There and Back Again

The talk recounts how a small forensics team came to examine a Dominion voting system from Puerto Rico after a federal request. They imaged the election management system and several machines, then worked in a conservative threat model: a skilled attacker with access to the local network, not an insider or stolen keys. Much of the effort went into decrypting and deobfuscating self-modifying binaries, and the team had to set aside earlier material with broken chain of custody.

The findings cover four areas. LTE modems were active during operation, so the system was not air-gapped. Passwords were reused, weak or hard-coded, and audit databases shared the attack surface of the main system. Cryptography showed weak entropy, IV reuse, hard-coded material and cleartext key handling. At least twelve high or critical CVEs affected commercial components, with patches available before certification, and the code relied on obfuscation and stored credentials in plain text. The speakers say they found no evidence that votes were altered, but they also could not rule out exploitation with the data they had.

The recommendations push for a constrained, immutable and air-gapped appliance, open source code with reproducible builds and published hashes, and append-only audit logs. They argue that certification should test deployed configurations and real cryptographic use, not only FIPS-validated modules, and that independent risk-limiting audits against paper records are needed. The talk closes by announcing a nonprofit effort to fund open review of voting software.