welcome to this virtual voting village
talk
vulnerability disclosures for voting
systems a deep dive into vulnerable
disclosure programs among the most
popular
voting system vendors thanks for coming
i wish i could be there in vegas with
you but alas
uh the coveted weather is is just too
severe so
couldn't make it this year next year for
sure right so yeah i'm todd beardsley i
am the director of research at rapid7
and i deal with vulnerability disclosure
pretty regularly and i also
incidentally care about election
security and election integrity
uh and because of that i'm also an
election judge here in
in travis county texas if you want to
find me
or look up my stuff you a
great starting point is uh keybase.i o
slash todd b
all my twitters and all my stuff is
there so check it out there
but enough about me on to the voting
machines that we're all
interested in hacking i guess
all right i'm up in the corner now um
i'll be here for most of the
presentation just to stay out of your
way
uh first off let's blast through some
terms that i
am likely to use all of the time they
are
coordinated vulnerable disclosure or cbd
this is the process by which i typically
disclose vulnerabilities typically it
starts with
a researcher almost always who is not me
occasionally i do my own bones but
mostly these days i help other other
people disclose vulnerabilities
and this for me like this is all about
getting the vendor and the researcher
and you know any other interested
parties maybe a regulatory agency or
somebody like that
all on the same page all ready to go all
agreeing on what the vulnerability is
severity
descriptions mitigations fixes all that
stuff that whole thing from beginning to
end
from discovery to eventual public
disclosure that's
cbd so if i see say cbd that's what i
mean
uh also i use another acronym vdp a
vulnerability
disclosure program a vulnerability
disclosure program
is pretty much in my opinion it is
pretty much anything
where you are a vendor of software
which is to say all companies and all in
most organizations
uh you have some kind of software
product um
it might be embedded it might be a
typical app
on a phone it might be a typical program
it might be server side it might be
your website it might be your back end
it might be anything right
basically what we're looking for in a
vdp is
some way to contact you and let you know
about this vulnerability
i don't super care like about the
details of it just
if you have a vdp great and you're in
you're in rare company if you do and
then finally
we have bug bounty programs i talk about
a little bit nobody calls them
bbs this is something we don't acronym i
don't know why but a bug browning
program
is is basically like a vdp except
there's
usually money involved
not always sometimes it's just like for
like kudos
and karma or whatever
almost always there's some kind of more
formal nda in place
usually restricting uh the the reporter
of the vulnerability from
from talking about it until the the
receiver the bug bounty
runner um does a thing either they fix
it
um okay very occasionally they um
i would say occasionally not very
occasionally anymore occasionally they
have
uh like a timeout procedure so if so
much time has passed then you're free to
publish
um but but yeah so that is the deal
uh with bug bounties
so um actually finding vdps in the wild
um
is not terribly hard uh you know i look
at a few things i look at bug crowd
hacker one and disclose io i bring up
bug crowd and hacker one because they're
bug bounding programs and it's in
their interest to to really let you know
that such and such a company has a bug
bounty program which is a
you know a species of vdp it's not the
only kind of vdp but it's a species of
it
disclose io and bug crowd are like this
and
disclose runs a pretty nice
community sorted
directory of vulnerability disclosure
programs right
i also look for the security.txt file
that
should be on a given company's or
product even
websites so like let's say you work at
acme corp
um and your website is acmecorp.com
you would have a security.text in acme
torque
acmecorp.com dot well dash
known slash security.tax you can learn a
lot about this
at securitytechs.org it is a great way
to
tell people and it's like um well
let me back up it's a great way to tell
people about your vulnerability
disclosure program
what the policy is who to contact a ptp
key languages all kind of stuff can go
in there
but the minimum is like some kind of
contact information
i look for that basically second these
days i'm usually disappointed
sometimes i come across one um and then
finally
if those don't pan out i google to work
around right for
vulnerability for the word disclosure
for the word security and whatever the
organization or the product name is
typically if these if all of these fail
this tends to succeed
um you know it's a very jargony sort of
business we're in with vulnerability
disclosure so
these words all together uh almost
