start	end	text
9470	14210	All right, we're going to get our next session started. It is my great pleasure to introduce
14210	21750	Schema, who is going to be talking to us about flaws in a commercial voting system
21750	28030	and how that can make its way into civil elections in the U.S. So this is some
28030	33190	really interesting work. We were talking about online voting earlier. Now we have an example.
34650	42960	Awesome. Thank you, Matt. How are we doing on volume? You guys hear me? Perfect. Fantastic.
42960	48920	All right. I'm Schema. I'm super excited to be here. I've been attending DEF CON for a long time,
48920	54960	but I'm excited to present, excited to take you on this journey of this kind of little pocket of
54960	59040	the world that many people don't know about, including I didn't know about this. I'm excited
59040	66200	to bring you on that journey. So at the root, elections are about power and influence. And we
66200	71480	elect the best to lead us and put their trust in them. And with that trust comes a lot of controls.
71960	75640	Since there's so much potential for abuse, we have controls around the power that comes with
75640	82360	elections. But there's an area of elections where those controls are much weaker. And this is an
82360	87340	area that doesn't get discussed at places like this. And I want to bring it out of the shadows.
87340	94660	And that's private elections. So private elections are elections for private organizations. So think
94660	101680	unions, Amnesty International, Harvard University, tons and tons of organizations elect their
101680	106620	leaders. And the way those election works are very different than civil elections. And as we're
106620	112780	going to see, there's some problems there. So first, I want to touch on why does this matter?
112780	118560	Why should we care about private elections? Let's imagine you're a foreign adversary. And on one
118560	125820	side, you have the option of, you know, co-opting state and local election, maybe getting a random
125820	131560	congressman in a state that matters elected. And that's kind of interesting. On the other side,
131560	137520	you have Harvard, these big NGOs. You can get to elect the president of Harvard University and a
137520	141460	lot of these national and international organizations that are very influential.
142080	147140	That second bucket has some very rich targets if you're a foreign adversary.
149840	154700	Not only are the organizations themselves interesting as a place of influence, but private
154700	160160	elections... I'm sorry, I hope you can hear me. Private elections are a stepping stone to major
160160	166620	political offices. So here we have Justin Kitanji Brown-Jackson. She started on the Harvard board
166620	170640	of overseer. That's how she started to kind of gain influence and eventually came to be on the
170640	174860	Supreme Court. We have people that are involved with the American Medical Association, senators
174860	180800	now. Ambassadors that got their start on these private elections. They're the stepping stone
180800	191700	for a lot of big major positions in U.S. society. So private elections have much less controls and
191700	196440	scrutiny than traditional civil elections. And as we're going to see in this talk,
196440	203060	their technical systems are highly vulnerable. Yeah. In this talk, I'm going to disclose a brand
203060	208960	new zero-day vulnerability in a major provider of election software, private election software.
211660	216860	The CVE number is here. This is a live CVE. There are approximately 2,000 elections that
216860	220900	are affected. They're both civil elections, the kinds you're familiar with, and private elections.
220900	227200	But this vendor runs many of many private elections. So we're going to focus on that
227200	231810	part since it's so exploitable and such an interesting part that we don't talk a lot about.
235190	240990	All right. Well, before we go diving deeper into private elections and what they are,
240990	247810	I want to first make the point of just how much work is involved in the traditional way of spying,
247810	252890	the traditional way of gaining influence in the U.S. Here we have this operation,
252890	260030	this FBI operation, FBI Operation Ghost Story, where they caught a group of 10 Russian spies
260030	265890	that had spent decades building their cover in the U.S. And because this is public information,
265890	270210	we can kind of dig deep into just how much work was put into doing this.
