buna ziua bucharest buna ziua romania
she buna ziua mama ok everybody
so let's get started my talk is the
election system can we fix it yes we can
solutions to improve the election system
with yours truly be a scilab so Who am I
I'm a 12 year old girl I was a younger
speaker at Hope hackers on planet earth
which is one of the oldest hacker
conferences I am now a three times
speaker at Def Con I spoke at the voting
village the bio hacking village and the
Ruth asylum I am a maker and a hacker
and my election hacking from the roots
asylum was highlighted at a
congressional hearing on election
security here is me with the witness
panel while this talk will be focused on
the u.s. election system the lessons
learned here can apply to any election
system worldwide so what did the roots
Asylum do they held a mock election
reporting system and us kids got to
perform sequel injection to change the
results what is sequel injection you may
ask here is part of my girls who hacked
course on sequel injection
dun-da-da-da the application in this
case a webform that talks to the
database is tricked into sending an
attack query so here is the classic
username and password field now here is
a simple attack or one equals one is
true so this is the code sequel equals
select from users where name equals you
name and pass equals you pass
so it's requesting a username and a
password and let's say Alice wants to
attack the
website because I mean why not so she
puts in Alice double-quote or one equals
one
they user name field and then Alice pass
or double quote or one equals one in the
past field so then this command in
orange gets sent to the database select
from users where name equals you name
where you name equals Alice or one
equals one and pass equals Alice pass or
one equals one does one equal one yes
okay good
you passed the test
you all greet graduated from preschool
yay
goldstar stickers for everyone and then
the sequel above is valid and will turn
all rows from the user and past table
since or one equals one is always true
back to my talk sequel injection like I
said the kids and I and the roots column
did this attack last year and this year
you're thinking big deal it was rigged
for the kids but Russia use the same
sequel injection attack and successfully
broke into a State Board of Elections
website where they gained access to the
voter records and exfiltrated them they
were then able to pivot into the network
and who knows what happened after that
this is outlined in Volume one on pages
50 and 51 of the Mueller report if you
don't believe me now let's start what
the election system the election system
has a huge attack surface over 10,000
voting precincts voter registration
databases voting machines reporting
systems and of course election officials
as dr. Latanya Sweeney said at the
hearing on voting technology
vulnerabilities every step introduces a
vulnerability and I agree with you
and let me just say they're problems
everywhere most states lack the
resources and technical expertise and
let's face it they are election
officials not computer security experts
if not we wouldn't be in this situation
they have aging equipment many of the
voting machines that have been pawned at
the voting village at DEFCON are still
in use in many districts they have a
lack of consistent funding for security
a lot of the voting security money comes
in a lump sum
this is fixes problems now but not in
the future states need consistent voting
security budgets attacked by foreign
adversaries with endless time and money
versus the underfunded state and local
election websites or Stephen Frank have
to secure them along with all the other
sites and help Bob print out his emails
who do you think will win in that
situation then NIST's election security
research team consists of one full-time
for part-time and four contractors there
are more people working at a single
McDonald's and they are working on
election security people like really so
let's jump into more problems and how to
solve them this is me at the
Pennsylvania voting machine review where
we are allowed to examine the machines
all we wanted either of them crazy this
simple to pick lock covers the USB ports
that contain the votes and the software
update port so wow I mean look at that
now for all of you wondering how the
u.s. election system works here is a
brief overview SEP number one voters
must register to vote it's not automatic
because that would actually make sense
we want to make the election system as
complicated as we can right then you
cast your vote
it's done at your local voting precinct
not the one by your work it has to be by
your house so you've got to wake up
early go vote and then go to work and
yes it is not a national holiday it's
still a work day then the voter is
identity is verified and then your vote
is cast the voting machines differ from
precinct to precinct then the votes are
tabulated at a local ven state level in
the presidential election the Electoral
College decides the president this keeps
the larger states from having too much
power and as January generally based on
the state's popular vote the Electoral
College can be talking itself but I'm
just keeping it short for you guys okay
so here are some voting a sack of voting
machines at the vote waiting village duh
a DEFCON I'm pretty sure this was
actually the first of first voting
village at DEFCON two now voter
registration systems they differ from
state to state some have standalone
systems while other tie in with their
Department of Motor Vehicles driver's
registration system everyone including
bad guys nation states and groups trying
to upset democracy is trying to hack
these systems all the time if you
monitor an intrusion detection system
which is a machine that examines all the