always first page
great seo right um so if you are running
one
and people don't know where it is make
sure that this google door works and and
people will find it
um if all of this fails i kind of have
to assume that
you don't have a vulnerability
disclosure program that might not be
true
um you know and there's certainly other
ways to have
to advertise vdps um but if
if it's not one of these like five
things basically
uh it is effectively invisible to
uh certainly me and i would say most
uh most people who are in the business
of vulnerability disclosure
in my business i mean charity almost
always um
you know bug bounty programs are a
little bit special and they tend to have
their own thing but again like
and it's totally possible to run a bug
binding program without bug crowd or
heck of one for sure
um but if you're running your own
homegrown bug bounty program and you're
not hitting that google door or not
hitting that secure that text
this is an easy easy problem to solve
so let's take a look at the fortune 500
just for context um this is not
uh you know none of these uh voting
system manufacturers are in the fortune
500
but we can take a look at the fortune
500 and see what's going
on there like kind of just a level set
like how common are vdps out in the the
real world you know this is the world of
uh name brands um you know the most
successful
and highest revenue companies uh lots of
tech companies lots of manufacturing
companies lots of everything right
uh in the fortune 500. um back in march
uh i ran around and counted all of these
uh using exactly that methodology i just
i just talked about uh and you can read
that report if you like um it's it's
on rapid7 if just do like rapid seven
icer uh you'll find it's the industry
cyber exposure report
uh and uh if this were in person i would
ask for people to guess
how many of the fortune 500 have a vdp
and then i would chortle and say you're
wrong because it's actually this many
um it's just about 20 almost 100
of the fortune 500 have a vdp now
they're not all in the top 100.
top 100 is overrepresented um fortune
100 has about 40
of these and then the rest are kind of
scattered throughout um the the
remaining 400
but that like gives us an idea of like
well how common are these right
uh and i will say that on a given very
successful company
um about 20 percent have an active
findable vdp today
so how do i pick uh voting machines um
or i'm sorry voting system manufacturers
well i look at
the eac or the u.s election assistance
commission
they run a program that certifies
vendors in this space and
one quick caveat before i talk about
those
not every vendor is certified by the eac
and
uh not every eac
um certified uh
vendor is in any of the all of the
states right
um or in by state i mean locality
so which ones are they um well they're
these ones there's avante
clear ballot dominion voting ess esns
heart interactive microvote smartmatic
unison
and votingworks those are the nine
vendors
uh that are part that that participate
with the
eac get their stuff certified um there's
mountains of documentation on the eac
and this is not an eac
talk so i'll just go by there i'll just
stop there but like these are the nine
companies that i'm looking at
um to see like who has vulnerability
disclosure program
um and as i mentioned before a quick
caveat
um this is where any of these companies
operate um today and by today i mean i
think this
uh survey was for the last election the
2020
um presidential election uh so
you can see that like not even every
like there are a few states where it's
100 eac certified voting machines um
some states have none uh some of them
are rather large like california and new
york and florida
um all of the um
decision making on what voting systems a
given
locality uses that tends to evolve down
to the county
um but if you're in the voting village
you probably know that so moving on
uh from there so
among the vdps who which are eac
certified
uh how many of them have some kind of
vdp how many of them
are welcoming of vulnerability
information on their products that are
installed and people
cast votes on or are used to tabulate
votes or anything like that any election
system
kind of deal what do you think
well you are right some of you
it is better than the fortune 500 it is
about 55 or 509 uh have
some kind of vdp so uh good job good job
guys
uh we're doing better uh than than we
were
even even a year ago most of these are
very new
and so just to remind you 55 percent of
voting system manufacturers have a vdp
about 20 percent of the fortune 500 have
a vdp
and so that is that is better uh it is
it is greater than so
good job guys um so for the for the next
section i want to like kind of dive this
is the deep dive part
um i want to dive deep onto these uh vdp
so i read all of them so you don't have
to
um and first and foremost let's just
knock out the ones that don't have
any vdp at all that is avante microvote
smartmatic and votingworks