273440	279200	One of the spies is this gentleman here, Andre. He went by the name of Donald Howard
279200	284140	Heathfield. That's a fake name. That's the name of a Canadian deceased person. So step one,
284140	289180	you want to be a spy. You got to find some name and identity to take over. Step two,
289180	293800	he got a degree at Harvard to get that legitimacy. So step two, you actually have to be admitted to
293800	299860	Harvard, actually do the studying. And we're only in step two. Then he married. So he married in the
299860	304080	U.S. He had children, legitimate children in the U.S. His children didn't know he was a spy,
304080	309260	didn't know he was a Russian. Children believed the whole story. He bought a house out here and
309260	313380	then he worked his way up like everybody. He started at the bottom of a company and then
313380	317500	kind of moved his way up and eventually got more and more influence. He spent 20 years,
317500	322080	20 plus years doing this. This is what it takes to do things the traditional way.
322300	326800	There's a lot of energy because there's so much, so much opportunity here to have
326800	332440	tentacles everywhere in the U.S. Foreign adversaries spend a lot of time doing this.
337870	342510	So if you wanted to become a spy in the U.S., there's that kind of path A, the traditional path,
342510	348430	the laundry list of things, the decades you need to put in to get in that position. But if you want
348430	353090	to take the shortcut, just become an elected official. Become an elected official of a
353090	364210	private organization. Go straight to the top. I'm sorry. It is funny. So if you were to take that
364210	369230	path B, here's the menu of organizations that you could put your people in and top leadership
369230	374990	positions. You have unions, big major unions, auto workers unions, all sorts of industries.
375330	380570	NGOs, we talked about those. Universities, all the major universities elect their leadership.
380790	385790	Corporation, professional bodies, the associations that govern who gets to be a doctor, who gets to
385790	390810	be a lawyer. You could put your people in those positions. Pension funds, billions of dollars
390810	395410	that gets spent. You could have your people deciding where that money goes.
395430	401290	This is attractive. I want this. I'm interested. And I'm sure a foreign adversary is, too.
405560	410480	So now that we've established that these elections are influential and juicy targets for a foreign
410480	416880	adversary, I want to make a second point, which is that these elections are a lot easier to attack
416880	424100	than traditional civil elections. The big reason is polling. Traditional elections have a lot of
424100	429600	polling, third-party polling, leading up to the elections. By the day the election comes,
429600	435340	we already kind of know who's going to win. And there's a lot of visibility and focus on that.
435340	439180	And if things don't line up with the polls, people are going to notice. There's a lot of scrutiny.
439440	443960	There's no polling in private elections. These are a lot more open. And these elections are
443960	449620	all electronic, no paper record. I think the crowd knows how dangerous all electronic
449620	456640	elections are. And here we have it. We have just this explosive mix of very powerful positions,
456640	461660	no way to reconcile whether those numbers make any sense with third-party polling,
461660	465760	and all electronic elections. To me, that's pretty scary.
469140	473860	If you're like me, you've never heard about private elections before this. I definitely haven't.
473860	478960	It's kind of the boring areas like this that foreign adversaries actually tend to attack,
478960	491460	rather than the very visible things. So far we've been discussing a theoretical
491460	497740	vulnerability in election software. I want to get to the practical now. In this part of the talk,
497740	504120	I'm going to disclose a zero-day vulnerability in one of the big major providers of private
504120	509920	election software. I mentioned earlier, there are about 2,000 elections affected. It's a live
509920	514660	CVE. And to tell you the story about this, I want to tell you about my journey, about how I
514660	524920	discovered this. I voted in one of these private elections, and I realized that there's basically
524920	529740	this one vendor that handles all these private elections you've never heard about, but are very
529740	534960	important and influential. And this is what the process looks like. You just go to some website.
535200	540380	This is an election for the state bar of Texas. It's a public URL. You just go to this special
540380	544900	web page, and then you put in your information here, click submit, and you vote. And that's it.
544900	552060	That's the whole story. I voted in one of these elections. My university has their alumni vote
552060	556540	on the leadership of the organization. So I went to a page very similar to this,
556540	563140	put in my information, and I made a typo in the information I put in. And I got to this error
563140	569260	page. Now, the error page isn't so interesting, but the part that is interesting is the URL.
