We Pwn Your Phone, We Pwn Your Vote (Demo and Panel)

This closing-day Voting Village session paired a live demonstration with a panel on internet voting. The argument: voting software is only one layer of the attack surface, and the mobile operating system beneath it is equally exposed to state-level attackers. The presenter ran a chain built from 39 patched iOS vulnerabilities against an older device. It moved from a compromised web page through several sandbox escapes, one bypassing pointer authentication, to root access. It then gathered keychain items, cloud tokens, Wi-Fi passwords and messaging databases and sent them to a command server. A race condition slowed the run, so the full collection was not finished on stage.

The panel argued that a flawless voting app cannot be trusted on a compromised phone, since the platform can alter what voters see and record what they do. Code voting would not reliably prevent this, and a platform attacker could block access to a voting site. Speakers also noted that end-to-end verifiable schemes still rely on trusted components, and that dispute resolution after a detected problem is poorly defined. Many states already allow emailed or faxed ballots for overseas voters, which face similar risks.

The takeaway is that voting security is a systems problem spanning device, network and servers. Anyone assessing remote or mobile voting should model the platform as part of the threat, and be skeptical of claims that device security is solved.