guys get on the stick there but of the
rest all of these
the rest of these do have some kind of
vdp but not all vdps are
created equal right um of those that
have a vdp
uh some of them don't actually cover the
voting machines
and customer implementations so that
knocks out heart inner civic
and unison so if you
recall from from last year at black hat
and and defcon time
i know that some of these vendors said
like yes we have a vdp and we are
anxious to work with uh researchers uh
well not so fast
um these two companies in particular
heart inner civic and
unison their vulnerability disclosure
program only covers their own website
and so great that they have one
but not so great that they they they
have a written policy that says that
their
voting machines and any like customer
implementation implementations are off
limits which is
weird it's kind of not a vdp anymore but
hey you have a vdp so wonderful
of those that have a vdp that do cover
customer implementations
who has a safe harbor policy well it's
not clear ballot
clear about is a little weird they do
have a place to report vulnerabilities
they publish an email address and they
talk about their security a lot
but they don't actually seem to have any
written policy at least i couldn't find
one and if you know somebody clear about
it
reach out to me i'd love to be able to
find it
it is if it exists it's invisible so
you're welcome to report vulnerability
to them but it's like unclear
how they'll take it uh which is which is
fine right
um i'm glad they have some way of doing
it i guess
so esns and dominion
are the only two eac certified voting
system manufacturers that actually offer
a clear unambiguous safe harbor for
researchers and hackers
in their vulnerability closure program
so yay congratulations guys you did it
um es and s and dominion i do believe
their heart is in the right place
they're a pretty great place to report
vulnerabilities incidentally between
es and s and dominion you're looking at
most of the voting machines in america
including
in those areas that you know aren't
required to have
eac certified voting machines they still
use them
they may be like back a rev or they may
just use them and not bother to tell the
eic because you know
hands off my local government you big
federal nasties
or whatever reason right so it's
certainly possible to run into
a voting system from one of the other
these companies
in a locality that that eac doesn't know
about
so if you find vulnerabilities there you
are it's smooth sailing
um good job and let them know because
they want to hear about it
um but of all the other companies don't
give up you know if you find
if you're a researcher or a hacker or an
academic
and you find some kind of vulnerability
involving one of these systems
i mean it doesn't hurt to try i wouldn't
say just sit on it
because that doesn't help anyone right
um and so
uh this uh you know this is this is my
opinion anyway
um some people are our real sketch
about uh trying to report
vulnerabilities to a place that doesn't
have a
clear and concise and unambiguous
safe harbor provision for for hackers um
so
these companies are less likely to get
decent vulnerability intelligence from
you know good samaritans out on the
internet um than es and s
and and dominion um but it doesn't mean
that you have to be that way right like
it is
of of course it's our all up to your own
risk tolerance
very similar to traveling to las vegas
during covet um
it's up to you and it's up to like how
you deal with it
um but basically like if you have a
vulnerability on
a voting system manufacturer that's not
on that list
or which is on that list but their terms
are like real restrictive
uh or they might be on the list like you
found an issue but you're not super sure
what it's for
like maybe you found some kind of sql
injection bug and some
you know in like an e poll book that's
online or something like that right like
it's not directly a vote it's not like a
voting machine compromise but it's a
back-end system compromise or like a
maybe a military or a front-end
for some county like and it may be run
by one of these companies these
companies don't just produce
voting machines as you know they often
do the end-to-end
management of of the voting machines the
ballot box the e-poll books the
collection all of the stuff right um
they may be all up in that
in that business if you find a
vulnerability
in a candidate's website or in something
in their infrastructure or in their
campaign
um what do you do um or if it's like in
a
general political party issue like as we
all know
political parties are not immune to to
hackery and are not
certainly not immune to like not
patching something
so if it's a political party or pack
what do you do well
i'm here to tell you uh there's a one
stop shop these days
uh i used to have a long complicated
answer for this but now i have a very
short and terse answer and it's scissor
is pronounced not like pizza by the way
