start	end	text
0	5600	Shannon Morse with DEF CON 30 here. I am joined by Harry Hirste. I am so excited. This is one
5600	11500	of my favorite villages to join and check out and research personally from my own experience.
11600	16060	The Voting Machine Village. And you have a very interesting machine to share with us
16060	17060	this year.
17260	23220	Yes, every year we try to find new machines and get new things for people to poke around.
23740	28420	And we have been looking for this machine or something like this for quite a while.
29000	34600	Ivanka Trump, it was widely published that Ivanka Trump registered a trademark for voting
34600	39440	machines in China. And since there are no Chinese voting machines as such, we have been
39440	43860	keeping looking and looking until now the machine popped up. We don't know if this is
43860	48780	the same machine, but that's the reason we were looking for a Chinese voting machine.
48980	53860	So in Alibaba we found a machine which is advertised with the pictures of Trump and
53860	54900	Hillary Clinton.
55500	56560	Crazy, crazy.
56560	60360	And we ordered it. We got it. Here it is.
60900	64580	So when did you order this machine? When did you see it pop up?
64640	69600	We saw it popping up in July, in early July, and we ordered it immediately.
70300	76000	They ship it. And after that, I saw it returned to sender because it had too big battery.
76000	80980	And then they removed the battery and they sent it. There was something else. It eventually
80980	87640	got just a week ago to U.S. So we were sweating because of all the shipping problems, but
87640	93680	we got it in. And we also wanted to know as much as we can from the vendor. So the company
93680	98900	which we bought this from claimed they had a designer and they said that this is at least
98900	105060	in use in Nigeria. We also have discovered since it came here that there's a second company
105060	110400	in China who is selling this under their own name. So we don't know what is the story.
110400	115760	We are investigating this. We didn't know about the other company until we saw the sticker
115760	120580	in behind it. So that is not matching with the name of the company we bought it from.
120580	125360	That's really interesting. It almost sounds like the same manufacturer is selling this
125360	130240	under different brands or selling it out to other manufacturers. We don't know. That's
130240	134380	very interesting. I'm very intrigued. But again, the company which we contacted is different
134380	139280	than what is actually the sticker behind. Right, right. Now, so far this weekend, we
139280	144760	have seen a lot of interesting information coming out about this machine. You had a team
144760	150680	come in here and write up an entire report, which we have not seen yet. Yeah. So first
150680	155340	of all, because this is a one-off machine, it's the only one. And also we have never
155340	161120	seen anything. There was a dedicated team who went very methodological, documented everything,
161120	166520	went step by step, got the forensic images out. And that's why it took them five and
166680	170440	a half hours to get a route, because they actually didn't even turn it on for the first
170440	175380	three hours. Oh, wow. But what did they find once they got in? Do we have any information
175380	179980	about that yet? I mean, the only thing what they have been reporting to me is it's running
179980	189420	Android or Ubuntu Firefly. It has wireless, it has LTE, mobile network, Wi-Fi, Bluetooth,
189420	195780	all connectivity you can possibly imagine. We also found there is a UART port right on
195780	203120	the main board. Exposed UART port. An exposed UART port. And I also noticed on this machine,
203120	210600	and this is so interesting to me as somebody who picks locks, this is a very easy lock to pick.
210700	216880	This is a very, very generic key and a very generic lock. And apparently they sell it everywhere. You
216880	222940	can find one over in the hardware village. Every single voting machine we have seen has a very
222940	228300	simple locks. There is no secure locks in any of the machines. So with the machines as a whole
228300	234380	in your village, I'm hearing that there's a lot of physical security issues, which if somebody
234380	238920	could physically get access to the machine, obviously they would be able to own it, most
238920	244100	likely. Basically, all machines used in the United States, this is not used in the U.S.,
244100	250580	but all machines used in the U.S. are designed at the time when cyber war was science fiction. So
250580	256460	there have been no security considerations to mention in any of these designs. So once you
256460	263220	get physical access, the game is always over. At the same time, a lot of these machines do have a
263220	270120	capability of being attacked remotely or in a wholesale basis. So there are different ways of
270120	275560	getting in. Discovering the vulnerability is one thing, but weaponizing and thinking about how this
275560	280500	can be misused and abused, that's the second thing. Have you found that a lot of people have come in
280500	287780	here and found not only those physical penetration access, but also remote access as well? Yes, we
287780	293120	have. We have seen that from every year that people are coming up with new ways. One of the
293120	298480	beauty of voting villages, for a lot of people, this is the first time they have any access to
298480	303460	voting machines. They don't know what has been discovered before. So there's a lot of rediscovery.
