Exploiting the client vulnerabilities in internet e-voting systems: Hacking helios 2.0 as an example

EVT/WOTE 2010 - 2010 Electronic Voting Technology Workshop/Workshop on Trustworthy Elections

Volumn , Issue , 2010, Pages

  Estehghari, Saghar ^a   Desmedt, Yvo ^b  

^a UNIVERSITY COLLEGE LONDON   (United Kingdom)

^b RCIS

Author keywords

[No Author keywords available]

Indexed keywords

PERSONAL COMPUTING; VOTING MACHINES; WEBSITES;

ADOBE ACROBAT; CRYPTOGRAPHIC TECHNIQUES; E-VOTING SYSTEMS; INTERNET ENVIRONMENT; SOCIAL ENGINEERING; STATE OF THE ART; VOTING SYSTEMS; WEB TECHNOLOGIES;

ELECTRONIC VOTING;

EID: 85092032247     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (44)

1. About electronic voting in Finland. http://www.vaalit.fi/sahkoinenaanestaminen/en/ yleistietoa.html.
2. The e-vote 2011-project. http://www.regjeringen.no/en/dep/krd/kampanjer/election_portal/ electronic-voting.html.
3. Implementing electronic voting in the UK. - UK Local Governmernt http://www.communities.gov.uk/archived/general-content/ localgovernment/ implementingelectronicvoting/.
4. Official State of Geneva e-voting site. http://www.geneve.ch/evoting/english/welcome.asp.
5. The International Association for Cryptologic Research (IACR), August 2009. http://www.iacr.org/elections/eVoting/presentations.html.
6. Ben Adida. Helios: Web-based Open-Audit Voting. In Paul C. van Oorschot, editor, USENIX Security Symposium, pages 335-348. USENIX Association, 2008.
7. Ben Adida. Helios Voting System Blog, August 2009. http://blog.heliosvoting.org/.
8. Ben Adida, Oliver de Marneffe, Oliver Pereira, and Jean J. Quisquater. Electing a University President using Open-Audit Voting: Analysis of real-world use of Helios. EVT/WOTE'09, Electronic Voting Technology Workshop / Workshop on Trustworthy Elections, August 2009.
9. Andrew W. Appel, Maia Ginsburg, Harri Hursti, Brian W. Kernighan, Christopher D. Richards, Gang Tan, and Penny Venetis. The new jersey voting-machine lawsuit and the avc advantage dre voting machine. EVT/WOTE'09, Electronic Voting Technology Workshop / Workshop on Trustworthy Elections, August 2009.
10. BBC News. Chaotic polling problems lead to calls for e-voting. http://news.bbc.co.uk/2/hi/technology/10102126.stm.
11. Josh Benaloh. Simple verifiable elections. In EVT'06: Proceedings of the USENIX/Accurate Electronic Voting Technology Workshop 2006 on Electronic Voting Technology Workshop, pages 5-5, Berkeley, CA, USA, 2006. USENIX Association.
12. BigPulse. Online voting software and services, August 2009. http://www.bigpulse.com/.
13. Christopher Bollyn. Death of Democracy or May the Best Hacker Win.
14. David Chaum. Surevote: technical overview. in: Proceedings of the Workshop on Trustworthy Elections (WOTE'01), August 2001. presentation slides. http://www.vote.caltech.edu/wote01/pdfs/surevote.pdf.
15. Stephen Checkoway, J. Alex Halderman, U Michigan, Ariel J. Feldman, Edward W. Felten, Brian Kantor, and Hovav Shacham. Can dres provide long-lasting security? the case of return-oriented programming and the avc advantage. EVT/WOTE'09, Electronic Voting Technology Workshop / Workshop on Trustworthy Elections, August 2009.
16. Michael Clarkson, Stephen Chong, and Andrew Myers. Civitas: A secure voting system, August 2009. http://www.cs.cornell.edu/projects/civitas/.
17. Crispin Cowan, Perry Wagle, Calton Pu, Steve Beattie, and Jonathan Walpole. Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade. DARPA Information Survivability Conference and Exposition,, 2:1119, 2000.
18. Yvo Desmedt and Saghar Estehghari. Weaknesses of Helios 3.0. In preparation.
19. Yvo Desmedt and Saghar Estehghari. Hacking Helios and Its Impact, August 2009. http://rump2009.cr.yp.to/ 1b884ce772d84af05f0f4b07bf019053. pdf.
