More Related Content
What's hot
What's hot (20)
Similar to Voting Systems - ISSA Chicago Presentation 2020
Similar to Voting Systems - ISSA Chicago Presentation 2020 (20)
Recently uploaded
Recently uploaded (20)
Voting Systems - ISSA Chicago Presentation 2020
- 2. All Your Votes Are Belong To… ES&S, Dominion, and Hart… Chris Roberts Chris@hillbillyhitsquad.com Sidragon1 (LinkedIn and Twitter)
- 6. Disclaimer… The guy giving this presentation doesn’t have skin in this game… • I don’t care if a Democrat, Republican, or John McAfee gets in… • I’d rather you didn’t vote in the Constitution folks. • This is your country… • We gave it back to you • It started out promising. • It’s not looking so good... • However, with Brexit back home, I really can’t say too much! • What I DO care about is a fair fight… – And you don’t have the mechanism in place for that.
- 7. If you were looking for a feel-good pep talk… This isn’t going to be it You have been warned
- 9. The Now…
- 10. "The integrity of our elections is directly tied to the machines we vote on — the products that you make," they wrote. "Despite shouldering such a massive responsibility there has been a lack of meaningful innovation in the election vendor industry and our democracy is paying the price." (2019) Four senators… For once, something we agree on…
- 11. Our Industry…
- 13. We’re Spending More And More! Add 5-10% for 2020
- 14. Splendid, So We’re Winning?
- 15. Nope…
- 16. Not Even Close… The global average mean time to identify a data breach is 197 days. The mean time to recover from a data breach is around 70 days. 76% of organizations were targeted by a phishing attack in the past 12 months. 75% companies say a data breach has caused a material disruption to business processes. The global average cost of a breach is around $4m. We are losing an average of 22.5 million records a DAY. Statistically you now have a 33% chance of being breached in the next 24 months. USA is still the most popular target, 57% of breaches, 97% of the data in last 24 months.
- 17. Globally Top 30 breaches account for almost DOUBLE the Earths population… Congratulations to us… At least we’re thorough in losing everyone data… TWICE!
- 18. EVEN in failure we manage to make a profit?!? Ransomware services, for when the blinky shit fails
- 20. But I’ve Got Cyber?!?
- 21. Adversaries Perspective… Not only do I have a bigger toolbox than you do, I also have time, patience, and the element of surprise on my side. You MUST be right ALL the time… I only need to get lucky once.
- 23. Invite Only CTF, Jan 2020 • Task: – Compromise the Win10 platform and escape from the Virtual Machine • Action: – The team attempted BOTH objectives – Completed BOTH objectives – It took 68 seconds to do both • Result: – Win10 payout $25k – Virtual machine payout $75k – Split between team (different countries) – Most went to charities
- 25. Defenders Current Status It’s not pretty…less tools, the technologies don’t readily coexist and we’re spending ½ the time justifying what we DO do. We also have policies, procedures and controls….all with less resources.
- 27. But My Vendors Told Me I’d Be Secure…
- 30. Going To Need More Tasers…
- 31. Everyone's Got Alert Fatigue
- 33. It’s not IF, it’s WHEN you’ll be breached…
- 34. Narcissistic Reality • Companies are no longer led by solving problems, they’re led by marketing messages. • We charge down the latest buzzwords, fads, and breaches like a pack of rabid hyenas. • We confuse clients with an increasing array of acronyms, product names and rarely simplify the message. • Our companies no longer focus on protecting their charges, simply making more profit. • Build, grow, get acquired and move on is NOT a sustainable view for any established enterprise. • We hide behind FUD, hoodies, faceless attackers, while peppering our clients with AI, ML, Blockchain, and other empty promises. • The evolution of InfoSec to Cyber has NOT been done for the right reasons… • AS an attacker, and adversary YOU have created the perfect conditions for ME to succeed.
- 36. The State Of Voting…
- 37. We’re going to skip past the fact that the 2018’s midterms were a mess, we’ll ignore some of the stuff so far this year, and assume that you already have a background IN the voting systems themselves…
- 38. Let’s Jump In With Passwords…
- 39. Your Vote’s Protected! • By systems with passwords such as: – 1111 – 1234 – Admin – ESS – EVEREST – password – Vogue – (no password)
- 41. For Reference…
- 42. When the FAIL is so strong, one facepalm is not enough…
- 43. Hacking Skills NOT Required… Search for: ElectionCentralMenuPassword
- 44. Try Searching For: • Instruction manuals • Passwords • Configuration settings • Local/Regional/State installation discussions • Images/pictures/booth configurations • Manufacturers patents • Suppliers instructions/device installs • Support forums, tickets, help areas • Software code forums • Etc.
- 45. It’s OK! The Software Will Protect Us...
