[00:00.000 --> 00:05.600] Shannon Morse with DEF CON 30 here. I am joined by Harry Hirste. I am so excited. This is one [00:05.600 --> 00:11.500] of my favorite villages to join and check out and research personally from my own experience. [00:11.600 --> 00:16.060] The Voting Machine Village. And you have a very interesting machine to share with us [00:16.060 --> 00:17.060] this year. [00:17.260 --> 00:23.220] Yes, every year we try to find new machines and get new things for people to poke around. [00:23.740 --> 00:28.420] And we have been looking for this machine or something like this for quite a while. [00:29.000 --> 00:34.600] Ivanka Trump, it was widely published that Ivanka Trump registered a trademark for voting [00:34.600 --> 00:39.440] machines in China. And since there are no Chinese voting machines as such, we have been [00:39.440 --> 00:43.860] keeping looking and looking until now the machine popped up. We don't know if this is [00:43.860 --> 00:48.780] the same machine, but that's the reason we were looking for a Chinese voting machine. [00:48.980 --> 00:53.860] So in Alibaba we found a machine which is advertised with the pictures of Trump and [00:53.860 --> 00:54.900] Hillary Clinton. [00:55.500 --> 00:56.560] Crazy, crazy. [00:56.560 --> 01:00.360] And we ordered it. We got it. Here it is. [01:00.900 --> 01:04.580] So when did you order this machine? When did you see it pop up? [01:04.640 --> 01:09.600] We saw it popping up in July, in early July, and we ordered it immediately. [01:10.300 --> 01:16.000] They ship it. And after that, I saw it returned to sender because it had too big battery. [01:16.000 --> 01:20.980] And then they removed the battery and they sent it. There was something else. It eventually [01:20.980 --> 01:27.640] got just a week ago to U.S. So we were sweating because of all the shipping problems, but [01:27.640 --> 01:33.680] we got it in. And we also wanted to know as much as we can from the vendor. So the company [01:33.680 --> 01:38.900] which we bought this from claimed they had a designer and they said that this is at least [01:38.900 --> 01:45.060] in use in Nigeria. We also have discovered since it came here that there's a second company [01:45.060 --> 01:50.400] in China who is selling this under their own name. So we don't know what is the story. [01:50.400 --> 01:55.760] We are investigating this. We didn't know about the other company until we saw the sticker [01:55.760 --> 02:00.580] in behind it. So that is not matching with the name of the company we bought it from. [02:00.580 --> 02:05.360] That's really interesting. It almost sounds like the same manufacturer is selling this [02:05.360 --> 02:10.240] under different brands or selling it out to other manufacturers. We don't know. That's [02:10.240 --> 02:14.380] very interesting. I'm very intrigued. But again, the company which we contacted is different [02:14.380 --> 02:19.280] than what is actually the sticker behind. Right, right. Now, so far this weekend, we [02:19.280 --> 02:24.760] have seen a lot of interesting information coming out about this machine. You had a team [02:24.760 --> 02:30.680] come in here and write up an entire report, which we have not seen yet. Yeah. So first [02:30.680 --> 02:35.340] of all, because this is a one-off machine, it's the only one. And also we have never [02:35.340 --> 02:41.120] seen anything. There was a dedicated team who went very methodological, documented everything, [02:41.120 --> 02:46.520] went step by step, got the forensic images out. And that's why it took them five and [02:46.680 --> 02:50.440] a half hours to get a route, because they actually didn't even turn it on for the first [02:50.440 --> 02:55.380] three hours. Oh, wow. But what did they find once they got in? Do we have any information [02:55.380 --> 02:59.980] about that yet? I mean, the only thing what they have been reporting to me is it's running [02:59.980 --> 03:09.420] Android or Ubuntu Firefly. It has wireless, it has LTE, mobile network, Wi-Fi, Bluetooth, [03:09.420 --> 03:15.780] all connectivity you can possibly imagine. We also found there is a UART port right on [03:15.780 --> 03:23.120] the main board. Exposed UART port. An