20. Yvo Desmedt and Yair Frankel. Threshold Cryptosystems. In Gilles Brassard, editor, CRYPTO, volume 435 of Lecture Notes in Computer Science, pages 307-315. Springer, 1989.
21. Mozaill Developer Center, August 2009. https://developer.mozilla.org/en/ Extensions.
22. Digital Civil Rights in Europe. Electronic Voting Machines Eliminated In The Netherlands. http://www.edri.org/edrigram/number5. 20/e-voting-machines-netherlands.
23. Security Focus. Adobe Acrobat and Reader collab 'getIcon()' Javascript Method Remote Code Execution Vulnerability, August 2009. http://www.securityfocus.com/bid/34169/discuss.
24. Security Focus. Adobe Acrobat and Reader Multiple Arbitrary Code Execution and Security Vulnerabilities, August 2009. http://www.securityfocus.com/bid/27641/discuss.
25. Security Focus. Adobe Reader'util.printf()' Javascript Function Stack Buffer Overflow Vulnerability, August 2009. http://www.securityfocus.com/bid/30035/discuss.
26. Stefan Frei, Thomas Duebendorfer, Gunter Ollmann, and Martin May. Understanding the Web browser threat. Technical Report 288, TIK, ETH Zurich, June 2008. Presented at DefCon 16, Aug 2008, Las Vegas, USA. http://www.techzoom.net/ publications/insecurity-iceberg/ index.en.
27. Rop Gonggrijp and Willem-Jan Hengeveld. Studying the Nedap/Groenendaal ES3B voting computer: a computer security perspective. In EVT'07: Proceedings of the USENIX Workshop on Accurate Electronic Voting Technology, pages 1-1, Berkeley, CA, USA, 2007. USENIX Association.
28. Andy Greenberg. The year's most-hacked software, December 2009. http://www.forbes.com/2009/12/10/ adobe-hackers-microsoft-technology. -cio-network-software.html.
29. Stuart Haber, Josh Benaloh, and Shai Halevi. The Helios e-Voting Demo for the IACR, May 2010. http://www.iacr.org/elections/eVoting/heliosDemo.pdf.
30. Harri Hursti. Diebold TSx Evaluation: Critical Security Issues with Diebold TSx. Black Box Voting, May 2006.
31. Trusteer Inc. Flash security hole advisory trusteer, August 2009. www.trusteer.com/files/Flash_Security_Hole_Advisory.pdf.
32. Tadayoshi Kohno, Adam Stubblefield, Aviel D. Rubin, and Dan S. Wallach. Analysis of an Electronic Voting System. In IEEE Symposium on Security and Privacy, pages 27-. IEEE Computer Society, 2004.
33. Mike Ter Louw, Jin Soon Lim, and V. N. Venkatakrishnan. Extensible Web Browser Security. In Bernhard M. Hämmerli and Robin Sommer, editors, DIMVA, volume 4579 of Lecture Notes in Computer Science, pages 1-19. Springer, 2007.
34. Epp Maaten. Towards remote e-voting: Estonian case. In Electronic Voting in Europe - Technology, Law, Politics and Society, volume 47 of LNI, pages 83-100. GI, 2004. July 7th-9th 2004, Bregenz, Austria.
35. Mozilla. Mozilla's Q1 2010 Analyst Report - State of the Internet, August 2009. http://blog.mozilla.com/metrics/2010/03/31/ mozillas-q1-2010-analyst-report. -state-of-the-internet/.
36. University of Connecticut. Adder: an Internet-based Voting System, August 2009. http://cryptodrm.engr.uconn.edu/adder/.
37. Microsoft PressPass. Microsoft Statement Regarding Download.Ject Malicious Code Security Issue, August 2009. http://www.microsoft.com/presspass/press/2004/jun04/ 0625download-jectstatement.mspx.
38. Anonymous Referee.
39. Ryan Roemer, Erik Buchanan, Hovav Shacham, and Stefan Savage. Return-Oriented Programming: Systems, Languages, and Applications, 2009. In review.
40. StatOwl.com. Operating Systems Market Share, 2010. http://statowl.com/operating_system_market_share.php.
41. TrueBallot, August 2009. http://www.trueballot.com/trueballot.aspx.
42. Julian Verdurmen. Firefox extension security. Master's thesis, Radboud University Nijmegen, the Netherlands, January 2008.
43. W3Schools. Web Statistics and Trends, OS, August 2009. http://www.w3schools.com/browsers/browsers_os.asp.
44. Jun Xu, Zbigniew Kalbarczyk, Sanjay Patel, and Ravishankar K. Iyer. Architecture support for defending against buffer overflow attacks, 2002.