Meet the e-voting machine so easy to hack, it will take your breath away

Virginia election officials have decertified an electronic voting system after determining that it was possible for even unskilled people to surreptitiously hack into it and tamper with vote counts.

The AVS WINVote, made by Advanced Voting Solutions, passed necessary voting systems standards and has been used in Virginia and, until recently, in Pennsylvania and Mississippi. It used the easy-to-crack passwords of "admin," "abcde," and "shoup" to lock down its Windows administrator account, Wi-Fi network, and voting results database respectively, according to a scathing security review published Tuesday by the Virginia Information Technologies Agency. The agency conducted the audit after one Virginia precinct reported that some of the devices displayed errors that interfered with vote counting during last November's elections.

The weak passwords—which are hard-coded and can't be changed—were only one item on a long list of critical defects uncovered by the review. The Wi-Fi network the machines use is encrypted with wired equivalent privacy, an algorithm so weak that it takes as little as 10 minutes for attackers to break a network's encryption key. The shortcomings of WEP have been so well-known that it was banished in 2004 by the IEEE, the world's largest association of technical professionals. What's more, the WINVote runs a version of Windows XP Embedded that hasn't received a security patch since 2004, making it vulnerable to scores of known exploits that completely hijack the underlying machine. Making matters worse, the machine uses no firewall and exposes several important Internet ports.

"Because the WINVote devices use insecure security protocols, weak passwords, and unpatched software, the WINVote devices operate with a high level of risk," researchers with the Virginia Information Technologies Agency wrote in Tuesday's report. "The security testing by VITA proved that the vulnerabilities on the WINVote devices can allow a malicious party to compromise the confidentiality and integrity of Voting data."

Putting it to the test

To prove their claim the machine was vulnerable to real-world hacks, the auditors were able to use the remote desktop protocol to gain remote access to the voting machines. They also used readily available hacking and diagnostic software to map, access, and transfer data from default shared network locations including C$, D$, ADMIN$, and IPC$. After downloading the database that stores the results of each vote, the auditors required just 10 seconds to figure out its password was "shoup" (named after the company name that preceded Advanced Voting Solutions). The auditors were then able to copy the database, modify its contents to tamper with recorded votes, and copy it back to the voting machine.

It's hard to find plain words that convey just how bad the security of this machine is. It's even harder to fathom so many critical defects resided in a line of machines that has played a crucial role in the US' democratic system for so many years. Jeremy Epstein, a security expert specializing in e-voting, summarized the threat brilliantly in a post published Wednesday morning to the Freedom to Tinker blog. He wrote:

As one of my colleagues taught me, BLUF—Bottom Line Up Front. If an election was held using the AVS WinVote, and it wasn’t hacked, it was only because no one tried. The vulnerabilities were so severe, and so trivial to exploit, that anyone with even a modicum of training could have succeeded. They didn’t need to be in the polling place—within a few hundred feet (e.g., in the parking lot) is easy, and within a half mile with a rudimentary antenna built using a Pringles can. Further, there are no logs or other records that would indicate if such a thing ever happened, so if an election was hacked any time in the past, we will never know.

He went on to write:

I’ve been in the security field for 30 years, and it takes a lot to surprise me. But the VITA report really shocked me—as bad as I thought the problems were likely to be, VITA’s five-page report showed that they were far worse. And the WinVote system was so fragile that it hardly took any effort. While the report does not state how much effort went into the investigation, my estimation based on the description is that it was less than a person week.

And finally, he wrote:

So how would someone use these vulnerabilities to change an election?

1. Take your laptop to a polling place, and sit outside in the parking lot.
2. Use a free sniffer to capture the traffic, and use that to figure out the WEP password (which VITA did for us).
3. Connect to the voting machine over WiFi.
4. If asked for a password, the administrator password is “admin” (VITA provided that).
5. Download the Microsoft Access database using Windows Explorer.
6. Use a free tool to extract the hardwired key (“shoup”), which VITA also did for us.
7. Use Microsoft Access to add, delete, or change any of the votes in the database.
8. Upload the modified copy of the Microsoft Access database back to the voting machine.
9. Wait for the election results to be published.

It's good that Virginia will no longer use this machine. Still, given how long it took for the vulnerabilities to be identified, the report raises serious questions about the security of electronic voting and the certification process election officials use to determine if a given machine can be trusted.

Story updated to change "national" to "necessary" in the second paragraph.