WEBVTT 00:10.590 --> 00:11.450 Hello? 00:11.450 --> 00:11.870 Hello? 00:11.870 --> 00:12.710 Hi! 00:12.930 --> 00:14.630 Hi, can everybody hear me? 00:14.630 --> 00:16.970 Thank you so much for your patience. 00:17.190 --> 00:21.870 I really appreciate you sticking it out with us while we get these audio things figured out. 00:21.870 --> 00:24.890 I wanted to introduce to you Ashley Benge. 00:24.890 --> 00:33.670 She is the director of Threat Advocacy at Reversing Labs and she's going to be presenting her talk The Ghost in the Voting Machine. 00:33.670 --> 00:36.630 So everybody give it up for Ashley Benge! 00:39.730 --> 00:40.810 Hi guys! 00:40.810 --> 00:45.010 I am going to try to talk really loud so that you can actually hear me. 00:45.010 --> 00:49.150 But if you can't hear me, just like wave or give me a thumbs down or something. 00:49.670 --> 00:51.190 So my name is Ashley Benge. 00:51.250 --> 00:56.750 I am very fortunate to lead a very cool team of threat researchers at Reversing Labs. 00:56.750 --> 01:05.190 In my career I've worked in roles in threat detection, threat hunting, and now finally I'm in mostly more of an outreach type of role. 01:05.230 --> 01:18.850 So today I am going to talk to you a little bit about a recent engagement that we had at Reversing Labs that allowed us to really learn a lot about our posture on election security and more specifically software supply chain security. 01:18.910 --> 01:21.350 And so I'm going to start this with a story. 01:21.430 --> 01:35.070 In this story, one particular US state had engaged with a contracting company and signed a multi-million dollar deal and they were looking to build some backend infrastructure for their election systems. 01:35.210 --> 01:36.870 So this was a reputable contractor. 01:36.870 --> 01:38.910 This wasn't a random one off the street. 01:38.910 --> 01:40.130 This one had been vetted. 01:40.130 --> 01:49.730 They had worked with vital records databases before and they had really been a good partner to work with up until this point. 01:50.190 --> 02:01.270 The tricky part or the catch to this is that in that contract it specified that it was okay for this contractor to use foreign nationals as long as they were based in the United States. 02:01.370 --> 02:12.150 But then we had a pandemic and that changed a lot of things and a lot of those foreign nationals actually moved back to their country of origin to be with their families, to be closer to friends and loved ones for whatever reason. 02:12.270 --> 02:16.630 But that wasn't something that this contractor had thought to report back to the state. 02:16.910 --> 02:21.610 So in this case we have a broken contract for a huge dollar amount and this isn't ideal. 02:21.610 --> 02:24.630 There are a couple reasons that we don't want this to become an issue. 02:24.910 --> 02:35.250 And if we break the contract this is probably something that is going to hit the news and now we have a potential publicity issue to deal with and this was immediately before a midterm election. 02:35.730 --> 02:42.550 And so I obviously don't want to rely on chance and hope that something bigger and badder comes up and sweeps that under the rug. 02:42.630 --> 02:51.990 And so what this the state was really looking for is a way to work this out because the contractor had up until that point been great to work with. 02:52.330 --> 02:54.470 And so this is where Reversing Labs comes in. 02:54.470 --> 02:59.590 We are mostly a company that does malware analytics and file analysis so this is our bread and butter. 02:59.590 --> 03:10.590 And what we wanted to look for was any other issues outside of just the foreign national contracting issue that might potentially come up as an issue later on in this process. 03:11.390 --> 03:22.030 And so as we analyzed this file, or rather this package, the software, we found two main issues that were related to both third party dependencies. 03:22.350 --> 03:30.130 And so in the first case there was an issue with dependency on a third-party library that is actually maintained by a known felon. 03:30.170 --> 03:32.370 So this is not a not a great look. 03:33.290 --> 03:46.450 At the initial instance when they had started to use this library, the person behind it was not a felon, but there was an unfortunate run-in with the law when this person actually killed someone on their motorcycle. 03:46.710 --> 03:51.610 Later on really just did not have a lot of empathy towards the situation. 03:51.610 --> 03:57.370 And so all these things combined, not a great library to be using. 03:59.570 --> 04:04.810 The second major issue was an issue with call-outs to foreign TLDs. 04:04.810 --> 04:14.270 And so this is probably more of an issue than you might think it would be, particularly with political tensions in certain regions between the US and other nations. 04:14.270 --> 04:18.690 And so the second library that was being used made these call-outs. 04:18.690 --> 04:29.430 And in addition to the bad look being there to begin with, there's also a potential risk that logs could actually be put somewhere for that foreign entity to access. 04:29.430 --> 04:32.690 And so sort of a double issue there. 04:33.330 --> 04:44.190 So through engaging with this state and working through these issues with this contractor, we bucketed what we found into two or three rather categories of risk. 04:44.270 --> 04:47.070 The first one is financial risk. 04:47.070 --> 04:52.210 That's obviously, you won't be wasting tax dollars, especially in the multiple millions. 