[00:10.590 --> 00:17.350] Hello? Hello? Hi! Hi, can everybody hear me? Thank you so much for your patience. I [00:17.350 --> 00:20.850] really appreciate you sticking it out with us while we get these audio things [00:20.850 --> 00:26.550] figured out. I wanted to introduce to you Ashley Benge. She is the director of [00:26.550 --> 00:31.630] Threat Advocacy at Reversing Labs and she's going to be presenting her talk [00:31.630 --> 00:36.630] The Ghost in the Voting Machine. So everybody give it up for Ashley Benge! [00:39.730 --> 00:45.010] Hi guys! I am going to try to talk really loud so that you can actually hear me. [00:45.010 --> 00:49.970] But if you can't hear me, just like wave or give me a thumbs down or something. So [00:49.970 --> 00:54.330] my name is Ashley Benge. I am very fortunate to lead a very cool team of [00:54.330 --> 00:59.050] threat researchers at Reversing Labs. In my career I've worked in roles in [00:59.050 --> 01:03.670] threat detection, threat hunting, and now finally I'm in mostly more of an [01:03.670 --> 01:08.210] outreach type of role. So today I am going to talk to you a little bit about [01:08.830 --> 01:12.890] a recent engagement that we had at Reversing Labs that allowed us to really [01:12.890 --> 01:16.530] learn a lot about our posture on election security and more specifically [01:16.530 --> 01:21.890] software supply chain security. And so I'm going to start this with a story. In [01:21.890 --> 01:28.530] this story, one particular US state had engaged with a contracting company and [01:28.530 --> 01:31.910] signed a multi-million dollar deal and they were looking to build some [01:31.910 --> 01:36.110] backend infrastructure for their election systems. So this was a reputable [01:36.110 --> 01:40.130] contractor. This wasn't a random one off the street. This one had been vetted. [01:40.130 --> 01:47.050] They had worked with vital records databases before and they had really [01:47.050 --> 01:51.550] been a good partner to work with up until this point. The tricky part or the [01:51.550 --> 01:56.270] catch to this is that in that contract it specified that it was okay for this [01:56.270 --> 02:00.310] contractor to use foreign nationals as long as they were based in the United [02:00.310 --> 02:04.850] States. But then we had a pandemic and that changed a lot of things and a lot [02:04.850 --> 02:08.070] of those foreign nationals actually moved back to their country of origin to [02:08.070 --> 02:11.270] be with their families, to be closer to friends and loved ones for whatever [02:11.270 --> 02:15.330] reason. But that wasn't something that this contractor had thought to report [02:15.330 --> 02:19.190] back to the state. So in this case we have a broken contract for a huge [02:19.190 --> 02:23.250] dollar amount and this isn't ideal. There are a couple reasons that we don't want [02:23.250 --> 02:27.510] this to become an issue. And if we break the contract this is probably something [02:27.510 --> 02:32.070] that is going to hit the news and now we have a potential publicity issue to deal [02:32.070 --> 02:36.730] with and this was immediately before a midterm election. And so I obviously [02:36.730 --> 02:40.270] don't want to rely on chance and hope that something bigger and badder comes [02:40.270 --> 02:44.890] up and sweeps that under the rug. And so what this the state was really looking [02:44.890 --> 02:50.450] for is a way to work this out because the contractor had up until that point [02:50.450 --> 02:55.130] been great to work with. And so this is where Reversing Labs comes in. We are [02:55.130 --> 02:58.490] mostly a company that does malware analytics and file analysis so this is [02:58.490 --> 03:02.810] our bread and butter. And what we wanted to look for was any other issues outside [03:02.810 --> 03:08.390] of just the foreign national contracting issue that might potentially come up as [03:08.390 --> 03:15.430] an issue later on in this process. And so as we analyzed this file, or rather this [03:15.430 --> 03:20.650] package, the software, we found two main issues that were related to both third [03:20.650 --> 03:25.870] party dependencies. And so in the first case there was an issue with dependency [03:25.870 --> 03:30.490] on a third-party library that is actually maintained by a known felon. So [03:30.490 --> 03:36.110] this is not a not a great look. At the initial instance when they had started [03:36.110 --> 03:40.250] to use this library, the person behind it was not a felon, but there was an [03:40.250 --> 03:45.170] unfortunate run-in with the law when this person actually killed someone on [03:45.170 --> 03:50.870] their motorcycle. Later on really just did not have a lot of empathy towards the [03:50.870 --> 