WEBVTT 00:04.130 --> 00:04.850 What's up? 00:04.850 --> 00:08.230 Cause Effect here, DEF CON, here at Voting Village. 00:08.230 --> 00:09.430 My name is Heri Hirstin. 00:09.430 --> 00:13.130 I'm the founder, co-founder and co-organizer of the Voting Village. 00:13.130 --> 00:28.330 We are here to educate people about the reality of voting machines, especially now in an era when false claims of rigging and whatnot is done, so that people understand exactly how these machines work, what are the vulnerabilities, how you mitigate against the vulnerabilities. 00:28.330 --> 00:32.250 We have a lot of machines here that we are currently using around the country. 00:32.250 --> 00:35.250 These machines are old machines. 00:35.410 --> 00:38.630 These machines are designed from mid-80s. 00:38.630 --> 00:40.690 It's still widely in use. 00:40.690 --> 00:45.590 This is the first machine ever hacked, and I did that hack in 2005. 00:45.770 --> 00:52.430 So, because this machine was designed at a time when cyber war was bad science fiction. 00:52.690 --> 00:57.710 This doesn't have the capabilities of hardware, which modern general purpose computers... 00:57.710 --> 00:59.710 this doesn't have an operating system. 00:59.710 --> 01:09.990 So, this has a very small footprint and a very small attack surface, because the time era when this was built, everything was minimalistic by necessity, not by design. 01:10.030 --> 01:11.070 Okay. 01:11.470 --> 01:17.450 So, let's talk a little bit about this machine and talk specifically about the vulnerability that you pointed out. 01:17.450 --> 01:18.910 It doesn't have a hard drive. 01:18.910 --> 01:20.330 It doesn't have flash. 01:20.930 --> 01:22.770 The software itself is an EEPROM. 01:22.770 --> 01:28.450 It doesn't have any other storage than a memory card, which is the vulnerability of this machine. 01:28.450 --> 01:46.450 However, because it's a removable memory card, you can mitigate against it by making two-man rule on everybody who is touching it, programming it, making the physical security to fight against the vulnerability on the technology. 01:46.450 --> 01:48.150 And this is very normal. 01:48.150 --> 01:49.730 These machines are old. 01:49.730 --> 01:53.450 They require a lot of physical security, all of which is missing. 01:53.450 --> 02:02.690 Always when we show a vulnerability, what happens is people are claiming, well, that won't happen in a real world because there's such a high physical security. 02:02.690 --> 02:04.050 And that's never true. 02:04.110 --> 02:12.690 If somebody got their hands on this memory card, was able to manipulate the information, and then put it back in, and then put it back in inventory, that would be the problem, right? 02:12.690 --> 02:12.950 Yeah. 02:12.950 --> 02:21.490 In this machine, because the software itself cannot be altered, the software is an EEPROM and this machine is physically incapable of reprogramming its programming. 02:21.490 --> 02:31.050 The only way you hack this is using the memory card by introducing from there, a wrong ballot definition or manipulate the vote counters. 02:31.130 --> 02:33.230 So everything is in a memory card. 02:33.230 --> 02:36.330 And it's really, this is not about code injection. 02:36.330 --> 02:43.010 This is more about very rudimentary old ways of manipulating, like a car automator running over. 02:43.010 --> 02:47.530 This actually has unsigned integers, so it has an integer overflow problem. 02:47.530 --> 02:48.050 Okay. 02:48.050 --> 02:54.030 So now we covered a very old school voting machine here, still in use. 02:54.050 --> 02:55.630 Memory card is the major vulnerability. 02:55.630 --> 02:57.590 You want to take a look at another one that you pointed out? 02:57.590 --> 02:58.190 Yes , absolutely. 02:58.190 --> 03:00.590 This is a high-speed paper ballot scanner. 03:00.690 --> 03:06.190 These are used in major cities and in vote centers to high-speed process a lot of ballots. 03:06.310 --> 03:11.690 This is still in use, and this is a way more modern technology than the previous one. 03:11.690 --> 03:13.550 This actually does have hard drives. 03:13.550 --> 03:15.410 This actually has an Ethernet. 03:15.550 --> 03:19.850 This is the two decades more modern machine. 03:19.850 --> 03:27.650 So what I'm guessing here with the hardware inside, and we can't take a look obviously, or I don't know if we can. 03:27.650 --> 03:28.110 Yes, we can. 03:28.110 --> 03:29.250 Ah, perfect. 03:31.570 --> 03:39.970 Just to get an idea of the difference and what would be considered an upgrade, right? 