569980	572860	And I want to tell you about that. So if we focus on that for a second,
574240	580180	this is what that URL looks like. And there's two parameters, but there's this one parameter here
580180	585600	that just has a bunch of numbers. It doesn't seem so interesting, but I may be being a little too
585600	591660	curious a person. I'm sure this audience can relate. If you start playing around with these
591660	596060	parameters and start putting code in that parameter, rather than the normal numbers
596060	601080	the system expects, if you start putting code in that, in this case, if we put an instruction to
601080	609340	wait for 30 seconds, the software actually executes that instruction. It's crazy. I mean,
609340	614720	we just put something, a random thing in the URL, and we got the software to actually run that code.
617080	622220	Now, getting the software to wait 30 seconds is pretty innocuous, but I, as a security
622220	629080	researcher, know how serious a thing that is. This is called an SQL injection. And what it means is
629080	635000	that, you know, in a traditional way a system works, there's the database that has all the
635000	640020	important information about the system, about who voted and how they voted and so on. And then
640020	645060	there's software that's a gatekeeper of that. So if a regular user tries to ask information they're
645060	650600	not entitled to, like how did the X person vote, the gatekeeper makes sure that they're not given
650600	657780	that information. And an SQL injection is really problematic because it allows us to bypass this
657780	663500	gatekeeper, to ask the database directly, how did Alice vote? Or how about we change this particular
663500	668320	vote? Or how about we add new votes to this database? And nobody would know because there's
668320	682280	no paper backups. It's all electronic, these elections. So to recap, with this SQL injection
682280	689080	vulnerability, just to visit, sorry I'll get out of the way, just to visit, just by visiting this
689080	694860	one public URL and kind of messing with the parameters a little bit, we're able to do anything
694860	701720	to the database. To view how people voted, to submit fake votes, and then to overwrite existing
701720	706540	votes, to change how existing people voted. This is a very serious thing. All through that kind of
706540	712780	URL parameter and putting special things in there. There's even a little bonus, there's a number four
712780	721360	on this. The database is misconfigured in a way that allows an attacker to escape the confines
721360	727800	of the database and take full control of the server. So an attacker in this situation can
727800	734060	you know even kick out the legitimate owners of the server and disable their user accounts, can
734060	740060	install software, they can install a backdoor. A backdoor means that even if the actual vulnerability
740060	745940	the URL messing around stuff we've seen earlier, even if the vendor fixes that, if somebody has
745940	751040	managed to install a backdoor, an attacker can continue to get in until the backdoor itself is
751040	761180	fixed. So they really have total control of this machine. So we were talking about the impact
761180	768040	earlier, there's about 2,200 elections affecting, started from 2001. So anybody can see how those
768040	773040	elections, or an attacker could see how voters have voted in those elections. Lots of organizations
773040	778340	you'd recognize, Teamsters, IBEW, Amnesty International, lots of universities, Yale
778340	785360	University example, California State Bar, public pension systems in most of the states out there,
785360	788300	and many, many more organizations like this.
796680	803020	So in this section of the presentation, I want to talk a lot about a bit about the process of
803020	807880	discovering and reporting this vulnerability. It's a very concerning thing, it's a very shocking thing
807880	813860	to discover. And when you discover something like this, it's difficult to approach the vendor
813860	818690	directly, like who am I to reach out to the vendor and say, hey, everything is broken here. Will they
818690	824710	believe me? Will they trust me? Will I be able to reach out to the right person to get a hold of
824710	833170	them and get them to pay attention? In this case, I had the assistance of CISA. CISA is an agency
833170	837690	part of the Department of Homeland Security, and they do exactly this. And I want to bring them up
837690	842730	to, if anybody in this audience is thinking about exploring election vulnerabilities, private or
842730	848370	otherwise, they're a fantastic player. They do exactly this. They help researchers like I am
849170	854010	disclose vulnerabilities to the vendor. And they're the government, and the vendor pays
854010	858130	attention when the Department of Homeland Security is knocking, saying, hey, there's something wrong
858130	862730	with your software. And in this case, they very much did, thanks to CISA's help. If you're ever
862730	870710	considering doing a vulnerability disclosure, I couldn't say enough good things about them.
