WEBVTT 00:00.580 --> 00:01.520 Hi Voting Village. 00:01.520 --> 00:02.540 My name is Forrest Senti. 00:02.540 --> 00:05.880 I'm the Director of Business and Government Affairs at the National Cyber Security Center. 00:06.200 --> 00:07.180 I'm Caleb Gardner. 00:07.180 --> 00:10.500 I'm a fellow at the National Cyber Security Center and Secure the Vote. 00:10.860 --> 00:14.640 And we're going to be presenting you our Hack-a-Fax presentation today. 00:14.640 --> 00:20.940 For a little background to start, National Cyber Security Center is a 501c3 centered in Colorado Springs. 00:21.120 --> 00:31.080 A lot of our focus has to do with cyber innovation awareness and a lot of our projects have to do with tackle global problems, smart cities, elections, space. 00:31.240 --> 00:34.700 Some of our colleagues in the Space ISAC are presenting today in the Aerospace Village. 00:34.700 --> 00:38.000 We want to give them good congratulations and a shout out over there. 00:38.140 --> 00:43.740 But the big reason why we're here today ultimately is that we want to talk about the gap, the security gap. 00:43.740 --> 00:48.260 And specifically it has to do with policy in addition to the different agencies and groups. 00:48.260 --> 00:50.360 A lot of people ask why NCC? 00:50.360 --> 00:50.780 Why us? 00:50.780 --> 00:52.500 Why do we care about some of these issues? 00:52.500 --> 01:03.780 And the reality is that between the different groups that exist in the United States that are multi-agency, multi-party, multi-policy, you know, depending on where you come from, whether it's the Election Security ISAC, groups like Verified Voting, MIT, 01:03.780 --> 01:08.900 even places like the EIC, CISA, CIS, all serve a specific segment. 01:08.900 --> 01:11.840 But our focus is on identifying gaps in critical infrastructure. 01:12.100 --> 01:16.140 And the presentation you're going to hear from us today is going to be talking about that gap. 01:16.140 --> 01:24.220 One gap we've identified specifically has to do with the population affecting the overseas voter or UOCAVA. 01:24.520 --> 01:28.200 This is specific to the Uniformed and Overseas Citizens Absentee Voting Act. 01:28.340 --> 01:32.460 Many of you here at the Voting Village, it's going to be no secret and surprise to you. 01:32.540 --> 01:33.580 You know what this means. 01:33.580 --> 01:41.520 You know how many people and, you know, kind of the different challenges these people face, whether they're voting from Afghanistan or Italy or even from a remote jungle, the Amazon. 01:43.340 --> 01:46.100 So a lot of what we're focused on today is on this area. 01:46.200 --> 01:51.520 So one of the pieces I want to call out is specific to fax machines, like we mentioned early on. 01:51.600 --> 01:59.500 Under the current implementation of the Move Act that was established in 2009, 31 states currently allow for ballot return via email and fax. 01:59.680 --> 02:09.980 This means that these 31 states have to provide a place for these people that are voting from overseas to provide a place for them to send their ballot via fax or email. 02:10.480 --> 02:19.860 So knowing this information and us seeing this different research that was coming out, we wanted to do a quick breakdown and see how many ballots were actually transmitted back in 2018. 02:20.220 --> 02:24.120 According to the EAC, roughly 29,000 ballots were sent. 02:24.380 --> 02:26.380 Now, this is under the category of others. 02:26.380 --> 02:32.100 So some of these in there could be mobile voting from West Virginia or a web portal like in Colorado, Montana, Arizona, or Michigan. 02:32.860 --> 02:41.400 But 29,000 ballots, although not statistically significant to the rest of the United States, still represents a population that is voting using this method. 02:41.460 --> 02:46.780 And this shows that election offices are still allowing for this method and pushing for it, even in some cases. 02:47.020 --> 02:53.260 Although it has been on the decline, it's important to note that security is still paramount for every single vote that comes out. 02:53.520 --> 03:01.900 So now I'll hand it over to Caleb, who's going to talk a little more about the research that we did specific to fax machines and election jurisdictions and kind of give you a little more of the issue right now. 03:02.260 --> 03:03.120 Thanks, Forrest. 03:03.120 --> 03:10.220 So first off, we're going to reference you guys back to some presentations that probably made an impression on you when you first saw them. 03:10.220 --> 03:13.220 They were specifically focused on fax and printer faxes. 03:13.300 --> 03:17.720 So first off, in DEFCON 26, we saw lots of fax from checkpoint research. 