03:39.970 --> 03:47.070 So here we have a general purpose computer, which is running operating system unlike the previous one. 03:47.070 --> 03:50.830 We have hard drive, we have Ethernet, we have network capabilities. 03:50.950 --> 03:52.510 This is actually a dangerous machine. 03:52.510 --> 03:56.030 This is a multi-horsepower engine. 03:56.190 --> 04:03.790 And when we accidentally in some paper ballot put a metallic plate in one study, it flew across the room and buried itself to a drywall. 04:03.790 --> 04:05.690 That's the speed the paper goes through. 04:05.690 --> 04:08.290 So you can kill yourself with this voting machine. 04:08.470 --> 04:10.450 So this is not just a voting machine. 04:10.450 --> 04:12.830 This is possibly an assassin. 04:12.830 --> 04:16.510 Yes, it really goes fast because it's a high-speed scanner. 04:16.510 --> 04:19.890 And the vulnerability of this machine is again removal media. 04:19.890 --> 04:23.010 That's a zip drive, and those zip drives are forever old. 04:23.010 --> 04:26.250 You saw the insert in the other side. 04:26.250 --> 04:36.270 This runs a QNX operating system, and if you have a file with a certain name, it automatically executes that with the full root permissions without asking user permission or notifying user. 04:36.270 --> 04:41.070 So you only need to have one certain name of file on a zip drive, and it's done. 04:41.070 --> 04:41.890 And then you're in. 04:41.890 --> 04:42.630 Then you're in. 04:42.630 --> 04:48.190 It sounds like they just made it as easy as possible for you to gain access. 04:48.190 --> 04:49.950 Well, it's convenience. 04:51.090 --> 04:56.650 Remember again, these machines were designed at a time when cyber war was not existing. 04:56.650 --> 04:59.110 Yeah, you have to keep reminding me of that, right? 04:59.110 --> 05:00.350 Because that is an interesting thing. 05:00.350 --> 05:02.950 We live in a day right now when it's so relevant. 05:03.270 --> 05:05.050 And just a couple decades ago... 05:05.050 --> 05:05.990 Bad science fiction. 05:05.990 --> 05:07.710 Nobody would have believed. 05:07.710 --> 05:13.730 Everything we have today, casual and common knowledge, would have never passed as a movie script. 05:13.730 --> 05:17.830 Because it would have been too stupid for people to think this can be actually real. 05:17.930 --> 05:21.750 All right, this technology actually comes from the 2000s. 05:21.930 --> 05:27.730 And thank God this machine is on its way out, because this is the second most dangerous way of voting. 05:27.730 --> 05:33.270 The most dangerous way of voting is Internet voting, because it's beyond our human capabilities to do Internet voting. 05:33.270 --> 05:34.630 It cannot be done. 05:34.630 --> 05:38.430 This is a touchscreen voting where there's no paper record. 05:38.430 --> 05:40.870 Everything is just in electronic form. 05:40.930 --> 05:42.930 So, it's a touchscreen. 05:42.930 --> 05:43.790 You vote. 05:43.790 --> 05:45.270 There's no auditability. 05:45.270 --> 05:50.110 And if you alter the memory counters, there's no recovery. 05:50.370 --> 05:52.190 You cannot do anything else. 05:52.190 --> 05:53.910 You cannot find out if it was hacked. 05:53.910 --> 05:57.890 We actually ran a test election a few years ago with this machine. 05:58.150 --> 06:02.170 It was a very tight race between George Washington and Benedict Arnold. 06:02.170 --> 06:06.850 And our benign dictator, Don Kangen, won, and he wasn't even on the ballot. 06:07.230 --> 06:14.350 So, you were able to switch out names and add completely new applicants or candidates into the machine. 06:14.350 --> 06:15.030 Exactly. 06:15.030 --> 06:19.330 But the funniest thing is, when you did that hack, you cannot recover. 06:19.330 --> 06:22.990 You cannot find the original, actual votes of the people who were voting. 06:22.990 --> 06:23.930 So, it's done. 06:23.930 --> 06:24.410 It's done. 06:24.410 --> 06:26.810 Because there's no paper ballot where you can come back. 06:26.810 --> 06:29.850 So, that's why, thank God, these machines are on the way out. 06:30.590 --> 06:34.730 So, in fact, this was the newest of the three that we looked at. 06:34.730 --> 06:37.970 But this is the most vulnerable and the most dangerous machine. 06:37.970 --> 06:41.750 It's the most dangerous because if something goes wrong, you don't have a recovery. 06:41.830 --> 06:47.150 And, of course, the funniest thing about this machine is that this card reader is not clued in. 06:47.350 --> 06:50.990 And if you plug it out and you boot it, it goes to the supervisor most. 06:50.990 --> 06:51.970 Because why not? 06:51.970 --> 06:57.810 And then you can actually plug it back in, in the convenience or secrecy of the booth. 