uh but it's as a
cyber security and infrastructure
security agencies
so secure the name did twice was secure
i would say that like in all cases if
you
see something say something um cesa is
generally pretty good about this uh they
have some really talented people there
still
um and continue to be like
pretty responsive um if you
uh yeah so if you're not comfortable
with uh interacting with cizza for
whatever reason
you should know that as far as i know
they've never gone after anyone they've
never they never hassled anybody they've
never
like turned around and you know ratted
anybody out to the doj or anything like
that
they've always been on the up and up and
they are sincere
in wanting to know about your
vulnerabilities to fix them
and they are specifically excluded um
this whole vulnerability intelligence
gathering
function that they have they're excluded
from the uh vulnerability equities
program if you've heard of that
and are worried about that they're
excluded from that so
uh spooks and spies will not use your
vulnerability in the meantime
um you know unless they're doing
something like super duper illegal like
spying on scissors which
that never happens right um there's
there's no such thing
as interagency conflict um but they're
they're a great backstop for basically
anything related to civilian government
um including these issues so
uh i urge you uh get in touch with sizza
um and and they will they will take care
of you if you have a bad experience this
is let me know and i will
i will i don't know be your champion and
your white knight i guess
um i just wanted to take a moment
uh to talk about the r words and that is
reasonable
or responsible disclosure i try to use
reasonable exp
disclosure as a as a term but it's just
not it's just not taking off
um but let's talk a little just a little
bit about responsibility now that we've
talked about like who has a vdp
maybe you run into a situation where
you're not comfortable with the vdp or
you
don't find a vdp or something like that
what do you do then right
um uh so the the rest of this talk and
it's i'm almost at the end here because
these are
these are all real short talks um
restless talk is just pro tips uh just a
couple grab bag of pro tips
uh so first off uh timing considerations
um
nobody does anything with a deadline if
you report a vulnerability and don't
say you're gonna do something in a
certain amount of time
i guarantee you no one will do anything
with it
they will they may reply they may say oh
thank you for the thing and you'll never
hear from them again
in my experience in disclosing a few
hundred vulnerabilities
being upfront with that deadline is
everything um what's extra great is
being able to tell people like hey i
found a vulnerability
i would love to publish this buy the
next conference whatever that conference
is you can make it up
you can lie it's fine but just pick a
security conference off the calendar
that's like a couple months ahead you
know
um and uh and and do that right
um provide them with regular reminders
that this deadline is approaching and
you have to do the thing
um you know if you want to say a
conference or a cfp or just say a date
um or if you say or if like you work at
a company or whatever and you want to
publish these things on your company's
blog like i do all the time
[Music]
you know let them know you don't have to
be a jerk about it you don't have to say
like hey
i haven't heard from you in like six
hours and what's the deal here
like you should know that like
vulnerability disclosure from the
receiving end is usually a pretty
emotional event
um so anything like i strongly urge you
to go hang out with
the social engineering folks over in
social engineering land
and learn how to make people believe
that you're on their side
i guess is the best way to put it but
yeah you don't have to be a jerk about
it
allow for extensions on your deadline um
if you have a deadline in mind
um know that things happen and sometimes
deadlines slip
um so if you're using the conference
excuse super um
you know that that is i think i think
okay
nobody cares about your conference by
the way you care about it uh they
definitely do not
um so if you blow through it then you
have mechanisms you know of disclosing
without specifically naming the vendor
and you can you can give that up right
and say like well listen i'm going to
publish
some details but i won't say your name
and i won't say who it is and i'll black
out all your logos and then they'll
they'll
feel they'll feel cared for if you do
something like that
and uh i don't know how to do it anyway
but try not to notice these buttons
right before or right after an election
um
because of reasons um since 2016
uh the general public is
[Music]
aware of us and aware of our activities
here and so
if you go to the news and say like hey i
know about a
vulnerability in you know dominion or
ess or whoever um and you disclose that
like two or three days before an