04:52.210 --> 04:53.110 It's a bad look. 04:53.110 --> 04:56.650 Usually causes some sort of political press issue. 04:57.450 --> 05:01.390 The second one, I also probably don't have to speak very long about political risk. 05:01.390 --> 05:08.910 If you're an election official and you are responsible for trying to procure infrastructure that can't be used, it's a bad look. 05:08.910 --> 05:15.250 It's a bad look if the infrastructure you procure is ultimately calling out to foreign TLDs. 05:15.290 --> 05:25.490 Regardless of this, this could potentially have risk for you as an individual trying to get reelected in your state or local government body. 05:26.790 --> 05:32.870 The final one I think is the most interesting and the most nuanced, and that is the risk in terms of public relations. 05:32.870 --> 05:45.010 And so there have been, and I don't think this is going to be news to anyone, but there have been lots of conspiracy theories, particularly around the most recent 2020 election. 05:45.410 --> 05:54.790 Something that I found very interesting was the impact that actually had to the company Dominion Voting that was sort of at the center of a lot of these conspiracies. 05:54.910 --> 06:03.130 And so in that case, if you don't remember, one of the accusations was that they were involved with Venezuela, who was changing votes to be for the other party. 06:03.330 --> 06:06.470 And this actually did have a very quantifiable financial risk. 06:06.470 --> 06:11.090 There was a lawsuit, I think it came out to be filed for just under a billion dollars. 06:11.410 --> 06:21.530 And so this also, in addition to that, caused a lot of states and other agencies to actually pull back from their potential vetting of using those systems. 06:21.890 --> 06:29.510 And so regardless of which one of these categories each of these risks fell into, all of these are fairly concerning. 06:31.410 --> 06:40.570 So something that we've talked about a lot today, if you have sat through any of the other talks or panels, is this idea of trust and the democratic process. 06:40.570 --> 06:52.970 And so something I think we've focused a lot on that we're actually moving away from in terms of election security is this idea of active exploitation of needing to secure these devices. 06:53.090 --> 06:57.510 And that is, of course, the very interesting kind of sexy way to frame the problem. 06:57.690 --> 07:05.610 But more and more I think we're starting to see that it is not only the actual devices that can be exploited, but human beings. 07:05.650 --> 07:17.650 And I think we see this the most with the way the the trust in our democratic process has started to be poked at by certain bodies that have a vetted interest in undermining that trust. 07:18.090 --> 07:44.010 And so I think the most important tie-in to software supply chain security, which is sort of my jam, that's what my research team does, is that the software supply chain actually offers would-be threat actors, would-be bad actors, a potential to compromise one thing that might actually be a little easier to compromise than actual election infrastructure or something touching those systems that are usually very well protected. 07:44.150 --> 08:04.570 But if instead they could maybe slip something into that third-party library, a piece of malware or other code that might gather a little information, send that back to the C2 server, if they do that and they're able to get this picked up and used by a number of other agencies that might have sensitive information, 08:04.570 --> 08:13.030 then as a bad guy I've written one piece of bad code, I put it one place, and I've managed to compromise multiple other entities which is great value for my time. 08:13.030 --> 08:15.370 And I think that's a that's what all of us want, right? 08:15.370 --> 08:17.910 Is a good return on our investment. 08:18.670 --> 08:27.070 I think we can see the impact of this if we look at recent instances where we've actually seen software supply chain events. 08:27.230 --> 08:30.570 Most recently the Moobit instance comes to mind. 08:30.570 --> 08:46.530 We've also seen this happen with 3CX, a number of others, SolarWinds, the breach of Medoc, and in all of these cases it was only the the thing that was being dispersed to customers that had to be compromised rather than the customers themselves. 08:46.530 --> 08:53.330 And the enormous financial impact in particular of SolarWinds and also of the Medoc compromise is very obvious. 08:56.280 --> 09:12.200 And so in particular when we talk about elections, this makes me very nervous, and I'm a nervous person in general working in threat research, but I think it's particularly concerning that not only is this not active exploitation, which has been given a lot of active attention, 09:12.200 --> 09:17.380 we've spent a lot of time talking about that, this is something that might slip by the wayside. 09:17.380 --> 09:25.680 It's very easy if you're a developer to fat-finger the name of a third-party library and accidentally import something that you didn't mean to import. 09:26.000 --> 09:35.580 And what we do at Reverse Labs, in my threat research organization, is we look at a lot of these libraries and try to uncover the malicious code or malware that's in them. 09:35.580 --> 09:42.760 And we find a lot, a really concerning amount of malware and other malicious things in these third-party libraries. 