrationsoftwarethatcarriesoutthisvote-stealingattack.
2. Anyonewhohasphysicalaccesstoavotingmachine,ortoamemorycardthatwilllaterbeinserted
intoamachine,caninstallsaidmalicioussoftwareusingasimplemethodthattakesaslittleasone
minute. Inpractice,pollworkersandothersoftenhaveunsupervisedaccesstothemachines.
3. AccuVote-TSmachinesaresusceptibletovoting-machineviruses—computervirusesthatcanspread
malicious software automatically and invisibly from machine to machine during normal pre- and
post-electionactivity. Wehaveconstructedademonstrationvirusthatspreadsinthisway,installing
ourdemonstrationvote-stealingprogramoneverymachineitinfects.
4. WhilesomeoftheseproblemscanbeeliminatedbyimprovingDiebold’ssoftware,otherscannotbe
remediedwithoutreplacingthemachines’hardware. Changestoelectionprocedureswouldalsobe
requiredtoensuresecurity.
Thedetailsofouranalysisappearbelow,inthemainbodyofthispaper.
Givenourfindings,webelieveurgentactionisneededtoaddresstheseproblems. Wediscusspotential
mitigationstrategiesinmoredetailbelowinSection5.
Themachineweobtainedcameloadedwithversion4.3.15oftheDieboldBallotStationsoftwarethatruns
themachineduringanelection.1 Thisversionwasdeployedin2002andcertifiedbytheNationalAssociation
ofStateElectionDirectors(NASED)[11]. Whilesomeoftheproblemsweidentifyinthisreportmayhave
beenremediedinsubsequentsoftwarereleases(currentversionsareinthe4.6series),othersarearchitectural
innatureandcannoteasilyberepairedbysoftwarechanges. Inanycase,subsequentversionsofthesoftware
shouldbeassumedinsecureuntilfullyindependentexaminationprovesotherwise.
Thoughwestudiedaspecificvotingtechnology,weexpectthatasimilarstudyofanotherDREsystem,
whether from Diebold or another vendor, would raise similar concerns about malicious code injection
attacksandotherproblems. WestudiedtheDieboldsystembecausewehadaccesstoit,notbecauseitis
1ThebehaviorofourmachineconformedalmostexactlytothebehaviorspecifiedbythesourcecodetoBallotStationversion
4.3.1,whichleakedtothepublicin2003.
2
necessarilylesssecurethancompetingDREs. AllDREsfacefundamentalsecuritychallengesthatarenot
easilyovercome.
Despitetheseproblems,webelievethatitispossible,atreasonablecost,tobuildaDRE-basedvoting
system—includinghardware,software,andelectionprocedures—thatissuitablysecureandreliable. Sucha
systemwouldrequirenotonlyavotingmachinedesignedwithmorecareandattentiontosecurity,butalso
anarrayofsafeguards,includingawell-designedvoter-verifiablepaperaudittrailsystem,randomauditsand
forensicanalyses,andtrulyindependentsecurityreview.2
StructureofthePaper Theremainderofthispaperisstructuredasfollows. Section2describesseveral
classesofattacksagainsttheAccuVote-TSmachineaswellasroutesforinjectingmaliciouscode. Section3
discusses the machine’s design and its operation in a typical election, focusing on design mistakes that
make attacks possible. Section 4 details our implementation of demonstration attacks that illustrate the
securityproblems. Section5examinesthefeasibilityofseveralstrategiesformitigatingalloftheseproblems.
Section6outlinespriorresearchontheAccuVotesystemandDREsmoregenerally. Finally,Section7offers
concludingremarks.
2 Attack Scenarios
ElectionsthatrelyonDieboldDREsliketheonewestudiedarevulnerabletoseveralseriousattacks. Many
ofthesevulnerabilitiesarisebecausethemachinedoesnotevenattempttoverifytheauthenticityofthecode
it executes. In this section we describe two classes of attacks—vote stealing and denial-of-service—that
involveinjectingmaliciouscodeintothevotingmachine. Wethenoutlineseveralmethodsbywhichcode
canbeinjectedanddiscussthedifficultyofremovingmaliciouscodeafterasuspectedattack.
2.1 ClassesofAttacks
2.1.1 Vote-StealingAttacks
TheAccuVote-TSmachinewestudiedisvulnerabletoattacksthatstealvotesfromonecandidateandgive
themtoanother. Suchattackscanbecarriedoutwithoutleavinganyevidenceoffraudinthesystem’slogs.
Wehaveimplementedademonstrationattacktoprovethatthisispossible;itisdescribedinSection4.2.
Toavoiddetection,avote-stealingattackmusttransfervotesfromonecandidatetoanother,leavingthe
totalnumberofvotesunchangedsothatpollworkersdonotnoticeanydiscrepancyinthenumberofvotes
reported. Attacksthatonlyaddvotesoronlysubtractvoteswouldbedetectedwhenpollworkersco