303460	308140	People are finding something that we knew existed, but they might have a completely different
308140	313540	approach how to get there. So there are all the time new ways to exploit the same thing which has
313540	318680	been found before. So we know this one is currently not being used in the United States. Are any of
318680	322680	the other voting machines that you have here currently being used here in the US? I believe
322680	327420	everything else we have there in the village is being used in the United States. And by the way,
327420	333820	one of the things where we had a security chief of a local, very big county in the United States,
333820	338420	and he was like, please tell me that this doesn't get to Seoul. I said, well, it shouldn't. But
338420	346020	that is, actually, honestly, this is not complying with the US requirements. So it should not be ever
346020	351460	able to enter the US market. But we also know that this manufacturer has more voting machine
351460	357920	models. So I have another model on the way here. And they were telling me that they have a whole
357920	362340	catalog. So we don't even know what all they are making. So are you intending to bring some of
362340	368260	those back in next year for DEFCON 31? Absolutely. I mean, the other machines just didn't arrive in
368260	374020	time. Right, right. Well, hopefully we will see them next year. I'm sure that we will. I love the
374020	378400	fact that you bring in all of these different machines for people to hack on and people to mess
378400	384260	around with, get access to just like you said. If I am brand new to this audience, if I'm brand new
384260	388540	to coming in here to the Voting Machine Village, are there people that I can talk to? Are there ways
388540	394200	that I can find access to these as an entry level hacker? Well, it's always every year, the people
394200	399840	who have been coming earlier are educating and helping the next, next, next incomers. So with
399840	406040	this, our mission is educational. Yes. So this is the primary thing. This year, we also have been
406040	411860	taking a big step towards debunking conspiracy theories. So there has been so many claims that
411860	418420	there's this secret algorithm in these machines. Well, that's what we encouraged from day
418420	425940	one from Friday. Please pull the hardware, pull the firmware out and see yourself if there's a
425940	431980	debunked myth or conspiracy theory. And there have been so many people doing exactly that.
431980	438160	Have you found that brands of the manufacturers and brands themselves have been open to the idea
438160	440320	of having the voting machines here?
441560	447720	We have been openly inviting them every year. This year, we had a from the February, March
447720	452880	conversation with three different vendors of not only voting system, but you know, every system we
452880	457620	used in election environment. Three vendors were indicating they're willing to come. And then about
457860	462400	a month before they say, well, we just realized this is a even a year. So this election year, we
462400	466000	are busy. Oh, wow. Oh, hopefully next year.
466000	467820	So we're trying, we're trying.
467820	473420	We every year try and every, every year we get closer. I mean, this was the first time when we
473420	479680	had a such an advanced talks. And we have had other kind of vendors here every year, who have been
479680	484700	exposing their stuff for hacking. We have a DARPA, Defense Advanced Research Project and their
484700	492120	chips. We have here now Ori, who have a mockup of a election system to as a hacking challenge for
492120	497460	their identity management system. So we have an election related things which are not in use in
497460	503400	elections, but something which can be related. So we all the time invite everyone.
503420	506960	Are there any other challenges happening with the village this weekend?
506960	512580	No, this is the only challenge, but it's also a remote challenge. So you don't have to be here to
512580	513180	participate.
513180	516700	That's great. Is there anything that we didn't touch base on that you would like to share with our
516700	517900	online audience?
518400	523300	Well, I think the most important thing is that even when we talk about vulnerabilities in
523300	531000	elections, never ever feel that that should be discouraging you to vote. Always vote where
531000	538640	you're eligible. Vote, participate. Also, if you really care, become a poll worker. We have a
538640	547460	problem hiring poll workers across the US. And last but not least, in the United States, there
547460	553500	are different election laws in every state and different practices in counties. People get very
553500	558300	confused when misinformation is targeting and telling a story, which might be touching one
558300	564060	county, because of the way they do it, but exposing the different locations. So be very
564060	569620	careful with misinformation, malinformation. Be very careful what you want to believe.
569620	575240	I absolutely agree. Yes, please, please register to vote, especially if you have issues with what's
575240	579960	going on in the political climate. That's so important. Our voices are the ones that change the
579960	583580	world. So we need to make sure that we make those voices heard.
583620	584480	Absolutely.
584480	589740	Thank you so much, Harry. I really appreciate you talking to me today. I'm personally a huge fan. So
589740	593500	it was really such a pleasure. Thank you so much. Have a great day.
593500	593900	You too.