09:42.900 --> 09:51.820 We often see, you know, it may not even be a typo, it may be that I'm going to name something really close to an existing library that's used all the time. 09:51.820 --> 09:56.600 There are many other very simple attack vectors we need to take advantage of if I'm a bad actor. 09:56.600 --> 10:05.180 And it's the simplicity that makes me the most worried, because you don't even really have to be that good of a bad guy to cause an issue. 10:05.320 --> 10:17.120 And so when we think about potential repercussions for elections, it doesn't even have to be the big bad scary nation-state actor that has the technical prowess and time to invest into that. 10:17.120 --> 10:25.680 It could just be an individual who has a little bit of knowledge and is able to slip something into a library they know is going to be used. 10:25.900 --> 10:32.980 And that makes me really worried that one individual with an agenda would be able to manipulate the public opinion of an election. 10:35.480 --> 10:52.020 And so if I had to come up with a takeaway for the audience, I think a lot of what we have focused on in the security product world, and if you're someone who is buying software for critical systems, probably what you're doing is reviewing source code. 10:52.020 --> 10:52.620 And that's great. 10:52.620 --> 10:54.340 It's really, really important to do that. 10:54.460 --> 10:56.240 It's valuable for sure. 10:56.340 --> 11:00.920 But if you aren't looking at that final compiled binary, that's a problem. 11:00.920 --> 11:03.420 And it's something that you should be very worried about. 11:03.420 --> 11:18.440 And so a lot of what we see, particularly for example, the recent 3CX compromise, is that it was actually during the build process, which you wouldn't have seen if you were just vetting source code, that we saw the malicious library actually introduced. 11:18.840 --> 11:23.480 And so this wasn't anything that necessarily would have been caught otherwise. 11:23.480 --> 11:26.100 And for that reason, that's very concerning. 11:26.400 --> 11:39.500 And so when I think about the ways that I want to see election security change, I think that not only do I want to see, you know, time invested into preventing active exploitation, preventing misinformation campaigns. 11:39.500 --> 11:42.020 These are all very, very important things. 11:42.040 --> 11:55.280 But what I'd also like to see is that we're very conscious of the little things, the things that might not require such skill or the ability to to control it and get a very massive disinformation campaign going. 11:55.360 --> 12:12.200 And so if I had to leave you with a message , I would say if you are someone who is in the business of procuring software or you are an election official in your state, you should probably think about what your security controls are actually doing. 12:13.100 --> 12:17.480 And just as a side note, if I go back to that case study, it was a little bit interesting. 12:17.480 --> 12:23.620 We actually ended up reviewing a second application that this government entity was using. 12:23.720 --> 12:29.780 And this one was something that was storing vital records in the form of driver's license information. 12:29.780 --> 12:37.720 And we actually found an additional instance involving third-party libraries where enough had occurred that there were actually arrests made. 12:37.720 --> 12:50.420 And so, you know, I think it's a proof point there that, you know, if you aren't very, very diligent and paying attention, then potentially something could be going on that you're not even aware of. 12:50.960 --> 12:53.840 And so with that, I'll stop talking now. 12:53.840 --> 12:58.480 If you have any questions, there are people I'm sure in the audience that have very interesting points of view. 12:58.480 --> 13:02.020 If you have anything to bring up for discussion, happy to hear it. 13:06.700 --> 13:07.920 Go ahead, Paul. 13:09.180 --> 13:10.780 How do you know my name is? 13:12.600 --> 13:14.460 You have to yell at me. 13:16.780 --> 13:35.680 Is there any evidence that the vendors themselves, because there's a small number of vendors who make the hardware and software for election systems, are attuned to this supply chain risk and taking any steps or measures to address it? 13:35.680 --> 13:47.280 Yeah, I think in general the awareness level is increasing, especially if you're a government entity because there have been executive orders, for example, that are starting to require things like SBOMs. 13:47.280 --> 13:52.380 If you're not familiar, this is sort of like a nutrition fax label for a piece of software. 13:52.440 --> 13:57.200 And so there are, I think, positives and negatives to that legislation. 13:57.200 --> 14:02.540 You know, that legislation is not very specific, but it does exist, and I think that's a step in the right direction for sure. 14:02.980 --> 14:15.000 But I would say in general the level of awareness sort of starts with those most critical contractors, developers, people who might be touching that sort of very sensitive information, and it's sort of trickled down from there. 14:15.000 --> 14:16.260 So I'm hopeful. 14:24.730 --> 14:31.750 Hey, so your firm researches like and finds compromised libraries. 