03:57.370] situation. And so all these things combined, not a great library to be using. [03:59.570 --> 04:06.030] The second major issue was an issue with call-outs to foreign TLDs. And so this is [04:06.030 --> 04:10.030] probably more of an issue than you might think it would be, particularly with [04:10.030 --> 04:14.610] political tensions in certain regions between the US and other nations. And so [04:14.610 --> 04:19.730] the second library that was being used made these call-outs. And in addition to [04:19.730 --> 04:25.010] the bad look being there to begin with, there's also a potential risk that logs [04:25.010 --> 04:30.330] could actually be put somewhere for that foreign entity to access. And so sort of [04:30.690 --> 04:37.170] a double issue there. So through engaging with this state and working through [04:37.170 --> 04:42.330] these issues with this contractor, we bucketed what we found into two or three [04:42.330 --> 04:49.210] rather categories of risk. The first one is financial risk. That's obviously, you [04:49.210 --> 04:52.590] won't be wasting tax dollars, especially in the multiple millions. It's a bad [04:52.590 --> 04:58.450] look. Usually causes some sort of political press issue. The second one, I [04:58.450 --> 05:01.710] also probably don't have to speak very long about political risk. If you're an [05:01.710 --> 05:05.710] election official and you are responsible for trying to procure [05:05.710 --> 05:10.470] infrastructure that can't be used, it's a bad look. It's a bad look if the [05:10.470 --> 05:16.110] infrastructure you procure is ultimately calling out to foreign TLDs. Regardless of [05:16.110 --> 05:20.090] this, this could potentially have risk for you as an individual trying to get [05:20.090 --> 05:28.130] reelected in your state or local government body. The final one I think is [05:28.130 --> 05:31.790] the most interesting and the most nuanced, and that is the risk in terms of [05:31.790 --> 05:39.570] public relations. And so there have been, and I don't think this is going to be [05:39.570 --> 05:42.690] news to anyone, but there have been lots of conspiracy theories, particularly [05:42.690 --> 05:46.810] around the most recent 2020 election. Something that I found very interesting [05:47.210 --> 05:52.650] was the impact that actually had to the company Dominion Voting that was sort of [05:52.650 --> 05:55.850] at the center of a lot of these conspiracies. And so in that case, if you [05:55.850 --> 05:59.370] don't remember, one of the accusations was that they were involved with [05:59.370 --> 06:03.930] Venezuela, who was changing votes to be for the other party. And this actually [06:03.930 --> 06:07.750] did have a very quantifiable financial risk. There was a lawsuit, I think it came [06:07.750 --> 06:13.510] out to be filed for just under a billion dollars. And so this also, in addition to [06:13.510 --> 06:17.950] that, caused a lot of states and other agencies to actually pull back from [06:17.950 --> 06:23.970] their potential vetting of using those systems. And so regardless of which one [06:23.970 --> 06:28.490] of these categories each of these risks fell into, all of these are fairly [06:28.490 --> 06:34.990] concerning. So something that we've talked about a lot today, if you have sat [06:34.990 --> 06:39.450] through any of the other talks or panels, is this idea of trust and the [06:39.450 --> 06:43.830] democratic process. And so something I think we've focused a lot on that we're [06:43.830 --> 06:48.610] actually moving away from in terms of election security is this idea of active [06:48.610 --> 06:54.490] exploitation of needing to secure these devices. And that is, of course, the very [06:54.490 --> 06:59.050] interesting kind of sexy way to frame the problem. But more and more I think [06:59.050 --> 07:03.650] we're starting to see that it is not only the actual devices that can be [07:03.650 --> 07:07.890] exploited, but human beings. And I think we see this the most with the way the [07:07.890 --> 07:13.690] the trust in our democratic process has started to be poked at by certain bodies [07:13.690 --> 07:19.390] that have a vetted interest in undermining that trust. And so I think [07:19.390 --> 07:23.630] the most important tie-in to software supply chain security, which is sort of [07:23.630 --> 07:28.910] my jam, that's what my research team does, is that the software supply chain [07:28.910 --> 07:34.490] actually offers would-be threat actors, would-be bad actors, a potential to [07:34.490 --> 07:38.870] compromise one thing that might actually be a little easier to compromise than [07:38.870 --> 07:42.170] actual election infrastructure or something touching those systems that [07:42.170 --> 07:46.630] are usually very well