network traffic you will see constant
attacks like sequel injection cross-site
scripting and other exploits from all
over the world including Russia China as
well as tor exit notes okay now there's
something really important that I want
you all to listen if you're on your
phones pay attention don't pick your
nose and listen to this the scary thing
is election officials are not required
to report any detected compromises or
vulnerabilities in these systems
if the election was hacked we wouldn't
know maybe they know but there they
don't have to tell us so how do we fix
this
while voter registration systems are
things we actually know how to secure
website and database security is
something we know one have security
standards for so let's use some
guidelines number one there is OS wasp
or the open web application security
project they have tons of resources too
many to list here the NIST cybersecurity
framework provides a way to identify
protect and detect any compromises then
there is open SCAP or security content
automation protocol that supports
automated configuration vulnerability
patch checking and security measurement
then my personal favorite the SAFE Act
which is still currently sitting in
Congress but I hope I really hope it
becomes a thing
so here's more on the safe fact the SAFE
Act requires many important things
including voter verified paper ballots
these are important because the voter
actually verifies their vote and then
there is an analogue paper trail so you
can check with a physical piece of paper
there are risk limiting audits
that's where votes are counted by humans
to make sure the machines are accurate
and using risk limiting audits and voter
verified paper ballots are best defense
against election tampering then you've
built your reporting system now what
test it first make sure it actually
works because that's kind of important
then have your team test it make sure
you cover the basics like the top ten
and fix the bugs don't waste your budget
on having professionals come in just to
tell you what could you could have found
out by yourself next step
test it with hackers make sure it is
fully tested before you bring in an
external pen testing team they will find
things that you never thought of if you
are thinking that the systems out there
secure well let me tell you they are not
hackers have found siegel injection
working on a state site just recently
like two weeks ago states need to have a
bug bounty or at very least a clear
channel for reporting vulnerabilities
if registered to vote
now what hacking the voting machines oh
wait sorry just the voting machines
themselves voting machines you would
think the US would have a thriving
voting machine industry unfortunately
this is not true if you want to make a
voting machine you need to make the
entire system everything from the voter
registration system the voting machine
then the tabulator and reporting system
this is why 80% of the u.s. voting
machines are made by two manufacturers
yes in US and Dominion yes in us by
global election systems which became
Diebold oh they're so insecure as you'll
see soon yes and a senior programmer and
VP was convicted of computer software
tampering and embezzlement in 2004 they
performed an emergency software patch in
37 swing states these are key states
that could swing the election one way or
the other I wonder why they only did it
in the swing states something's fishy
there then Georgia and Tennessee have
reported machines losing votes in
predominantly african-american
neighborhoods now that just doesn't
sound right these manufacturers keep
their source close and will threaten to
sue people if they try to examine their
software the daibul gems tabulator was
found
lowering vote counts it's not
that hard people vote gets vote plus one
or for my C fans out there vote plus
plus many machines and tabulators have
hidden back doors that allow votes to be
manipulated during the election now
let's talk about direct recording
systems direct recording systems are
voting machines that do not produce a
human readable paper trail these
machines cannot not be made secure so
please follow my advice and don't use
them as was proven every year at Def Con
voting village the vote count can be
undetectably manipulated these types of
machines are used in many countries
around the world including Brazil who
wants to guess who made the machines in
Brazil Diebold yay not really you know
what I would trust more than a direct
recording system yeah now paper ballots
another way to collect votes is with
paper ballots there are two types number
one hand marked paper ballots this is
the best most secure option these are
marked by the voter themselves scanned
with an electronic scanner or counted by
hand then ballot marking devices these
were originally made for the handicapped
voters but what demand for public for
paper ballots the voting machine
manufacturers saw an opportunity to sell
more expensive BMDs as paper ballots
there are a few problems with these
machines if the human flips here if the
machine flips your vote what do they do
was a human error or a machine error
some machines print a barcode as a paper
trail how do you know what it says
fat bar skinny
fat bar fat bar skinny bar this just in
BMD suck some new machines take up to 10
minutes to switch screens while voting
10 minutes if there's a long line you
just want to jump right out texas
machines unable to read RFID voter card
causing massive delays again people want
to get out of the line and go to work
brand new SNS machines reporting zero
Democrat votes on printout but then once
they do a hand cow it reveals that
Democrats won hmm this just in do your
ease sock Virginia change to hand marked
paper ballots and the Democrats won for
the first time in twenty years