14:32.150 --> 14:36.970 So is there an authoritative source for those compromised libraries that you'd recommend? 14:37.290 --> 14:38.370 Who is that? 14:38.370 --> 14:39.730 Sorry, you said a what source? 14:39.730 --> 14:44.590 Like a source to identify those libraries that have been compromised . 14:44.590 --> 14:46.610 Where do we get that information? 14:47.170 --> 14:50.370 Like about the libraries themselves or who is behind it? 14:51.130 --> 14:54.510 Yeah, so that's something my research team prides themselves on. 14:54.510 --> 15:01.370 We, and I think most security research groups in the world, are very serious about spreading that kind of information widely. 15:01.370 --> 15:03.430 So we put all that on our blog, actually. 15:03.850 --> 15:11.490 We have, you know, we go from very high overviews all the way down into the deep technical details of these sort of threats. 15:11.490 --> 15:14.290 And we also obviously provide indicators for free as well. 15:14.290 --> 15:20.190 And so if you're interested in learning more about that, we try to publish as much as we can to the general public. 15:23.910 --> 15:24.390 As 15:28.230 --> 15:36.150 a security person myself, how do we hold our local officials really responsible for doing the right thing? 15:36.350 --> 15:47.790 Because, you know, they're gonna, they're gonna look at their money and say, okay, it's not in a budget to do static analysis, dynamic analysis, you know, S-bomb, they're not going to do that. 15:47.790 --> 15:56.870 So how do we really start at the ground level, at the grassroots level, hold our local authorities responsible for this? 15:57.010 --> 15:59.470 Now, I'm just, you know, I would love to hear your take. 15:59.470 --> 16:01.030 You play in this space a lot more than I do. 16:01.030 --> 16:02.090 I'm a health care guy. 16:03.030 --> 16:03.830 That's okay. 16:03.830 --> 16:07.210 My answer might be a little different than you're looking for. 16:07.210 --> 16:17.650 But in my point of view, it's really, really important that younger people with more technical prowess not to disparage anyone who is more senior. 16:17.830 --> 16:28.110 But I think a lot of apathy exists, especially in, you know, millennials and down, there's just not a lot of involvement in the political system, especially at the local level. 16:28.110 --> 16:34.310 And that really bums me out, because local politics is probably most applicable to our lives versus the big national politics. 16:34.310 --> 16:39.250 And so we had a lot of urging people to go become poll workers before. 16:39.250 --> 16:55.290 But even if you can run for your local city council, if you have the time for that, if you can otherwise do any kind of volunteer work, I think getting people who know and have firsthand experience with the issue into positions of power where they have a voice is going to be most critical to that. 16:55.530 --> 16:57.870 I don't know if that's what you were going for, but... 17:03.250 --> 17:04.910 Right, right. 17:07.600 --> 17:09.460 So thank you very much. 17:09.460 --> 17:11.200 I don't know if we have time for one more question. 17:11.200 --> 17:12.060 All right. 17:12.100 --> 17:15.320 Make the guy with the cane come over to you. 17:16.740 --> 17:18.040 Hello. 17:18.040 --> 17:38.160 So I was just wondering if the nation's current, like, political apathy could create kind of a worsening effect of the effects that you mentioned, like such as the, like, political risk or public relations at risk. 17:38.160 --> 17:45.200 If we're seeing a lot of people in America, especially young people such as myself, my group is starting to have a lot of political apathy. 17:45.200 --> 17:50.760 So do you think that could potentially change how people view this issue? 17:51.840 --> 17:53.180 Yeah, I do. 17:53.180 --> 18:07.180 One of the things I'm most concerned with is because there's been such a division of our political system, and there are very strong feelings on both sides, I think it's become a politicized issue to even question election security. 18:07.280 --> 18:10.660 And that's a problem, because I think it's important to be able to question everything. 18:10.980 --> 18:22.880 I think with regards to apathy in general, it's concerning to me that those who find themselves feeling apathetic are usually the people that are sort of in the middle, which I think represents most folks. 18:22.880 --> 18:38.180 And it's the very extreme points of view, the sometimes dangerous points of view that are involved and are willing enough to invest the time to potentially do something of the lines of supply chain threat that's going to ultimately impact critical infrastructure. 18:38.680 --> 18:40.720 So it does have me worried. 18:40.720 --> 18:52.900 And I think one of the best things that has come out of things like social media and people being very sort of ethically active, if you will, I don't know if that's the right word. 18:52.900 --> 18:58.080 But a lot of people, especially who are younger, feel very compelled to stand up for a cause. 18:58.180 --> 19:03.400 And so I have hope that the younger generations are going to pick this as a cause that they can really get behind. 19:03.400 --> 19:10.480 And the people that I talk to, maybe I'm biased because I talk to mostly very smart people, but I have a lot of hope in that regard. 19:13.760 --> 19:16.620 Please join me in thanking Ashley again. 19:16.780 --> 19:18.200 Thank you very much for your time.