protected. But if instead they could maybe slip something [07:46.630 --> 07:51.850] into that third-party library, a piece of malware or other code that might gather [07:52.030 --> 07:57.210] a little information, send that back to the C2 server, if they do that and [07:57.210 --> 08:02.450] they're able to get this picked up and used by a number of other agencies that [08:02.450 --> 08:06.930] might have sensitive information, then as a bad guy I've written one piece of bad [08:06.930 --> 08:10.710] code, I put it one place, and I've managed to compromise multiple other entities [08:10.710 --> 08:14.810] which is great value for my time. And I think that's a that's what all of us [08:14.810 --> 08:20.050] want, right? Is a good return on our investment. I think we can see the impact [08:20.050 --> 08:24.690] of this if we look at recent instances where we've actually seen software [08:24.690 --> 08:30.810] supply chain events. Most recently the Moobit instance comes to mind. We've [08:30.810 --> 08:36.830] also seen this happen with 3CX, a number of others, SolarWinds, the breach of [08:36.830 --> 08:41.910] Medoc, and in all of these cases it was only the the thing that was being [08:41.910 --> 08:45.450] dispersed to customers that had to be compromised rather than the customers [08:45.450 --> 08:49.590] themselves. And the enormous financial impact in particular of SolarWinds and [08:49.590 --> 08:58.100] also of the Medoc compromise is very obvious. And so in particular when we [08:58.100 --> 09:02.500] talk about elections, this makes me very nervous, and I'm a nervous person in [09:02.500 --> 09:07.080] general working in threat research, but I think it's particularly concerning that [09:07.080 --> 09:10.800] not only is this not active exploitation, which has been given a lot [09:10.800 --> 09:14.780] of active attention, we've spent a lot of time talking about that, this is [09:14.780 --> 09:19.800] something that might slip by the wayside. It's very easy if you're a developer to [09:19.800 --> 09:23.940] fat-finger the name of a third-party library and accidentally import something [09:23.940 --> 09:27.700] that you didn't mean to import. And what we do at Reverse Labs, in my [09:27.700 --> 09:31.540] threat research organization, is we look at a lot of these libraries and try to [09:31.540 --> 09:36.460] uncover the malicious code or malware that's in them. And we find a lot, [09:36.640 --> 09:41.300] a really concerning amount of malware and other malicious things in these [09:41.300 --> 09:47.660] third-party libraries. We often see, you know, it may not even be a typo, it may be [09:47.660 --> 09:50.820] that I'm going to name something really close to an existing library that's used [09:50.820 --> 09:54.780] all the time. There are many other very simple attack vectors we need to take [09:54.780 --> 09:59.380] advantage of if I'm a bad actor. And it's the simplicity that makes me the most [09:59.380 --> 10:03.580] worried, because you don't even really have to be that good of a bad guy to [10:03.580 --> 10:08.580] cause an issue. And so when we think about potential repercussions for [10:08.580 --> 10:13.720] elections, it doesn't even have to be the big bad scary nation-state actor that [10:13.720 --> 10:18.200] has the technical prowess and time to invest into that. It could just be an [10:18.200 --> 10:22.960] individual who has a little bit of knowledge and is able to slip something [10:22.960 --> 10:27.080] into a library they know is going to be used. And that makes me really worried [10:27.080 --> 10:31.780] that one individual with an agenda would be able to manipulate the public opinion [10:31.780 --> 10:40.260] of an election. And so if I had to come up with a takeaway for the [10:40.260 --> 10:45.240] audience, I think a lot of what we have focused on in the security product world, [10:45.240 --> 10:50.280] and if you're someone who is buying software for critical systems, probably [10:50.280 --> 10:53.220] what you're doing is reviewing source code. And that's great. It's really, really [10:53.220 --> 10:57.940] important to do that. It's valuable for sure. But if you aren't looking at that [10:57.940 --> 11:02.120] final compiled binary, that's a problem. And it's something that you should be [11:02.120 --> 11:07.200] very worried about. And so a lot of what we see, particularly for example, the [11:07.200 --> 11:11.980] recent 3CX compromise, is that it was actually during the build process, which [11:11.980 --> 11:16.180] you wouldn't have seen if you were just vetting source code, that we saw the [11:16.180 --> 11:20.960] malicious library actually introduced. And so this wasn't anything that [11:20.960 --> 11:24.760] necessarily would have been caught otherwise. And