03:17.720 --> 03:19.780 And that was a big sticking point for me. 03:19.780 --> 03:24.860 And we came back to that a lot as we went to do our own research and talk to other counties and cities. 03:25.080 --> 03:26.720 So we'll move to the next slide. 03:26.740 --> 03:35.440 And what checkpoint research really showed us was that it was impossible to exploit printer fax just with a publicly available fax number. 03:35.820 --> 03:40.020 No city or county that I looked for, their fax number was not available. 03:40.020 --> 03:47.200 Every single time I could find it for the city clerk or the county clerk, and which is where you'd be submitting your vote for if you were one of these blue collar voters. 03:47.800 --> 03:52.320 So using that phone number, checkpoint research was able to hack printer fax. 03:52.320 --> 03:59.400 And actually, they were also able to get to the network behind that printer fax if there was a flat network topology with no segmentation. 03:59.740 --> 04:01.700 So we'll talk about how they did that really fast. 04:01.700 --> 04:07.460 They discovered that in the T30 protocol, we have access to both the data and the headers. 04:07.460 --> 04:10.140 This enabled us to have full control of the JPEG file. 04:10.280 --> 04:12.840 So that's why we use JPEG over any other file type. 04:13.060 --> 04:22.080 And over the PSTN networks, the publicly switched telephone network, we are able to get to that printer fax and use the proprietary JPEG parser. 04:22.100 --> 04:27.820 They specifically looked at HP, but this is probably going to be the case for any of the big solutions. 04:27.820 --> 04:36.740 If that's Xerox, if that's HP, if that's someone else, they're probably implementing their own JPEG parser rather than using some sort of open source publicly known secure parser. 04:36.940 --> 04:40.140 So since they did that themselves, they found a lot of CVEs in there. 04:40.140 --> 04:43.260 They found a buffer overflow with parts and gauge T-markers. 04:43.380 --> 04:46.280 And with that, they had a controllable stack-based overflow. 04:46.280 --> 04:52.400 They could do anything with it, and they were able to get a great exploit, which they put on eternal blue to the rest of the network. 04:52.400 --> 04:55.300 And so it was a really great demonstration in DEF CON 26. 04:56.360 --> 04:57.660 What could you do with this? 04:57.660 --> 04:58.280 A lot. 04:58.500 --> 04:59.460 Practically everything. 04:59.460 --> 05:02.580 You have confidentiality attacks, integrity attacks, and availability attacks. 05:02.580 --> 05:04.440 You have a full CIA triad. 05:04.720 --> 05:10.880 You're seeing voter registration info, particularly if you're getting through to the network behind these printed faxes. 05:10.880 --> 05:14.260 You're seeing ballots, hopefully not, but potentially. 05:14.440 --> 05:17.500 And you are able to maybe change those ballots. 05:18.300 --> 05:26.920 That's something that we're going to look at in the future, is if we can get into one of these printed faxes, can we get to those ballots, or can we get the incoming ballots and change them before they're stored? 05:27.060 --> 05:28.900 And also you have availability attacks. 05:28.900 --> 05:38.720 You're potentially able to bring down an entire city or county's infrastructure for receiving votes for that election, which would make a recount necessary, which would make a lot of bad things happen. 05:38.720 --> 05:40.180 Obviously, we don't want to be saying. 05:40.880 --> 05:41.680 So we're going to research. 05:41.680 --> 05:46.980 We did some confidential research with different cities and counties, and we have to keep that confidential. 05:46.980 --> 05:48.700 We are under NDA, but we can generalize. 05:48.700 --> 05:54.040 We can say what are the rough takeaways we're seeing from two main different types of cities. 05:54.060 --> 05:55.260 First off, we have City A. 05:55.260 --> 05:57.480 This is your medium to large size city. 05:57.480 --> 06:00.640 They probably have good infrastructure investment in IT. 06:00.640 --> 06:09.080 They're probably able to actually hire talented IT professionals who are security conscious, and they're able to enforce strict adherence to best practices with regards to security. 06:09.420 --> 06:14.780 These are all great things, and you're probably going to see a pretty secure printed fax implementation. 06:14.800 --> 06:17.320 We did when we were looking at these types of cities. 06:17.460 --> 06:23.440 City B, however, is the city that we talk about pretty much every time DEF CON rolls around with Voting Village. 