something's wrong there too so now let's
[Music]
the Accu vote is a direct recording
system some of them have a printer so
that the voter can verify their vote
some don't in 2007 one year after I was
born the source code was reviewed by
state of California and they found it
was susceptible to viruses that could
alter the vote count my friends over at
the hacker house were able to load their
own phone firmware into the machine and
could do this hacker house 2020 election
fixing software hack toy injecting new
United States President CDC loading
operating system rigging election they
were also able to do this and what does
every hardware hacker ask can you play
Doom on it yes yes you can
[Applause]
now I have a question for all of you
where are your voting machines stored
right meow well if you live in the US
where are your voting machines right now
say you don't know how I live they are
stored in cold storage so how well are
they secured while in cold storage hey
Bob
where are the spare traffic cones oh you
know by the voting machines where I eat
my lunch and get this they protected it
with one thing no one can get past
caution tape everybody those caution
tape back away back to cold storage bad
actors can purchase machines off the
internet
reverse the software and the firmware
then install the hack software and
firmware on machines and cold storage
while these machines may have
tamper-evident seals they really are not
that tamper evident here is me at DEFCON
25 removing tamper-evident tape with
acetone that's also known as fingernail
polish for all of you out there I was
then able to reapply with no noticeable
difference all you need is a syringe
some nail polish remover get a little in
the syringe and a little at a time on
the seal you squirt a little it comes
out it's still sticky you manipulate the
voting machine in the box then you tape
it back again and you go eat lunch boo
so what can we do to secure voting
machines in cold storage well we can
invest in more secure storage monitored
security systems and cameras complex
locks and booby traps
okay maybe not booby traps wink another
way to help secure voting machines is to
reinstall the software and firmware
before the election making sure to
softer fingerprints and checksums before
installing doing this will not only
ensure the latest patch software is
running it will also wipe out any
malicious code that may have been
installed it's a two-for-one deal so
where does your vote go next different
election systems have different ways to
delivering the final vote count votes
are printed out in triplicate checked
and signed by poll workers these are
then phoned in in sent by car to the
election office USB sticks by car is
that data file encrypted if not it can
be manipulated some machines report
their counts by cellular data
transmission this still goes over the
public Internet but we all know how
secure the Internet is right yeah it is
also worth stating that there is no
established chain of custody rules for
any of these delivery methods so how do
you secure in transit
well you encrypt the records while being
transmitted and while at rest you
perform with risk limiting audits make
sure the paper ballots match what the
machine recorded and please do not use
the public Internet the machine
manufacturers want you to think that
cellular modems are not connected to the
public Internet guess what they are here
is a diagram the manufacturers could
learn from this is me
that's the voting machine over there on
the Left transmitting over the air with
its cellular modem to the cell tower
that's connected to the public Internet
where my friend Rainbow Dash is taking a
nap then the voting tabulator is
connected to the internet behind a
firewall but firewalls do not stop
hackers
now the next step the next step is the
vote count reporting systems these just
like the voter registration systems are
standard things we know how to secure
and again like registration systems we
should follow industry standards and
guidelines I recycle this slide I'm
going green remember wasp NIST opens gap
safe and remember encrypt data in
transmission and while at rest now
humans they have so many flaws that's
why I like cats better and let's face it
all the security in the world can't stop
Bob from clicking on a link you
shouldn't yeah really Bob come on you
can do better than that
spear phishing campaigns exist and have
been successful against voting machine
manufacturers using fake emails they can
direct to users to fake websites that
compromised their machines mr. Kelly who
is Registrar of Voters at Orange County
California sit at the hearing how well
are my election officials trained not to
click on links they shouldn't chances
are not well enough sorry mr. Kelly now
social engineering election officials
must be regularly trained on how not to
be socially engineered regular training
is very important not just during the
election season now fix the humans stage
should form election working groups with
local federal and state officials
including the Department of Homeland
Security the FBI as well as the state
Cyber Command this knowledge should be
shared across the entire state so you're
like yeah yeah all these problems all
these solutions what's the big fix
well we need to look at the election
system as a very hackable security
problem from the start
security can't be something we just bolt
on on the end the election system is one
big hardware and software system so we
need to train our developers and
engineers teach them secure coding from
the start
teach them how to hack and think like a
hacker so that they can better code
systems that are more difficult to
compromise send them to security
conferences and hire hackers they bring
a different perspective they think