- 46. Microsoft ended mainstream support for Windows 8.1 on January 9, 2018
- 47. “The ES&S system is extraordinarily complex, consisting of nearly 670,000 lines of source code written in twelve programming languages for five different hardware platforms.” “The type of discovered security bugs strongly suggests that ES&S did not perform an adequate level of code analysis.” “Using another tool, hundreds of potentially exploitable software bugs were immediately exposed.” (Thanks, Micah Sherr, PhD)
- 48. Dec 2019
- 49. I’d Be Disappointed Too..
- 50. Other Findings… • Malicious software running on machines can steal votes with little risk of detection. • Malicious software can modify records, audit logs, and counters kept by the machine. • Forensics will find nothing amiss. • Anyone with physical access to a machine can install malicious software. (<60 seconds) • Anyone who has access to memory cards used in the machine can also install software. • Poll workers and others often have long periods of unsupervised access to machines. • Several targeted machine are susceptible to specific voting-machine viruses • Malicious activity is easy to undertake during normal election activity. • Remediation? – Some of the issue can be eliminated by improving software, – Others cannot be rectified without full hardware replacements. – Significant changes to procedures would be needed to ensure security.
- 54. Patching? Nope…
- 55. When a Regular Facepalm Just Isn’t Enough The Presidential Facepalm
- 56. ES&S “Answers For Every Election Challenge” “These companies’ litigiousness creates a barrier to competition that becomes a barrier to improving our elections.” Louisiana campaign finance records show that an ES&S lobbyist in Baton Rouge has donated $13,250 to Edwards’ campaigns since 2014. Thanks: Jessica Huseman
- 57. ES&S Corruption Doc ...and another 39 pages
- 58. Note: Even though this points out ES&S’s flaws (only a few of them.) The others (Dominion and Hart) also fail most levels of scrutiny…and shouldn’t be sitting there congratulating themselves… You’re ALL as bad as each other, and that’s part of the problem.
- 59. We don’t need anyone to “hack” our elections… We’re fully capable of cocking it up on our own! In Summary:
- 60. So, Where DOES That Leave Us?
- 61. Nobody’s Got The Full Picture… This is the general population… Happy, relaxed and blissfully unaware…
- 63. That’s NOT Quite True…
- 64. August 2019, Las Vegas… 1. Commercially-Available Voting System Hardware Remains Vulnerable to Attack 2. There is an Urgent Need for Paper Ballots and Risk-Limiting Audits 3. New Ballot Marking Device (BMD) Products are Vulnerable 4. Infrastructure and Supply Chain Issues Continue to Pose Significant Security Risks PLEASE , take the time to download AND read the voting village report from DEF CON 27
- 65. Thank you, from ALL of us!
- 66. So We Have A Clue, But We’re Still Screwed?
- 67. Blame Someone, That Always Works…
- 68. Who To Blame? Theoretical and empirical research on the effect of foreign electoral intervention has been thin on the ground and weak until recently… Since 2011 several studies have been conducted. One study indicated that the country intervening in most foreign elections is: • The United States with 81 interventions • Russia (including the former Soviet Union) with 36 interventions The estimates put interference from 1946 to 2000 at an average of once in every nine competitive elections. (Most being through covert actions, BUT, on average able to shift the voting share by about 3%...)
- 69. Why Are We In Such A Mess?
- 73. Communication Math • It takes 1 minute to convince you to hand me your email… • It takes 1 free offer to get your phone number… • It takes 1 time to get you to click an email… • It takes 1 connection with your Bluetooth or wireless… • It takes 1 guess to work out you re-use your passwords… • It takes 1 minute with your unattended electronics… • It takes 1 connection on your social media networks… YET… • It takes 7-20 times to get through to you about awareness… Therefore adversaries continue to win. Change the engagement model
- 74. 2019-2020 Passwords… • 123456 (Still No1…) • 123456789 (Moved UP from 3rd place last year) • qwerty (Moved UP from 9th place last year) • password (Fallen from 2nd place…) • 1234567 (Too depressed to carry on…) • 12345678 • 12345 • Iloveyou (I actually hate you at this point) • 111111 (Congressman’s favorite…) • 1111 (Voting machine favorite!) • 123123 Seriously, we’re talking AI, bioengineering, nanotechnology, and putting people on Mars, and yet this is STILL front and center?!?
- 76. “…any civilization that had so far lost its head as to need to include a set of detailed instructions for use in a package of toothpicks, was no longer a civilization in which I could live and stay sane.” Douglas Adams, you are missed.
- 77. Or, TRY to protect…
- 78. Just ONE Attack Vector… • Last 4 years, around 1,500 healthcare companies have been hit with ransomware. • The 172 individual attacks from 2016 to 2019 affected 6.6 million patients. • The overwhelming majority of organizations affected were: – Hospitals or clinics at 74% – Elderly care providers accounted for 7% – Dental (5%) – Medical testing (2%) – Health insurance, government health and medical supplies, all at 1% • Researchers calculated the overall cost of the attacks at $157 million.