06:23.440 --> 06:28.840 They're the ones who are still running the DREs that we have shown vulnerabilities in every year. 06:28.840 --> 06:33.320 You know, it's obviously a broken system that they're still implementing, but they're not going to spend the money to fix it. 06:33.320 --> 06:36.440 They're not going to spend any money to become security conscious. 06:36.440 --> 06:42.920 So probably a really poor mismanaged IT department, and they probably don't have good patching policies or security posture. 06:44.560 --> 06:51.680 So looking at City A in more in-depth, the things that they have that makes them stand apart from other cities is that they have usually segmented networks. 06:51.720 --> 06:55.040 This keeps their printer fax separate from their data servers. 06:55.040 --> 07:00.440 It keeps them separate from their employee workstations, and it's even segmented on a very in-depth level. 07:00.440 --> 07:08.420 So every fire station and police station, there would be those three things, the data servers, the workstations, and the print servers, would all be different things in every single location. 07:08.420 --> 07:14.140 So it's an extremely segmented network that keeps you from getting to a lot of access through that one printer fax. 07:14.140 --> 07:18.260 So basically City A knows that printer fax is a potential point of intrusion. 07:18.420 --> 07:20.900 They probably have good patching policies for the printers. 07:20.900 --> 07:24.780 Hopefully they have multifactor in general, and also for the printer fax servers. 07:24.780 --> 07:29.740 They're probably using fax over IP over PSTN fax, T38 over T30. 07:30.240 --> 07:33.100 City B, however, doesn't have any of these things, practically. 07:33.100 --> 07:37.320 At a flat-nerve topology, you exploit the printer fax, you exploit the network. 07:37.340 --> 07:42.440 They have bad patching, bad multifactor authentication implementation, and bad security posture. 07:43.660 --> 07:48.920 So if you're City B, you're thinking, well, does this apply to me? 07:48.980 --> 07:50.680 How can I know? 07:50.680 --> 08:00.760 Our high-level attack overview is specifically geared towards what Checkpoint Research did in showing that specifically is the HP OfficeJet Pro 6830 online printer. 08:00.760 --> 08:06.240 However, it wasn't the printer that had the vulnerability, it was HP's implementation of the JPEG parser, if you remember. 08:06.460 --> 08:11.560 So HP released a security bulletin in July 2018 talking about this, providing patches. 08:12.140 --> 08:15.200 However, maybe not all of City B saw that. 08:15.200 --> 08:23.040 Maybe they didn't apply that patch, maybe they didn't think to apply the patch, they're not even keeping in track with their recycled machine. 08:23.280 --> 08:29.200 These sorts of things are not important to lots of cities, and they're not going to look at security patches when they're available for them. 08:29.320 --> 08:34.460 So I would recommend, if you're City B, looking to see if you have an HP printer. 08:34.460 --> 08:36.600 Did you buy it after 2018, before 2018? 08:36.600 --> 08:38.920 Did you apply a patch if you bought it before 2018? 08:38.960 --> 08:43.520 And if you didn't, and you're using PSDN, you're probably susceptible to this attack right now. 08:44.340 --> 08:46.300 NIST has some things to say about it as well. 08:46.740 --> 08:49.700 NIST says that there's no widely used standard for fax encryption. 08:49.960 --> 08:54.360 Thus, information sent by fax is at risk for the possible interception or modification. 08:54.720 --> 08:59.160 Jurisdictions should carefully weigh the risks of fax transmission over other alternatives. 08:59.420 --> 09:08.780 So this is a big deal, and I think this is one of the biggest vulnerabilities that we're seeing in fax, and the thing that we'd like to see changed most in the future is the unencryption of it. 09:08.780 --> 09:13.940 And we would like to see a default encryption method used on fax in the future. 09:14.420 --> 09:19.560 T38 making encryption standard rather than optional would probably be a great step in that direction. 09:19.700 --> 09:30.620 They also stress the secure location of fax machines, because often with T30, voting records or registration info might be actually still stored on that machine as it comes through, unbeknownst to the user. 09:30.640 --> 09:34.700 So physical access would allow access to all those PII. 09:35.220 --> 09:39.760 T38 and T30, we'll go over that really quickly if we haven't gone enough over it already. 09:39.940 --> 09:42.060 So PSPN, that's going to be T30. 09:42.060 --> 09:44.240 It's going to be unencrypted, and it's not real-time. 09:44.240 --> 09:51.520 T38 is the future that we're currently living in, but we also need to see the future as far as encryption implementations. 