Taking total control of voting systems: firmware manipulations on an optical scan voting terminal

ABSTRACT

The firmware of an electronic voting machine is typically treated as a "trusted" component of the system. Consequently, it is misconstrued to be vulnerable only to an insider attack by someone with an in-depth knowledge of the system and access to the source code. This case study focuses on the Diebold/Premier AccuVote Optical Scan voting terminal (AV-OS) that is widely used in the USA elections. We present three low level manipulations of the above voting terminal's firmware resulting in divergence from its prescribed operation: (i) the first bestows the terminal with a powerful memory card dumping functionality, (ii) the second enables the terminal to leak the ballot details through its serial port thus violating voter privacy during the election, (iii) the final third firmware manipulation is a proof of concept attack that swaps the votes of two candidates thus permanently destroying the election outcome in an undetectable fashion. This demonstrates the extent to which the firmware of the AV-OS can be modified with no insider knowledge or access to the source code.

Our results underscore the importance of verifying the integrity of the firmware of electronic voting terminals accompanied by sound auditing procedures to maintain the candor of the electoral process. We also note that this work is performed solely with the purpose of security analysis of AV-OS, and the first and the second firmware manipulations we describe serve a dual purpose in assisting the technological audits of actual voting procedures conducted using AV-OS systems.

REFERENCES

• 1: Black Box Voting http://blackboxvoting.org.
• 2: H. Hursti, Critical Security Issues with Diebold Optical Scan Design, Black Box Voting Project, July 4, 2005. www.blackboxvoting.org/BBVreport.pdf
• 3: A. Kiayias, L. Michel, A. Russell, A. Shvartsman, M. Korman, A. See, N. Shashidhar and D. Walluck, Security Assessment of the Diebold Optical Scan Voting Terminal, voter.engr.uconn.edu/voter/Report-OS.html
• 4: Aggelos Kiayias , Laurent Michel , Alexander Russell , Narasimha Shashidhar , Andrew See , Alexander A. Shvartsman, An authentication and Ballot layout attack against an optical scan voting terminal, Proceedings of the USENIX Workshop on Accurate Electronic Voting Technology, p.13-13, August 06, 2007, Boston, MA
• 5: A. Kiayias, L. Michel, A. Russel, N. Shashidhar, A. See, A. Shvartsman, S. Davtyan. Tampering with Special Purpose Trusted Computing Devices: A Case Study in Optical Scan E-Voting. Twenty-Third Annual Computer Security Applications Conference (ACSAC), December, 2007, Fl.
• 6: D. Wagner, D. Jefferson and M. Bishop, Security Analysis of the Diebold AccuBasic Interpreter, Voting Systems Technology Assessment Advisory Board, University of California, Berkeley, February 14, 2006.
• 7: V25+ and V35+ User's Manual, NEC Corporation, December, 1992.
• 8: J. Calandrino, A. Feldman, J. Halderman, D. Wagner, H. Yu, W. Zeller, Source Code Review of the Diebold Voting System, July 20, 2007. www.sos.ca.gov/elections/elections_vsr.htm
• 9: Seda Davtyan , Sotiris Kentros , Aggelos Kiayias , Laurent Michel , Nicolas Nicolaou , Alexander Russell , Andrew See , Narasimha Shashidhar , Alexander A. Shvartsman, Pre-election testing and post-election audit of optical scan voting terminal memory cards, Proceedings of the conference on Electronic voting technology, p.1-13, July 28-29, 2008, San Jose, CA
• 10: The Connecticut Citizen Election Audit Coalition, Report and Feedback February 2008 Connecticut Election Audit Observation, April 3, 2008 www.ctelectionaudit.org/Reports/ObservationReportFeb08.pdf
• 11: Stephen N. Goggin , Michael D. Byrne, An examination of the auditability of voter verified paper audit trail (VVPAT) ballots, Proceedings of the USENIX Workshop on Accurate Electronic Voting Technology, p.10-10, August 06, 2007, Boston, MA