Increasing the Security of Your Election

Architecture and Background

Daniel C. Silverstein & Damon McCormick - Increasing The Security Of Your Election By Fixing It Increasing The Security Of Your Election By Fixing It In response to the problems that plagued the last United States presidential election, many communities plan to replace existing paper ballot machines with electronic voting systems. Unfortunately, the new systems open up a Pandora's box of security issues that traditional paper ballots do not face. It is difficult to understand the issues because there is a serious lack of data describing the real world performance of these systems. This problem is compounded by the fact that the major commercial vendors' products are closed, proprietary systems protected as trade secrets.

Vulnerability Analysis

Ignorance of the unique security concerns raised by electronic voting could leave US State and Federal elections open to unprecedented levels of fraud. This past April, a new online election system was used at the University of California at Berkeley. We present this system as a case study, which sheds much needed light on electronic voting security. We describe the workings of this system, and discuss the findings of our security analysis. Additionally, we crafted a man-in-the-middle attack that exploits a flaw inherent in the system architecture.

Exploitation and Demonstrations

Our talk provides a detailed technical explanation of the attack. Finally, we discuss the implications of the case study. We will show that many of our conclusions apply to the major commercial systems, in spite of tangible differences with the case study system. We will answer questions from the audience, and offer constructive ways to address some of the concerns we raise. This talk is suitable for attendees of all technical levels.

Remediation and Defensive Strategies

For a thorough understanding of our man-in-the-middle attack, we suggest that you have some programming experience and familiarity with DNS and NAT. Daniel C. Silverstein studied Computer Science at UC Berkeley. He works as a Security Engineer at a small games company in the Bay Area. He admits to harboring some disdain for those who object to the legitimate spread of information, and the growth of the public domain. Damon McCormick studied Computer Science at UC Berkeley.