around outside and destroy the box I
hope I woke up any of you who are
sleeping there are security minded
individuals to whom everything is a
secure puzzle just waiting to be solved
it's right there also don't be afraid to
hire hackers without certifications kids
right out of school too they bring they
will bring an excitement and desire to
prove themselves beyond expectations so
what is the best system hand marked
paper ballots I made this really big so
you can take a picture and if you're not
taking a picture you better you better
memorize this okay okay
and with risk limiting audits I'll give
you guys a second to take a picture
[Applause]
okay everyone I have a big announcement
to make
next year at Def Con I will have
drumroll please my own election system
[Applause]
in a quick shout-out to one Dark One for
making this amazing logo my election
system that I'm making myself will be
called secure open vote and this awesome
logo has the SS unlock the circle as the
oh and the checkmark as a V secure open
bow cool right so what will secure open
vote be well secure open vote is an open
source voting system used with hand
marked paper ballots cuz that's the
safest type my goal is to have a
complete end-to-end system I figure I
have the smartest hacker friends we
could probably make a pretty awesome
election system I hope to have parts of
it available at Def Con for the hackers
to try to hack now what are your
questions
that was absolutely awesome we can take
about three to five questions defending
gun just make it you know quick and keep
it short in the suite so we can fit in
more of you please keep your hands up
until Mike gets to you so we can see
where you are put your hand up and it
would also help if you stood up while
you were talking so I can actually see
where you are and so they know who to
give the mic to okay so if you have the
mic stand up stand up whoever has a mic
I hope no one stole it and it's running
off when I did their back oh hello hello
thanks for the presentation BIA my
question is related to Romania because
we have paper ballots here but we also
have a problem where people stand in
line to vote especially people who are
outside of the country and have to vote
in consulates and places like that so
they are considering introducing
electronic voting and obviously I guess
no one here would trust the government
to implement something like that so what
would you tell the Romanian officials
who are considering introducing
electronic voting which you have in the
West for a long time thank you paper
ballots are amazing I think they should
stick with paper ballots please do not
change to our chronic voting machines
those are super hard to secure the
elections can be tampered with so please
say two paper ballots and to solve that
problem I don't I'm not sure if it is
already but if it isn't then make it a
national holiday I think it should be
everywhere yeah and it I don't know how
many days they are allowed to vote Dana
mom because you're Romanian you know
well if you have like three days maybe
it could be more days than that so
people have more time to vote more
places to vote maybe or a bigger space a
bigger precinct a little space to vote
with more
Sheens so yeah I hope that answers your
question awesome let's go to the next
one please stand up make yourselves show
thank you for presentation I'm really
amazed that you are so young and you've
done this and the question that I have
is that what is the most important
advice that you can give to the young
girls out there who want to start the
career in cyber security or hacking I
say just go for it if you don't know
where to start there are a lot of
resources on this amazing thing called
the Internet and if it's a girl wanting
to learn cybersecurity and hacking I a
couple months ago I just started girls
who hack on my t-shirt it says girls who
hack is their motto is teaching girls
the skills of hacking so that they can
change they're the future
it gives free lessons to on my website
girls who hack com2 any girl who wants
to learn cyber security and hacking an
awesome keep that in mind okay two more
questions we have one in the back there
oh we have some one here and then we'll
come to your promise thank you very much
for your talk can you move the mic
closer tear it it's okay thank you very
much for your talk and I'm wondering if
there are any regulations because the
voting system from the yes looks like
inherently insecure and we're icarus
because it's the voting democracy and I
would expect to have really strong
regulations in this area exactly they
actually don't really have any
guidelines pretty much at all so like I
said on two slides guidelines exist
let's use them I hope the SAFE Act
passes in Congress and it becomes a
thing because it sounds super awesome
if we all change to hand marked paper
ballots and have the it be a national
holiday with risk limiting audits I'm
pretty sure we can secure way better
than it is
thank you so one last question I know we
have someone there please give the
gentleman a mic he's been keep your
hands up yes yes we can do it yes that's
teamwork
teamwork makes the dream work very
interesting presentation congrats for
that and very interesting subject
Bianca one very quick question what is
your IQ I've never taken a test but I'm
hoping it's really high but your IQ
isn't what your IQ is it's about how you
feel like you could even be 70 years old
and super smart or five years old and
super smart it's about how you feel and
what you think you know that really
matters same with how young you feel you
can be 80 and still like doing the hula
and what not
thank you so much Viet was so awesome to
have you here on stage with us and I
hope this is only the first time and
definitely not the less so thank you
again thank you
[Applause]