09:51.560 --> 10:04.200 So we saw Babytel as a company, and they have an AES implementation that's very useful for companies that are regulated and that are mandated to use potentially unsecure networks along the way towards the delivery to the user. 10:04.200 --> 10:10.880 However, this AES implementation by Babytel isn't ensuring that you will have encrypted transport all the way across. 10:10.940 --> 10:20.040 So more stuff like that is what we need to see on a default level in the industry, and we're not seeing right now, which is why we're talking about it and getting that on the record. 10:20.580 --> 10:23.040 So fax security versus public perception. 10:23.200 --> 10:32.380 The big issue we kind of based in pushback from different cities and counties was that they say that only maybe the last faxed out they received was 2012, and that's eight years ago. 10:32.380 --> 10:34.100 So they don't think about it at all. 10:34.100 --> 10:39.160 It doesn't cross their minds, and since they don't see it on a daily basis, they ask themselves, why do we need to secure this? 10:39.160 --> 10:41.000 It doesn't seem like a security risk. 10:41.240 --> 10:45.560 But the point is, is that zero bouts need to be cashed for it to be a security risk. 10:45.560 --> 10:58.800 The fact of the matter is that having your publicly available city or county clerk number online, and knowing, and malicious actors knowing that that's the phone number they need to have access to if they need to hone that printer, or print a fax, that's all they need. 10:58.800 --> 11:03.360 And if you are not patched, if you're on a potentially vulnerable solution, that's it. 11:03.360 --> 11:03.820 You're done. 11:03.820 --> 11:04.700 That printer fax is done. 11:04.700 --> 11:12.600 You're potentially putting yourself up for integrity tax at the very least, confidentiality, and availability if you have bad network topology solutions. 11:12.840 --> 11:20.440 So we face a lot of pushback, but we definitely need to acknowledge that that's the issue, is the root of the matter, is having a publicly available phone number. 11:21.140 --> 11:24.760 So let's talk about the security gap analysis as we move towards a future state. 11:24.760 --> 11:25.960 Well, what do we want to see? 11:25.960 --> 11:28.420 Well, like we talked about, we want to see encryption. 11:28.560 --> 11:32.520 We want to maybe even see fax no longer being a needed method for transmission. 11:32.880 --> 11:35.380 But the reality is that many industries don't rely on fax. 11:35.380 --> 11:37.720 Medical is 70% of all medical transmissions. 11:38.400 --> 11:43.780 But maybe elections doesn't have to be one of those industries where fax is reality. 11:44.100 --> 11:47.940 So what are we going to do in the future as we continue to work on this with Secure the Vote? 11:47.940 --> 11:54.540 Well, we want to reconstruct the fax ploy, but we also want to demonstrate it with the T38 fax protocol and fax over IP. 11:54.540 --> 12:00.520 Because a lot of what we're seeing from cities and counties, well, we do do fax sometimes, but it's all electronically. 12:00.720 --> 12:07.040 And sometimes for these city B or county B scenarios, IP just means security to them. 12:07.040 --> 12:08.220 Over the internet means security. 12:08.220 --> 12:13.440 Maybe they have some sort of bias against phone lines but not IP when that's not the case. 12:13.440 --> 12:20.320 And so we need to demonstrate that exploit to various election officials around the country and show fax is insecure and it can be changed. 12:20.320 --> 12:25.120 And we need to make sure that this is a secure place to secure our votes and to secure our democracy. 12:25.120 --> 12:27.620 So we're going to continue to raise awareness about fax and security. 12:28.260 --> 12:29.640 So why now? 12:29.680 --> 12:39.760 Well, for one thing, COVID-19 has made this a very interesting age and potentially could drop voter turnout as people cannot come out to physical voting locations. 12:40.000 --> 12:47.040 And maybe jurisdictions will look to things traditionally offered to OPAPA and offering that to the general public. 12:47.040 --> 12:49.240 So fax, the web portals, the mobile voting. 12:49.820 --> 12:57.960 And we need to be very conscious when we look at adding fax to the general public, because that is adding a huge attack surface. 12:58.080 --> 13:05.040 And that's adding many, you know, the millions more votes that could potentially be cast by fax, even though we probably won't see millions of votes cast by fax. 13:05.040 --> 13:06.940 The potential is the point. 