Shocking proof: EVM can steal from itself

Computer scientists demonstrated that criminals could hack an electronic voting machine and steal votes using a malicious programming approach that had not been invented when the voting machine was designed.

The team of scientists from University of California, San Diego, the University of Michigan, and Princeton University employed “return-oriented programming” to force a Sequoia AVC Advantage electronic voting machine to turn against itself and steal votes.


“Voting machines must remain secure throughout their entire service lifetime, and this study demonstrates how a relatively new programming technique can be used to take control of a voting machine that was designed to resist takeover, but that did not anticipate this new kind of malicious programming,” said Hovav Shacham, a professor of computer science at UC San Diego’s Jacobs School of Engineering and an author on the new study presented on August 10, 2009 at the 2009 Electronic Voting Technology Workshop / Workshop on Trustworthy Elections (EVT/WOTE 2009), the premier academic forum for voting security research.


The computer scientists had no access to the machine’s source code—or any other proprietary information—when designing the demonstration attack. By using just the information that would be available to anyone who bought or stole a voting machine, the researchers addressed a common criticism made against voting security researchers: that they enjoy unrealistic access to the systems they study.


“Based on our understanding of security and computer technology, it looks like paper-based elections are the way to go. Probably the best approach would involve fast optical scanners reading paper ballots. These kinds of paper-based systems are amenable to statistical audits, which is something the election security research community is shifting to,” said Shacham.


 “If you are using electronic voting machines, you need to have a separate paper record at the very least.”


The computer scientists showed that an attacker would need just a few minutes of access to the machine the night before the election in order to take it over and steal votes the following day. The attacker introduces the demonstration attack into the machine through a cartridge with maliciously constructed contents that is inserted into an unused port in the machine. The attacker navigates the machine’s menus to trigger the vulnerability the researchers found. Now, the malicious software controls the machine. The attacker can, at this point, remove the cartridge, turn the machine’s power switch to the “off” position, and leave. Everything appears normal, but the attacker’s software is silently at work.


“We overwrote the computer’s memory and state so it does what we want it to do, but if you shut off the machine and reboot from ROM, the exploit is gone and the machine returns to its original behavior,” explained Checkoway,the scientist.


2009 Electronic Voting Technology Workshop is a two day workshop being held in Montreal .It bring together researchers from a variety of disciplines, ranging from computer science and human-computer interaction experts through political scientists, legal experts, election administrators, and voting equipment vendors.

IF the EC still feels it has got a pure machine with it, it should apply for nobel prize.

EXPERTS, COMPUTER SCIENTISTS ALL OVER THE WORLD AGREE THAT PAPER IN SOME FORM IS ABSOLUTELY NECESSARY FOR ANY CREDIBLE VOTING PROCESS. ALSO MOST OPINE LEAST USE OF COMPUTERS IN THE PROCESS.  THERE IS NO WAY AN ABSOLUTE 100% PERFECT MACHINE CAN BE FOUND IS THEIR ARGUMENT. IF THE EC OF INDIA THINKS THEY ARE A GENIUS, BETTER THAN THE REST, THEY SHOULD COME FORWARD AND EARN ONE MORE NOBEL FOR INDIA. 


OPTICAL SCAN IS SUGGESTED AS THE BEST AND SWIFT METHOD, AS OF NOW. BUT THEN HOW WILL YOU HAVE 'SCIENTIFIC' VOTING IN INDIA?


IF INDIA CLAIMS IT HAS GOT A MACHINE, WHICH THE WHOLE WORLD SAYS CAN NEVER BE MADE, WE SHOULD BE PROUD AND ARRANGE TO AWARD NOBEL PRIZE TO THE ECIL SCIENTISTS AND IMAGINE THE REVENUE WE WILL GET WHEN ALL NATIONS WILL BUY OUR MACHINES. I THINK THE EC SHOULD PRESENT IT'S PAPER TO THE NOBEL COMMITTEE.


THE LAST JOKE I HEARD FROM EC WAS IT GAVE A WEEK TIME FOR ANYONE TO PROVE IT AS GUILTY AND IN THE END OF THE WEEK PROCLAIMED ITSELF AS NOT GUILTY. IMAGINE IF KASAB GIVES INDIA A WEEK FROM NOW TO PROVE HIM GUILTY, FAILING WHICH HE SHOULD GET A IST CLASS TICKET TO ISLAMABAD, HOW MANY TAKERS ARE THERE IN INDIA?