06:57.810 --> 06:59.930 So, why would you do that? 06:59.930 --> 07:06.390 And the funniest thing is, we have one more machine which is over 10 years newer than this. 07:06.390 --> 07:12.110 And it has the same feature that if you jam the smart card, it goes to supervisor mode. 07:12.490 --> 07:16.630 So, can you do just a quick example of you messing that up? 07:16.630 --> 07:18.990 Because I think we got to see this one. 07:18.990 --> 07:22.670 I know you just brought that card out, but I would love to see supervisor mode. 07:22.670 --> 07:23.370 Here we are. 07:23.370 --> 07:27.850 So, once you are in the supervisor mode, then you can change settings. 07:27.850 --> 07:29.330 This obviously has a network. 07:29.330 --> 07:31.030 There's a lot of other capabilities. 07:31.110 --> 07:37.830 Which also means that one thing what you can do with this, not only you can alter one election, but there's also a proof of concept. 07:38.050 --> 07:45.090 We developed a voting machine virus which can travel from one voting machine to another and infect the whole precinct. 07:45.090 --> 07:46.630 Wow. 07:46.770 --> 07:52.530 So, all you need is access to one and you could potentially spread. 07:52.530 --> 07:54.890 Or not even one. 07:55.030 --> 08:04.610 It's also good enough that if you get the central headquarters election management system, you can spread then one to every precinct and it spreads around there. 08:04.610 --> 08:13.090 So, this is a very old unpatched version of Windows CE and obviously a very dangerous machine to be used. 08:13.090 --> 08:16.450 And thank God, as I said, we are out of the DRA voting. 08:16.450 --> 08:19.270 DRA voting is a very bad idea. 08:19.270 --> 08:21.810 The only worse idea would be internet voting. 08:21.810 --> 08:22.450 Okay. 08:22.610 --> 08:24.250 What is the solution here? 08:24.250 --> 08:26.430 Because we're seeing a lot of machines that are in use. 08:26.630 --> 08:27.530 What do we do? 08:28.110 --> 08:30.950 American elections are uniquely complex. 08:30.950 --> 08:35.570 And outside the smallest jurisdictions, you have to use voting machines. 08:35.570 --> 08:37.950 And you cannot trust the voting machines. 08:37.950 --> 08:46.930 The problem with the ballot marking devices, which is a newest technology introduced, it's a touch screen, when after you make your choices, it will print out the ballot. 08:46.930 --> 08:48.870 That is not anymore voters' choice. 08:48.870 --> 08:50.730 It's a hearsay by computer. 08:50.730 --> 08:58.830 And we have been showing it in studies that voters don't find if the ballot marking device is lying. 08:58.910 --> 09:02.650 So, the safest way to vote is hand-marked paper ballot. 09:02.650 --> 09:07.950 Use a voting machine scanner like the first one we saw, or that one, to scan them. 09:07.950 --> 09:15.550 And then mandatory risk-limiting audit to figure out if the machine provided the right, correct outcome of the election. 09:15.830 --> 09:17.090 Never trust. 09:17.090 --> 09:18.370 Always verify. 09:18.370 --> 09:21.950 And use hand-marked paper ballots so that you can verify. 09:22.050 --> 09:27.950 And if there needs to be a recount, obviously, then you have archived materials that mark votes. 09:27.950 --> 09:32.690 Yes, the security problem of voting is uniquely hard. 09:33.010 --> 09:37.670 Because we have a secret ballot at the same time as auditability. 09:37.670 --> 09:45.170 Secret ballot means that even if I want to reveal how I voted, I shouldn't be able. 09:45.170 --> 09:51.770 Because if I can be coerced to tell how I voted and prove it, then I can buy my vote. 09:51.770 --> 09:55.070 Votes can be bought, sold, and I can be coerced. 09:55.070 --> 09:56.910 How much would it cost to buy you? 09:56.910 --> 10:01.210 I wouldn't be forced to sell, but, you know, everything has also a price. 10:01.210 --> 10:01.590 Exactly . 10:01.770 --> 10:02.530 Everything. 10:02.530 --> 10:04.250 Everything has its price. 10:04.250 --> 10:05.270 I'm curious. 10:05.450 --> 10:06.630 Do you vote? 10:06.630 --> 10:07.350 Of course. 10:07.350 --> 10:07.950 Okay. 10:07.950 --> 10:08.650 Alright. 10:08.690 --> 10:09.270 And... 10:09.270 --> 10:10.930 And everybody should vote. 10:11.150 --> 10:14.510 Whenever you are eligible to vote, please vote. 10:14.510 --> 10:18.390 Democracy is only working with participation. 10:18.490 --> 10:27.570 And apathy is as dangerous to democracy as any kind of malfeasance and shenanigans in the process. 10:27.570 --> 10:28.050 Thank you very much. 10:28.050 --> 10:28.310 Alright. 10:28.310 --> 10:28.670 Thank you. 10:28.670 --> 10:29.370 Bye. 10:29.370 --> 10:29.930 Thank you.