- 79. When We Get It WRONG… People DIE
- 80. iRobot Artificial Intelligence in action…
- 81. So, NO, despite what the vendors say Artificial Intelligence is NOT going to save us
- 82. What DO We Do About It?
- 83. How About We JUST Talk? Communication: Exchange ideas with each other… Cooperation: Independent goals, with an aim to share data Coordination: ALL rowing in same direction for once… Collaboration: The whole is greater than the sum of its parts
- 85. TALK in a language OTHERS understand
- 87. DevSecOps!
- 89. We’ve forgotten the people, Ignored the process, and skipped straight to technology… CHANGE the equation…
- 90. And…one for us
- 91. Unplug!
- 92. There’s more, but hopefully you get the idea
- 93. Our Future
- 94. All Of Us… • Irrespective of your background. • Irrespective of your race, creed, color, faith, or eye color. • Absolutely irrespective of your orientation! • Change takes ALL of us. – This isn’t securities problem, it isn’t the researcher's fault, we need to stop blaming the hackers. – This isn’t the C-Suites blame to carry, nor is it the user's issue to solve. Developers need to be out of the firing line as does EVERYONE in the business. • We ALL take some of the responsibility, therefore we ALL have to solve it…together!
- 97. “We may have all come on different ships, but we’re in the same boat now” Martin Luther King, Jr. 97
- 98. I will fail We will succeed
Editor's Notes
- Welcome to 2020 SnowFroc!
- Oh let me SHOW you how many ways I may attack you….
- It’s NOT pretty…it hasn’t been for a while, competing priorities OT vs. IT vs. IR…..it’s a mess and it’s not getting any easier. I WANT our customers to talk about this too….(Scott/Shannon/Josh chime in and give us your perspectives and opinions…)
- Taser the vendor….simple as that. NO absolutes NO guarantees NO BS
- Here’s a partial survey of what happened: In South Carolina, machines were changing votes—a “calibration issue,” an election official told The State. “In Georgia,” The Washington Post reported, “voters waited more than four hours to vote at an elementary school in suburban Atlanta, where some voting machines were not working at the start of the day.” (Problems were reported elsewhere in the state, too.) The Detroit Free Press reported: Michigan voters are being turned away from the polls, or left waiting in seemingly interminable lines, in various metro Detroit locations so far on Election Day. Rex Nagy, a voter in Redford Township, said that his polling place at Pierce Middle School was relying on just one voting machine that he was told had not been tested before Tuesday morning. Everything was at a standstill while around 100 people waited for it to get fixed. From 7:50 a.m. to 9:30 a.m., Nagy saw about half the line leave to go to work, he said. Although Redford Township said the issue was resolved in around a half-hour, Nagy noted the line was still backed up. According to USA Today, malfunctioning voting machines caused long lines at several precincts in Indiana. Technical glitches were among the factors causing hours-long lines in Maricopa Country, Arizona. In Hamilton County, Ohio, “voting machines unexpectedly rejected ballots that had not been completely filled out” in “Blue Ash, Colerain Township, Hyde Park, Walnut Hills, downtown Cincinnati, Monfort Heights and other locations,” according to the Cincinnati Enquirer. And the Cleveland Plain Dealer reported that “a computer glitch at Geauga County polling places caused the system to mark some Election Day voters as having already voted by absentee ballot.” “Across New York City,” the AP noted, “reports of broken ballot scanners surfaced at several polling places. Turnout was so heavy at one packed precinct on Manhattan’s Upper West Side that the line to scan ballots stretched around a junior high school gym. Poll workers there told voters that two of the roughly half-dozen scanners were malfunctioning.” According to Politico, “Glitchy paperless voting machines are affecting an untold number of early voting ballots in Texas and Georgia, raising the specter that two of the most closely watched races could be marred by questions about whether the vote count is accurate.”
- https://security.cs.georgetown.edu/~msherr/papers/wv-voting-testimony.pdf
- https://www.propublica.org/article/the-market-for-voting-machines-is-broken-this-company-has-thrived-in-it
- Several US companies, and nobody’s good at being HONEST….
- Which leads to this…..everyone’s blissfully unaware until we get our ASSES handed to us….
- There ARE some folks who CARE and who want to make a difference!!
- There ARE some folks who CARE and who want to make a difference!!
- Quick to blame others, rarely do WE look in the mirror…. WE prefer to argue, to use lobbyist and to simply ignore the fact WE are to blame…
- So, I guess WE have to go look in the mirror …..
- Remember our childhood….
- Healthcare, Critical Infrastructure….think what would happen if ransomware hit some of the COVID-19 labs? OR if someone decided to NOW let lose another version of
- REMEMBER the voting village…..
- People Process THEN Technology
- We’re ALL in this together…thanks Charles Schulz!
- FAE, Fundamental Attribution Error, welcome to the end of days. Stop blaming the Russians UNTIL YOU REALLY KNOW! START Looking in the mirror