870710	875070	Very technically savvy team. Very competent. They're amazing to work with.
875070	879690	This is the URL. You put your report there, and they'll be in touch to help remediate it.
881590	887330	And since we're talking about remediation, I want to give you an update on how things stand
887330	891910	with this particular private election vendor that is responsible for a lot of private elections.
892190	896350	They have taken steps to remediate the vulnerability we just talked about,
896350	901770	by hardening their web application firewall. But one thing they haven't yet done,
901770	906730	and I want to highlight, is we don't know if people have exploited this vulnerability.
910130	913610	There's certainly the potential there, but we don't know if it's happened. And the only people
913610	919270	that really have a chance to know is the vendor. So the vendor has yet to commit to do a forensic
919270	923950	audit of their logs to see if there's ever been an attack, if they have evidence of an attack.
923950	928370	They haven't committed yet to publicly disclose if they do or don't find something. That's still
928370	937130	something that's up in the air. And that's it. I wanted to introduce you to the world of private
937130	940670	election software. I'll take some questions from here. But to me, this was a fascinating
940670	957860	and intriguing little part of the world. Thank you. Awesome. Oh, yeah. I can hear. I'll repeat
957860	968570	your question. Do you know what I'm talking about? Yes, I do. Yeah. Maybe you can talk a
968570	972050	little bit about that, where you think it's at. You can just repeat. Sure, sure. You'll say it
972050	978470	better than me. Yeah, absolutely. The question is around pending legislation that will require
978990	984090	organizations to disclose vulnerabilities like this. Or when they've been breached and what was
984090	987810	grabbed. Yeah, when they've been breached and what was grabbed. I don't know the exact details,
987810	993150	but it's my understanding that the legislation that's most likely to pass only affects public
993150	999410	companies, which this organization is not. There's a lot of these random one-off vendors. This is a
999410	1004850	very small organization. They're probably like a 10-15 person company. And I don't know if you're
1004850	1010570	familiar with that XKCD comic where there's like a whole pile of things that are built up. And then
1010570	1015310	there's that one little note at the bottom that everything depends on. It's very much like this.
1015310	1018330	I don't know if that legislation would affect them, but I wouldn't be surprised if they're
1018330	1021970	exempt from it. Because they're just such a tiny player, but so many of us depend
1021970	1026210	on them doing their job right and paying attention and kind of having scrutiny on that. So
1026210	1030010	I don't know if it affects them directly. I don't know if you knew, because it's been
1037610	1043410	blocked. That's right, yeah. Today the comment here was that many organizations are not required
1043410	1047650	to disclose a breach when it happens. And suddenly you just find your information on the dark web,
1047650	1052110	and you might not even know which organization is responsible for it, right? That is very much
1052110	1061750	the status quo. We do need to get that fixed for sure. Fantastic. Yeah, absolutely. Thank you so
1061750	1065550	much for the work that you've done. Thank you. You're why I'm here. You're a hero. This is
1065550	1070590	amazing, right? Thank you. I looked up the CVE. I've noticed that it's not disclosed yet. Thank
1070590	1077910	you for doing responsible disclosure. My question is, has the vendor been giant jerks about this,
1077910	1082470	or have they been like, oh, wow, thank you, we can fix this, given a timeline, etc.?
1082470	1089430	Yeah, the question was, how has the vendor responded to this? And the response, I think,
1089430	1094230	has been quite effective, in big part because CISA is involved. So I want to emphasize again,
1094230	1098750	if you're thinking of doing this, involve an organization like CISA. They're fantastic.
1099350	1104390	They've been taking steps at remediating the vulnerabilities we talked about here, but
1104690	1110410	a lot of their systems are just very old. They run on a very old version, very old database called
1110410	1115870	Sybase. And it's missing a lot of the security features we expect in modern databases. But
1115870	1119250	they're just stuck with it. You know, they built this thing decades ago, and it's working,
1119250	1124010	at least, you know, working, but still has security problems, right? So they're in this
1124010	1127610	tough spot where they're trying to fight their demons in their tech debt that they have,
1127610	1132890	and make the best out of that. So my impression is that they're earnestly trying, but also
1132890	1139110	the tech stack is in a difficult position for them to quickly remediate everything completely.
