Scribd Logo
Upload

Welcome to Scribd!

  • 3 views

    Lecture 8 - Internet Voting

    Uploaded by

    Tony

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content

    You might also like

    Lecture 8 - Internet Voting

    Uploaded by

    Tony
    3 views68 pages

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    3 views68 pages

    Lecture 8 - Internet Voting

    Uploaded by

    Tony

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    of 68

    Securing g Digital

    g Democracyy
    Lecture 8 | Internet Voting?
    g

    J. Alex Halderman
    University of Michigan
    8.1 A Bad Idea Securing Digital Democracy

    A Bad Idea
    8.1 A Bad Idea Securing Digital Democracy
    8.1 A Bad Idea Securing Digital Democracy

    Estonia

    Limited use: Canada, France, Switzerland, U.K., U.S.


    Graph source: http://www.ega.ee/node/835
    8.1 A Bad Idea Securing Digital Democracy

    Pilot Projects
    in the U.S.

    Limited to overseas
    absentee voters.
    voters
    8.1 A Bad Idea Securing Digital Democracy

    Potential Attackers?

    Traditional Fraudsters

    O li F
    Online Fraudsters
    d t

    “Hacktivists”
    ki i

    Foreign States
    8.2 Client‐side Threats Securing Digital Democracy

    Client‐side Threats
    8.1 A Bad Idea Securing Digital Democracy

    Results
    A: 1000
    B: 999

    Client Internet Server


    Voter’ss PC
    Voter Officials’ PC
    Officials
    8.2 Client‐side Threats Securing Digital Democracy

    Coercion
    8.2 Client‐side Threats Securing Digital Democracy
    8.2 Client‐side Threats Securing Digital Democracy

    Coercion

    Credential Theft
    8.2 Client‐side Threats Securing Digital Democracy
    8.2 Client‐side Threats Securing Digital Democracy

    Coercion

    Credential Theft

    Imposter Sites
    8.2 Client‐side Threats Securing Digital Democracy

    http://www.hyphenet.com/blog/2011/09/19/adobe‐flash‐player‐paid‐ads‐on‐yahoo‐bing‐link‐to‐malware‐again/
    8.2 Client‐side Threats Securing Digital Democracy

    Coercion

    Credential Theft

    Imposter Sites

    Malware
    8.2 Client‐side Threats Securing Digital Democracy
    8.2 Client‐side Threats Securing Digital Democracy

    B

    B
    8.2 Client‐side Threats Securing Digital Democracy

    Coercion

    C d ti l Theft
    Credential Th ft

    Imposter Sites

    Malware

    Botnets
    8.2 Client‐side Threats Securing Digital Democracy

    Botnets

    Illustration by Tom‐b via Wikimedia Commons, http://en.wikipedia.org/wiki/File:Botnet.svg


    Licensed under a Creative Commons Attribution‐Share Alike 3.0 Unported license
    8.2 Client‐side Threats Securing Digital Democracy

    Botnets

    Illustration by Tom‐b via Wikimedia Commons, http://en.wikipedia.org/wiki/File:Botnet.svg


    Licensed under a Creative Commons Attribution‐Share Alike 3.0 Unported license
    8.2 Client‐side Threats Securing Digital Democracy

    Botnets

    Illustration by Tom‐b via Wikimedia Commons, http://en.wikipedia.org/wiki/File:Botnet.svg


    Licensed under a Creative Commons Attribution‐Share Alike 3.0 Unported license
    8.3 Server‐side Threats Securing Digital Democracy

    Server‐side Threats
    8.3 Server‐side Threats Securing Digital Democracy

    Denial of Service
    Results
    A: 1000
    B: 999
    8.3 Server‐side Threats Securing Digital Democracy

    Distributed Denial
    Denial‐‐of
    of‐‐Service
    (DDoS
    DDoS)) Attack

    Illustration by Tom‐b via Wikimedia Commons, http://en.wikipedia.org/wiki/File:Botnet.svg


    Licensed under a Creative Commons Attribution‐Share Alike 3.0 Unported license
    8.3 Server‐side Threats Securing Digital Democracy
    8.3 Server‐side Threats Securing Digital Democracy

    Denial of Service
    Results
    A: 1000
    B: 999
    Insider Attacks
    8.3 Server‐side Threats Securing Digital Democracy

    Denial of Service
    Results
    A: 1000
    B: 999
    Insider Attacks

    Remote Intrusion
    8.3 Server‐side Threats Securing Digital Democracy

    Ad
    Advanced
    d Persistent
    P i t t Threats
    Th t
    8.3 Server‐side Threats Securing Digital Democracy

    Denial of Service
    Results
    A: 1000
    B: 999 Insider Attacks

    Remote Intrusion

    State‐Sponsored Attacks
    8.3 Server‐side Threats Securing Digital Democracy

    Source: http://ebiquity.umbc.edu/blogger/2010/09/23/is‐stuxnet‐a‐cyber‐weapon‐aimed‐at‐an‐iranian‐nuclear‐site/
    8.3 Server‐side Threats Securing Digital Democracy

    vs.
    vs

    Internet Voting Postal Voting


    Right: Photo by Chris Phan (Clipdude) licensed under a Creative Commons Attribution‐Share Alike 3.0 Unported license
    Via Wikimedia Commons, http://en.wikipedia.org/wiki/File:Oregon_ballot_return_box.jpg
    8.3 Server‐side Threats Securing Digital Democracy

    vs.
    vs

    Internet Voting Online Banking


    8.4 Washington, D.C. Securing Digital Democracy

    Washington D.C.
    Washington, DC
    8.4 Washington, D.C. Securing Digital Democracy

    http://www.dcboee.org/pdf_files/nr_588.pdf
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy

    Recruit
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy

    ballot pdf  /tmp/49d5.pdf


    ballot.pdf /tmp/49d5 pdf
    8.4 Washington, D.C. Securing Digital Democracy

    ballot xyz  /tmp/49d5.xyz


    ballot.xyz /tmp/49d5 xyz
    8.4 Washington, D.C. Securing Digital Democracy

    ballot $(sleep 5) “/tmp/49d5.$(sleep


    ballot.$(sleep /tmp/49d5 $(sleep 5)”
    8.4 Washington, D.C. Securing Digital Democracy

    Surveil
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy

    Steal database passwords,


    passwords keys,
    keys etc.
    etc
    Replace all existing votes with ours

    Attack!
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy

    Steal database passwords,


    passwords keys,
    keys etc.
    etc
    Replace all existing votes with ours
    Replace any new votes
    Back door to reveal new votes
    Attack! Clear logs
    “Calling card”
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy

    One more thing…


    thing
    8.4 Washington, D.C. Securing Digital Democracy
    8.4 Washington, D.C. Securing Digital Democracy

    Web applications tend to be brittle


    (Small mistakes can have huge consequences)
    Standard software
    soft are practices inadequate
    inadeq ate
    Officials not equipped to detect/response
    Deep security challenges left to solve

    Lessons Decades, if ever,


    before we can vote online securely.
    securely
    Securing g Digital
    g Democracyy
    Lecture 8 | Internet Voting?
    g

    J. Alex Halderman
    University of Michigan

    You might also like