Policy —

Meet the e-voting machine so easy to hack, it will take your breath away

Virginia decertifies device that used weak passwords and wasn't updated in 10 years.



The AVS WINVote, made by Advanced Voting Solutions, passed necessary voting systems standards and has been used in Virginia and, until recently, in Pennsylvania and Mississippi. It used the easy-to-crack passwords of "admin," "abcde," and "shoup" to lock down its Windows administrator account, Wi-Fi network, and voting results database respectively, according to a scathing security review published Tuesday by the Virginia Information Technologies Agency. The agency conducted the audit after one Virginia precinct reported that some of the devices displayed errors that interfered with vote counting during last November's elections.

The weak passwords—which are hard-coded and can't be changed—were only one item on a long list of critical defects uncovered by the review. The Wi-Fi network the machines use is encrypted with wired equivalent privacy, an algorithm so weak that it takes as little as 10 minutes for attackers to break a network's encryption key. The shortcomings of WEP have been so well-known that it was banished in 2004 by the IEEE, the world's largest association of technical professionals. What's more, the WINVote runs a version of Windows XP Embedded that hasn't received a security patch since 2004, making it vulnerable to scores of known exploits that completely hijack the underlying machine. Making matters worse, the machine uses no firewall and exposes several important Internet ports.

"Because the WINVote devices use insecure security protocols, weak passwords, and unpatched software, the WINVote devices operate with a high level of risk," researchers with the Virginia Information Technologies Agency wrote in Tuesday's report. "The security testing by VITA proved that the vulnerabilities on the WINVote devices can allow a malicious party to compromise the confidentiality and integrity of Voting data."

Putting it to the test

To prove their claim the machine was vulnerable to real-world hacks, the auditors were able to use the remote desktop protocol to gain remote access to the voting machines. They also used readily available hacking and diagnostic software to map, access, and transfer data from default shared network locations including C$, D$, ADMIN$, and IPC$. After downloading the database that stores the results of each vote, the auditors required just 10 seconds to figure out its password was "shoup" (named after the company name that preceded Advanced Voting Solutions). The auditors were then able to copy the database, modify its contents to tamper with recorded votes, and copy it back to the voting machine.

It's hard to find plain words that convey just how bad the security of this machine is. It's even harder to fathom so many critical defects resided in a line of machines that has played a crucial role in the US' democratic system for so many years. Jeremy Epstein, a security expert specializing in e-voting, summarized the threat brilliantly in a post published Wednesday morning to the Freedom to Tinker blog. He wrote:


He went on to write:

I’ve been in the security field for 30 years, and it takes a lot to surprise me. But the VITA report really shocked me—as bad as I thought the problems were likely to be, VITA’s five-page report showed that they were far worse. And the WinVote system was so fragile that it hardly took any effort. While the report does not state how much effort went into the investigation, my estimation based on the description is that it was less than a person week.

And finally, he wrote:

So how would someone use these vulnerabilities to change an election?

  3. Connect to the voting machine over WiFi.
  5. Download the Microsoft Access database using Windows Explorer.
  9. Wait for the election results to be published.

It's good that Virginia will no longer use this machine. Still, given how long it took for the vulnerabilities to be identified, the report raises serious questions about the security of electronic voting and the certification process election officials use to determine if a given machine can be trusted.

Story updated to change "national" to "necessary" in the second paragraph.

You must to comment.

Channel Ars Technica