for that reason, that's [11:24.760 --> 11:30.240] very concerning. And so when I think about the ways that I want to see [11:30.240 --> 11:35.380] election security change, I think that not only do I want to see, you know, time [11:35.380 --> 11:38.720] invested into preventing active exploitation, preventing misinformation [11:38.720 --> 11:43.120] campaigns. These are all very, very important things. But what I'd also like [11:43.120 --> 11:46.540] to see is that we're very conscious of the little things, the things that might [11:46.540 --> 11:52.740] not require such skill or the ability to to control it and get a very [11:52.740 --> 11:57.800] massive disinformation campaign going. And so if I had to leave you with a [11:57.800 --> 12:03.380] message, I would say if you are someone who is in the business of procuring [12:03.380 --> 12:08.780] software or you are an election official in your state, you should [12:08.780 --> 12:13.680] probably think about what your security controls are actually doing. And just as [12:14.100 --> 12:17.620] a side note, if I go back to that case study, it was a little bit interesting. We [12:17.620 --> 12:22.640] actually ended up reviewing a second application that this government entity [12:22.640 --> 12:27.700] was using. And this one was something that was storing vital records in the [12:27.700 --> 12:31.500] form of driver's license information. And we actually found an additional [12:31.500 --> 12:36.500] instance involving third-party libraries where enough had occurred that there [12:36.500 --> 12:40.920] were actually arrests made. And so, you know, I think it's a proof point there [12:40.920 --> 12:46.260] that, you know, if you aren't very, very diligent and paying attention, then [12:46.760 --> 12:51.220] potentially something could be going on that you're not even aware of. And so [12:51.220 --> 12:55.840] with that, I'll stop talking now. If you have any questions, there are people I'm [12:55.840 --> 12:59.100] sure in the audience that have very interesting points of view. If you have [12:59.100 --> 13:02.020] anything to bring up for discussion, happy to hear it. [13:06.700 --> 13:18.480] Go ahead, Paul. How do you know my name is? You have to yell at me. Is there any [13:18.480 --> 13:25.460] evidence that the vendors themselves, because there's a small number of [13:25.460 --> 13:29.540] vendors who make the hardware and software for election systems, are [13:29.540 --> 13:34.900] attuned to this supply chain risk and taking any steps or measures to address [13:34.900 --> 13:40.480] it? Yeah, I think in general the awareness level is increasing, especially if you're [13:40.580 --> 13:45.000] a government entity because there have been executive orders, for example, that [13:45.000 --> 13:48.560] are starting to require things like SBOMs. If you're not familiar, this is [13:48.560 --> 13:54.680] sort of like a nutrition fax label for a piece of software. And so there are, I [13:54.680 --> 13:58.120] think, positives and negatives to that legislation. You know, that legislation is [13:58.120 --> 14:01.220] not very specific, but it does exist, and I think that's a step in the right [14:01.220 --> 14:05.640] direction for sure. But I would say in general the level of awareness sort of [14:05.640 --> 14:10.620] starts with those most critical contractors, developers, people who might [14:10.620 --> 14:14.320] be touching that sort of very sensitive information, and it's sort of trickled [14:14.320 --> 14:30.150] down from there. So I'm hopeful. Hey, so your firm researches like and finds [14:30.150 --> 14:34.550] compromised libraries. So is there an authoritative source for those [14:34.550 --> 14:39.190] compromised libraries that you'd recommend? Who is that? Sorry, you said a [14:39.190 --> 14:44.010] what source? Like a source to identify those libraries that have been [14:44.010 --> 14:48.830] compromised. Where do we get that information? Like about the libraries [14:48.830 --> 14:53.430] themselves or who is behind it? Yeah, so that's something my research team [14:53.430 --> 14:58.090] prides themselves on. We, and I think most security research groups in the world, [14:58.090 --> 15:01.710] are very serious about spreading that kind of information widely. So we put [15:01.710 --> 15:06.630] all that on our blog, actually. We have, you know, we go from very high [15:06.630 --> 15:10.890] overviews all the way down into the deep technical details of these sort of [15:10.890 --> 15:15.570] threats. And we also obviously provide indicators for free as well. And so if [15:15.570 --> 15:18.590] you're interested in learning more about that, we try to publish as much as we [15:18.590 --> 15:20.190] can to the general public. [15:23.910 --> 15:33.310] As