13:07.060 --> 13:17.500 And that potential millions of votes that can be changed or maliciously attacked is a very juicy target for nation states, maybe, that are looking to influence it. 13:17.540 --> 13:21.640 So we need to keep that in mind as we potentially add fax in for more people. 13:21.640 --> 13:31.000 So if it does get added, we need to look at it very security-minded as an emergency ballot return method, not as something that everybody should think about doing over anything else. 13:31.560 --> 13:42.600 Election officers should probably secure, perform security audits on their fax machines to make sure, you know, potentially if you are exactly what we've been talking about, these HP printers, that you bought it after 2018 and it has a security patch applied, 13:42.600 --> 13:43.520 all that good stuff. 13:43.520 --> 13:47.580 Because if it's not, that's the first step of the rest that's fixing this situation. 13:47.860 --> 13:49.620 So short-term recommendations. 13:49.680 --> 13:54.560 If you're a position of power, you need to talk to your IT department about these things that we've been talking about. 13:54.580 --> 13:57.940 Specifically, do you have security posture like multi-factor? 13:57.940 --> 14:01.160 Do you have that already strong across your IT department? 14:01.160 --> 14:03.080 And do you have that for your printer fax service? 14:03.080 --> 14:09.540 Do you have a segmented network topology that will help you defend from these confidentiality and availability attacks that we've been talking about? 14:09.540 --> 14:15.220 And even the integrity attacks that will keep the printer fax from exploiting the rest of your election network? 14:15.360 --> 14:17.440 And do you have a patching policy? 14:17.580 --> 14:22.500 Are you even security conscious about the network machines that you have in your office? 14:22.620 --> 14:29.960 If you don't have these things or you don't know, I would definitely recommend talking to your IT department about this and try to secure your network by this fall. 14:30.660 --> 14:42.260 And in the farther future, we need to talk about how T38 fax over IP using encrypted solution should be the standard, the default, and what everyone is using, especially in this election context. 14:42.600 --> 14:51.420 The real-time faxing for everyone so we're not storing, especially unbeknownst to the users, voter records on these fax machines. 14:51.760 --> 15:00.500 And the T30 having an encryption protocol would also be great because a lot of people are still going to be stuck on legacy systems for various reasons. 15:01.240 --> 15:03.840 And having encryption for that would be great as well. 15:04.100 --> 15:09.520 So the medical industry has actually had a little bit of a commerce towards eliminating fax. 15:09.520 --> 15:14.080 They said they would do it by 2020 for one of the main providers for fax solutions for medical companies. 15:14.080 --> 15:18.840 It hasn't happened yet, you know, it's been a crazy time, but they're definitely looking at getting the right fax. 15:18.840 --> 15:22.220 So can we maybe eventually follow the medical industry? 15:22.220 --> 15:24.360 It's a great question, something we're looking at in the future. 15:24.640 --> 15:26.820 So what's the point of all this? 15:26.820 --> 15:34.460 With all of 2020's craziness leading down to the end of 2020, everything that's happened, this election is going to be of tantamount importance, obviously. 15:34.460 --> 15:38.640 So we cannot let this opportunity to further secure America's democracy go unspoken. 15:38.680 --> 15:47.000 That's all that we're about here at Voting Village, is showing exploits, showing vulnerabilities, and saying we are not securing our democracy properly if we really care. 15:47.000 --> 15:51.820 And fax is one of those things, even though it's a few ballots, it's a few ballots, and those few ballots matter. 15:51.820 --> 15:54.860 So at the same time, can we leverage you guys? 15:54.860 --> 16:01.280 Can we say, if you guys have a fax machine, if you're interested, if you want to keep following this up, how about you hack your fax machine? 16:01.300 --> 16:11.660 Post about it with hashtag hackafax, and we'll be able to see that, and we'll be able to continue looking at that, and showing that to officials as we go about the country for the next few years with Secure the Vote. 16:12.520 --> 16:13.900 So that's what we have. 16:14.240 --> 16:15.560 I've been Caleb Gardner. 16:15.560 --> 16:16.560 I'm Forrest Adu. 16:16.680 --> 16:20.340 And we're with the National Cyber Security Center, and that's a hackafax. 16:20.340 --> 16:20.800 Cool. 16:20.800 --> 16:21.360 Thanks, guys.