1140410	1141930	Does that answer your question?
1145150	1153670	So since we can't read up on the CVE yet, you're not wanting to tell us what company that is?
1153670	1159270	That's right. I'd rather not disclose the company since I want to give them a chance to do as many
1159270	1162590	steps as they can, fully resolving the vulnerability. They've done a lot. There's
1162590	1165490	still some stuff on their plate. I don't want to give them a chance.
1165850	1167730	The election community might want to know.
1167730	1172150	Absolutely. I will publish a paper with the full details, including naming the vendor.
1176950	1182050	So have you recommended to them and or they recommended their customers mitigating controls?
1182190	1186570	So I mean, simply put it behind a WAF, right? Like that would help quite a bit.
1186610	1187050	Yeah.
1187070	1188250	Attempts for SQL Induction.
1188250	1191910	I think there's two questions here.
1192130	1198230	Has a vendor alerted their customers here and have they put it behind a WAF?
1198230	1199650	Is that capturing the questions?
1199650	1200050	Yeah.
1200190	1201310	So let me start with the second one.
1201310	1202390	They have put it behind a WAF.
1202390	1204930	That's been pretty effective, but there's still stuff to do.
1205230	1207590	On the first question, they're planning a public announcement.
1207590	1208790	I haven't seen it live yet.
1208790	1210370	They know that this talk is happening.
1211810	1217490	I don't think the customers have been made aware yet, but they are planning to make them aware.
1218250	1222570	And there's also a CISA alert that's going out Monday covering this.
1222570	1223770	So, yeah.
1227130	1230630	In today's times, I don't know.
1230630	1235910	It seems to me, I personally, do you find it embarrassing that companies are still
1235910	1239790	having basic SQL injection vulnerabilities?
1240110	1245650	The question is, do I find it embarrassing that companies still have SQL injection vulnerabilities?
1245650	1247070	Yes, absolutely.
1247070	1247510	It is.
1247510	1248250	This is nuts.
1248250	1249090	This is crazy.
1249090	1252870	You go to a website, and you type stuff in the URL, and you have access to the database.
1252870	1254330	This is insanity.
1254530	1258250	And we've known about these failures for a very, very long time.
1258250	1261430	But it kind of goes back to this concept I was saying earlier.
1261430	1266090	There's just these random vendors you've never heard about in some nook of the world
1266090	1268810	that so many critical things depend on.
1268810	1272070	And they've been operating this business for decades, and it works.
1272070	1274550	And they're not necessarily growing their business.
1274550	1276590	They've sort of captured all the business there is to grow.
1276590	1279610	They don't really have incentive to tear it down and make it better.
1279610	1280750	It's just it's working.
1280790	1284950	There's a lot of things like this, especially in critical infrastructure.
1285190	1286690	So it is an embarrassment.
1286690	1289350	But I also don't see it going away very much.
1289890	1290650	Yeah.
1291030	1291790	Yeah.
1293150	1294410	Hey, thank you for the talk.
1294410	1295590	That was really cool.
1296090	1300610	So now that you've found this vulnerability in one of the, as you said, many vendors,
1300610	1304710	have you considering doing it systematically for all the other online vendors,
1304710	1308170	just to see if this maybe is more widespread than just this one?
1308170	1309850	I have. I definitely have.
1309990	1314050	There is one vendor that has a formal bug bounty program,
1314050	1321170	and their system gets a lot more attention from security researchers
1321170	1322910	because there's a bit of money there.
1323590	1326350	So there's definitely opportunity to research this.
1326410	1328990	I haven't gone as deep as I wanted to,
1328990	1330550	because this has been so all-consuming,
1330550	1333410	and especially helping the vendor get to the finish line and remediation
1333410	1335430	has been most of what I've been focused on.
1335790	1345630	I think we're good then.
1345630	1347170	Yeah, thank you very much.