a security person myself, how do we hold our local officials really [15:33.310 --> 15:38.990] responsible for doing the right thing? Because, you know, they're gonna, they're [15:38.990 --> 15:41.890] gonna look at their money and say, okay, it's not in a budget to do static [15:41.890 --> 15:48.090] analysis, dynamic analysis, you know, S-bomb, they're not going to do that. So [15:48.090 --> 15:53.470] how do we really start at the ground level, at the grassroots level, hold our [15:53.470 --> 15:58.570] local authorities responsible for this? Now, I'm just, you know, I would love to [15:58.570 --> 16:01.570] hear your take. You play in this space a lot more than I do. I'm a health care [16:01.570 --> 16:03.830] guy. That's okay. [16:03.830 --> 16:08.770] My answer might be a little different than you're looking for. But in my point [16:08.770 --> 16:12.670] of view, it's really, really important that younger people with more technical [16:12.670 --> 16:20.210] prowess not to disparage anyone who is more senior. But I think a lot of apathy [16:20.210 --> 16:24.910] exists, especially in, you know, millennials and down, there's just not a [16:24.910 --> 16:28.430] lot of involvement in the political system, especially at the local level. [16:28.430 --> 16:31.310] And that really bums me out, because local politics is probably most [16:31.310 --> 16:36.290] applicable to our lives versus the big national politics. And so we had a lot [16:36.290 --> 16:40.310] of urging people to go become poll workers before. But even if you can run [16:40.310 --> 16:43.590] for your local city council, if you have the time for that, if you can [16:43.590 --> 16:48.410] otherwise do any kind of volunteer work, I think getting people who know and [16:48.410 --> 16:52.230] have firsthand experience with the issue into positions of power where they [16:52.230 --> 16:56.530] have a voice is going to be most critical to that. I don't know if that's [16:56.530 --> 16:57.870] what you were going for, but... [17:03.250 --> 17:04.910] Right, right. [17:07.600 --> 17:09.460] So thank you very much. [17:09.460 --> 17:11.200] I don't know if we have time for one more question. [17:11.200 --> 17:15.320] All right. Make the guy with the cane come over to you. [17:16.740 --> 17:22.820] Hello. So I was just wondering if the nation's current, like, political apathy [17:23.520 --> 17:30.680] could create kind of a worsening effect of the effects that you mentioned, like [17:30.680 --> 17:38.760] such as the, like, political risk or public relations at risk. If we're [17:38.760 --> 17:42.400] seeing a lot of people in America, especially young people such as myself, [17:42.400 --> 17:45.740] my group is starting to have a lot of political apathy. So do you think that [17:45.740 --> 17:50.760] could potentially change how people view this issue? [17:51.840 --> 17:57.680] Yeah, I do. One of the things I'm most concerned with is because there's been [17:57.680 --> 18:02.180] such a division of our political system, and there are very strong feelings on [18:02.180 --> 18:05.780] both sides, I think it's become a politicized issue to even question [18:05.780 --> 18:09.160] election security. And that's a problem, because I think it's important to be [18:09.160 --> 18:15.100] able to question everything. I think with regards to apathy in general, it's [18:15.100 --> 18:18.500] concerning to me that those who find themselves feeling apathetic are usually [18:18.500 --> 18:21.980] the people that are sort of in the middle, which I think represents most [18:21.980 --> 18:26.060] folks. And it's the very extreme points of view, the sometimes dangerous points [18:26.060 --> 18:30.780] of view that are involved and are willing enough to invest the time to [18:30.780 --> 18:36.080] potentially do something of the lines of supply chain threat that's going to [18:36.080 --> 18:40.260] ultimately impact critical infrastructure. So it does have me [18:40.260 --> 18:46.140] worried. And I think one of the best things that has come out of things like [18:46.140 --> 18:51.640] social media and people being very sort of ethically active, if you will, I don't [18:51.640 --> 18:55.220] know if that's the right word. But a lot of people, especially who are younger, [18:55.220 --> 18:59.800] feel very compelled to stand up for a cause. And so I have hope that the [18:59.800 --> 19:02.980] younger generations are going to pick this as a cause that they can really get [19:02.980 --> 19:06.560] behind. And the people that I talk to, maybe I'm biased because I talk to [19:06.560 --> 19:10.480] mostly very smart people, but I have a lot of hope in that regard. [19:13.760 --> 19:18.200] Please join me in thanking Ashley again. Thank you very much for your time.