exposed UART port. And I also noticed on this machine, [03:23.120 --> 03:30.600] and this is so interesting to me as somebody who picks locks, this is a very easy lock to pick. [03:30.700 --> 03:36.880] This is a very, very generic key and a very generic lock. And apparently they sell it everywhere. You [03:36.880 --> 03:42.940] can find one over in the hardware village. Every single voting machine we have seen has a very [03:42.940 --> 03:48.300] simple locks. There is no secure locks in any of the machines. So with the machines as a whole [03:48.300 --> 03:54.380] in your village, I'm hearing that there's a lot of physical security issues, which if somebody [03:54.380 --> 03:58.920] could physically get access to the machine, obviously they would be able to own it, most [03:58.920 --> 04:04.100] likely. Basically, all machines used in the United States, this is not used in the U.S., [04:04.100 --> 04:10.580] but all machines used in the U.S. are designed at the time when cyber war was science fiction. So [04:10.580 --> 04:16.460] there have been no security considerations to mention in any of these designs. So once you [04:16.460 --> 04:23.220] get physical access, the game is always over. At the same time, a lot of these machines do have a [04:23.220 --> 04:30.120] capability of being attacked remotely or in a wholesale basis. So there are different ways of [04:30.120 --> 04:35.560] getting in. Discovering the vulnerability is one thing, but weaponizing and thinking about how this [04:35.560 --> 04:40.500] can be misused and abused, that's the second thing. Have you found that a lot of people have come in [04:40.500 --> 04:47.780] here and found not only those physical penetration access, but also remote access as well? Yes, we [04:47.780 --> 04:53.120] have. We have seen that from every year that people are coming up with new ways. One of the [04:53.120 --> 04:58.480] beauty of voting villages, for a lot of people, this is the first time they have any access to [04:58.480 --> 05:03.460] voting machines. They don't know what has been discovered before. So there's a lot of rediscovery. [05:03.460 --> 05:08.140] People are finding something that we knew existed, but they might have a completely different [05:08.140 --> 05:13.540] approach how to get there. So there are all the time new ways to exploit the same thing which has [05:13.540 --> 05:18.680] been found before. So we know this one is currently not being used in the United States. Are any of [05:18.680 --> 05:22.680] the other voting machines that you have here currently being used here in the US? I believe [05:22.680 --> 05:27.420] everything else we have there in the village is being used in the United States. And by the way, [05:27.420 --> 05:33.820] one of the things where we had a security chief of a local, very big county in the United States, [05:33.820 --> 05:38.420] and he was like, please tell me that this doesn't get to Seoul. I said, well, it shouldn't. But [05:38.420 --> 05:46.020] that is, actually, honestly, this is not complying with the US requirements. So it should not be ever [05:46.020 --> 05:51.460] able to enter the US market. But we also know that this manufacturer has more voting machine [05:51.460 --> 05:57.920] models. So I have another model on the way here. And they were telling me that they have a whole [05:57.920 --> 06:02.340] catalog. So we don't even know what all they are making. So are you intending to bring some of [06:02.340 --> 06:08.260] those back in next year for DEFCON 31? Absolutely. I mean, the other machines just didn't arrive in [06:08.260 --> 06:14.020] time. Right, right. Well, hopefully we will see them next year. I'm sure that we will. I love the [06:14.020 --> 06:18.400] fact that you bring in all of these different machines for people to hack on and people to mess [06:18.400 --> 06:24.260] around with, get access to just like you said. If I am brand new to this audience, if I'm brand new [06:24.260 --> 06:28.540] to coming in here to the Voting Machine Village, are there people that I can talk to? Are there ways [06:28.540 --> 06:34.200] that I can find access to these as an entry level hacker? Well, it's always every year, the people [06:34.200 --> 06:39.840] who have been coming earlier are educating and helping the next, next, next incomers. So with [06:39.840 --> 06:46.040] this, our mission is educational. Yes. So this is the primary thing. This year, we also have been [06:46.040 --> 06:51.860] taking a big step towards debunking conspiracy theories. So there has been so many claims that [06:51.860 --> 06:58.420] there's this secret algorithm in these machines. Well, that's what we encouraged from day [06:58.420 --> 07:05.940] one from Friday. Please pull the hardware, pull the firmware out and see yourself if there's a [07:05.940 --> 07:11.980] debunked myth or conspiracy theory. And there have been so many people doing exactly that. [07:11.980 --> 07:18.160] Have you found that brands of the manufacturers and brands themselves have been open to the idea [07:18.160 --> 07:20.320] of having the voting machines here? [07:21.560 --> 07:27.720] We have been openly inviting them every year. This year, we had a from the February, March [07:27.720 --> 07:32.880] conversation with three different vendors of not only voting system, but you know, every system we [07:32.880 --> 07:37.620] used in election environment. Three vendors were indicating they're willing to come. And then about [07:37.860 --> 07:42.400] a month before they say, well, we just realized this is a even a year. So this election year, we [07:42.400 --> 07:46.000] are busy. Oh, wow. Oh, hopefully next year. [07:46.000 --> 07:47.820] So we're trying, we're trying. [07:47.820 --> 07:53.420] We every year try and every, every year we get closer. I mean, this was the first time when we [07:53.420 --> 07:59.680] had a such an advanced talks. And we have had other kind of vendors here every year, who have been [07:59.680 --> 08:04.700] exposing their stuff for hacking. We have a DARPA, Defense Advanced Research Project and their [08:04.700 --> 08:12.120] chips. We have here now Ori, who have a mockup of a election system to as a hacking challenge for [08:12.120 --> 08:17.460] their identity management system. So we have an election related things which are not in use in [08:17.460 --> 08:23.400] elections, but something which can be related. So we all the time invite everyone. [08:23.420 --> 08:26.960] Are there any other challenges happening with the village this weekend? [08:26.960 --> 08:32.580] No, this is the only challenge, but it's also a remote challenge. So you don't have to be here to [08:32.580 --> 08:33.180] participate. [08:33.180 --> 08:36.700] That's great. Is there anything that we didn't touch base on that you would like to share with our [08:36.700 --> 08:37.900] online audience? [08:38.400 --> 08:43.300] Well, I think the most important thing is that even when we talk about vulnerabilities in [08:43.300 --> 08:51.000] elections, never ever feel that that should be discouraging you to vote. Always vote where [08:51.000 --> 08:58.640] you're eligible. Vote, participate. Also, if you really care, become a poll worker. We have a [08:58.640 --> 09:07.460] problem hiring poll workers across the US. And last but not least, in the United States, there [09:07.460 --> 09:13.500] are different election laws in every state and different practices in counties. People get very [09:13.500 --> 09:18.300] confused when misinformation is targeting and telling a story, which might be touching one [09:18.300 --> 09:24.060] county, because of the way they do it, but exposing the different locations. So be very [09:24.060 --> 09:29.620] careful with misinformation, malinformation. Be very careful what you want to believe. [09:29.620 --> 09:35.240] I absolutely agree. Yes, please, please register to vote, especially if you have issues with what's [09:35.240 --> 09:39.960] going on in the political climate. That's so important. Our voices are the ones that change the [09:39.960 --> 09:43.580] world. So we need to make sure that we make those voices heard. [09:43.620 --> 09:44.480] Absolutely. [09:44.480 --> 09:49.740] Thank you so much, Harry. I really appreciate you talking to me today. I'm personally a huge fan. So [09:49.740 --> 09:53.500] it was really such a pleasure. Thank you so much. Have a great day. [09:53.500 --> 09:53.900] You too.