4 ms·

You don't have to trust them that much, though. These are all COTS components used in every other computerized system everywhere, so any backdoors the authors w

by munin 10y ago

You don't have to trust them that much, though. These are all COTS components used in every other computerized system everywhere, so any backdoors the authors want to slip in would have to impact only the voting system, and not raise anyone else's attention. That's pretty hard. How, for example, are you going to get a CPU bug to do this for you? I'm not saying it's impossible, but it's sort of like saying that we're fools for using gas-powered engines for the military. Thousands of people design them, so how do we know the designs haven't been sabotaged? You might be right, but you're probably wrong.

cyphar 10y ago
> so any backdoors the authors want to slip in would have to impact only the voting system, and not raise anyone else's attention. Except that many of the backdoors are universal backdoors, meaning that they can be remotely updated with new instructions.
- munin 10y ago
  People still look for backdoors of that type, though. Additionally, if you really made something that specific, that was only ever discovered and used to hack an election, and the only people that could have done it were the chip vendor... how do you think that will play out when it's discovered? Or do you, as the attacker, bank on no one ever discovering this, ever? If you're an engineer working for one of these places, how much do you have to get paid, or what do you have to be threatened with, to make this work out? This seems much more like a novel written by Ian Fleming, not le Carre...
  - badsock 10y ago
    First, auditing the hundreds of millions of lines of code that it takes to build an OS and userspace every election and midterm is completely unrealistic. Especially given the degree of code obfuscation that is possible. Second, at the silicon level there's billions of transistors in a CPU, silicon in general is prohibitively expensive to audit, and you can do malicious things by just putting in nigh-undetectable changes in dopant levels: https://www.schneier.com/blog/archives/2013/09/surreptitiously.html https://www.schneier.com/blog/archives/2013/09/surreptitious... Third: you don't need to hide the hack forever. You just need to gain enough power in the election that you can suppress any further investigation. Given the parade of hacks that make the HN front page every week, at all levels of government and industry, given that the well-funded and incredibly paranoid US military inadvertently deployed backdoored chips, given that existing voting machines have had demonstrable amateur-hour exploits in them: http://fortune.com/2016/11/04/voting-machine-hack-watch-video-cylance/ http://fortune.com/2016/11/04/voting-machine-hack-watch-vide... http://www.pcworld.com/article/135461/article.html http://www.pcworld.com/article/135461/article.html is it really that difficult to believe that voting machines can be hacked?
badsock 10y ago
To use your metaphor, yes if the military installed a single model of identical, network-connected engine in every vehicle they own, they would absolutely be fools. A single hack could, in a strategically critical moment, disable all motorized assets - every vehicle and generator in the US military shutting down at the same time. That's a disaster. And you don't have to put in the backdoor just for the election. You can put one in and use it opportunistically. Someone backdoored a huge amount of Juniper VPN hardware, in hopes that it might be useful some day: http://arstechnica.com/security/2016/01/juniper-drops-nsa-developed-code-following-new-backdoor-revelations/ http://arstechnica.com/security/2016/01/juniper-drops-nsa-de... And to answer your question, this is how you get silicon like a CPU to do what you want: https://www.schneier.com/blog/archives/2012/05/backdoor_found.html https://www.schneier.com/blog/archives/2012/05/backdoor_foun... These are just two examples that made the news. It's a practical certainty that there's backdoors in all sorts of COTS components that we don't know about yet. At this point there's nothing above suspicion. For the scheme in TFA to work, they need a unhackable computer. If there is a single exploit or backdoor that happens to be in it, whoever controls it can pick the US congress, the senate, and the POTUS. Not metaphorically, literally. How is taking that degree of risk, when you know that backdoors and exploits are commonplace, not incredibly foolish?

by munin 10y ago

cyphar 10y ago

> so any backdoors the authors want to slip in would have to impact only the voting system, and not raise anyone else's attention. Except that many of the backdoors are universal backdoors, meaning that they can be remotely updated with new instructions.

munin 10y ago
People still look for backdoors of that type, though. Additionally, if you really made something that specific, that was only ever discovered and used to hack an election, and the only people that could have done it were the chip vendor... how do you think that will play out when it's discovered? Or do you, as the attacker, bank on no one ever discovering this, ever? If you're an engineer working for one of these places, how much do you have to get paid, or what do you have to be threatened with, to make this work out? This seems much more like a novel written by Ian Fleming, not le Carre...
- badsock 10y ago
  First, auditing the hundreds of millions of lines of code that it takes to build an OS and userspace every election and midterm is completely unrealistic. Especially given the degree of code obfuscation that is possible. Second, at the silicon level there's billions of transistors in a CPU, silicon in general is prohibitively expensive to audit, and you can do malicious things by just putting in nigh-undetectable changes in dopant levels: https://www.schneier.com/blog/archives/2013/09/surreptitiously.html https://www.schneier.com/blog/archives/2013/09/surreptitious... Third: you don't need to hide the hack forever. You just need to gain enough power in the election that you can suppress any further investigation. Given the parade of hacks that make the HN front page every week, at all levels of government and industry, given that the well-funded and incredibly paranoid US military inadvertently deployed backdoored chips, given that existing voting machines have had demonstrable amateur-hour exploits in them: http://fortune.com/2016/11/04/voting-machine-hack-watch-video-cylance/ http://fortune.com/2016/11/04/voting-machine-hack-watch-vide... http://www.pcworld.com/article/135461/article.html http://www.pcworld.com/article/135461/article.html is it really that difficult to believe that voting machines can be hacked?

badsock 10y ago

To use your metaphor, yes if the military installed a single model of identical, network-connected engine in every vehicle they own, they would absolutely be fools. A single hack could, in a strategically critical moment, disable all motorized assets - every vehicle and generator in the US military shutting down at the same time. That's a disaster. And you don't have to put in the backdoor just for the election. You can put one in and use it opportunistically. Someone backdoored a huge amount of Juniper VPN hardware, in hopes that it might be useful some day: http://arstechnica.com/security/2016/01/juniper-drops-nsa-developed-code-following-new-backdoor-revelations/ http://arstechnica.com/security/2016/01/juniper-drops-nsa-de... And to answer your question, this is how you get silicon like a CPU to do what you want: https://www.schneier.com/blog/archives/2012/05/backdoor_found.html https://www.schneier.com/blog/archives/2012/05/backdoor_foun... These are just two examples that made the news. It's a practical certainty that there's backdoors in all sorts of COTS components that we don't know about yet. At this point there's nothing above suspicion. For the scheme in TFA to work, they need a unhackable computer. If there is a single exploit or backdoor that happens to be in it, whoever controls it can pick the US congress, the senate, and the POTUS. Not metaphorically, literally. How is taking that degree of risk, when you know that backdoors and exploits are commonplace, not incredibly foolish?