election you're causing a bunch of chaos
now maybe that's your maybe that's what
you want to do maybe that's your thing
um not my thing but maybe that's your
thing i strongly urge you uh to
not do that if you want like the best
time to disclose bugs is like today
right now
we are a year before the next um
congressional national congressional
elections there's almost always an
election going on
usually two or three times a year in
most localities there's uh there's an
election
um but then you know you've got headline
elections too so
uh be sensitive about that please and
you don't have to cause a huge
huge tussle uh over your vaults
um just as inside uh these three
companies
uh do you have edps and they state uh
in no uncertain terms the kinds of
deadlines they expect
um which is great it's good for you like
you know now and you can and that
actually gives you a huge amount of
ammunition because you can tell these
companies like hey man you said 120 days
so
that's coming up um and you know
they will still
[Music]
somewhat regularly ask for some
extension because of something
there's like a whole recertification
process there's a bunch of things that
go into these things right so
um with voting systems in particular um
expect definitely expect like a response
pretty quick but
like an ultimate fix maybe a little ways
out um
i do think that like opening with like
45 days or 60 days or 90 days
is a pretty good opener and fairly
reasonable for
like just tech in general um you know i
know this is a fact because every open
source project i
disclose vulnerabilities to they can
turn them around in a day
it's always these proprietary software
things that have
have troubles with more than that but
anyway uh they have
they have their own preferences there
and good for them for saying it out loud
um when you're looking at your
eventual public disclosure and i promise
i'm almost done uh when you look at your
public disclosure
just be clear on the attack scenario be
clear on the hardware
if it's a hardware attack if it's a
radio attack if it's a trusted network
attack or if it's an internet attack
right these are all very different kind
of levels
of scalability for attackers so be clear
about that
um when you're disclosing
vulnerabilities and when you're talking
about it you should have
at your fingertips at all times the name
of whatever the system is
they have several every one of these
vendors has several of these things
they have several versions of these
things and so be sure that
if if at all possible like get that
version number
if you have one that you've taken apart
get the fcc ids those are great
get serial numbers anything that like
identifies the the machine
is perfect um and also of course note if
it's a default config versus a custom
config
um you know that can go that you know a
lot of people can get real confused if
you are talking about something that
only happens in like a rare
custom config on the flip side if
there's a custom config that's like a de
facto default because the defaults are
nonsense or you know nobody uses them um
then then be clear about that as well
and finally when you're dealing with the
media reporters always want razzle
dazzle especially with this
especially with with voting systems they
will
many will try to push you into
oversimplifying the attack
and will try to put words in your mouth
and try to like lead you
down a a narrative that makes sense
and that a narrative that makes sense is
like the hallmark of fiction
when it turns out um so be careful about
that
uh journalists don't usually control
their own headlines and so you might
have a great experience with a great
journalist and then you see a headline
that is totally wrong and well that's
the editor's problem
um you know click click's gonna bait i
guess
um when you disclose these
vulnerabilities uh be prepared to deal
with crazy people
um there are a few of them out there uh
that
especially pay attention to things like
voting machines i'm sure you can talk to
any of the
voting security superstars that are that
are at this event
and ask them about the crazy people that
they've that they've interacted with
um and and just finally like your bug
is beautiful um it is beautiful and
unique
and it is special and because of that
you are incredibly biased about your bug
so just keep that in mind
um when someone tries to talk you out of
you know trying to trying to lower a
cvss rating or
wants to say like well that's not
actually really how it works like
try to listen to it it's very hard
sometimes it's hard to hear
just like it's hard to hear that your
software is vulnerable it's hard to hear
that your bug kind of sucks
um so just keep that in mind if you want
any help on all any of this
ask me i'm a guy who does this all the
time you can write me
at rep7 you can find me on twitter my
dms are open
and with that
thank you so much uh i'm done so i'll be
around on the discord
and happy to talk about your cool cool
vulnerability