Return of the Insecure Brazilian Voting Machines
summary
Security analysis targets Brazil’s election system used by 140+ million voters, based on 2012 and 2017 hacking challenges. Findings include a hard-coded country-wide AES key that decrypts install cards and disk images, a timestamp-seeded PRNG that lets the public timestamp on the poll tape undo DRV shuffling and recover ballots, and flawed signature checks (unsigned libraries + integer bug) enabling runtime code injection to alter votes. Proofs include decrypted install-card tools, simulator payloads that change displayed and stored votes, and clear fixes: voter-verifiable paper trail and risk-limiting audits.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:59Context
- 1:26Election Workflow
- 2:25Brazilian Voting Machine
- 3:26Quick Facts
- 5:41The Election Workflow
- 9:52The Public Security Tests
- 12:47Vulnerabilities
- 15:04Digital Record
- 20:35Live
- 21:52Conclusions
- 23:52Software Integrity
- 24:48Encryption
- 26:24Cryptographic Keys
- 27:17MINIX
- 28:02Decryption
- 28:29Authentication
- 32:02Code Injection
- 34:32Voting Simulator
- 37:20Problems with the Voting System
- 38:52Solutions
- 45:52Voting Database
- 53:37Question
related talks
49mThe Return of Software Vulnerabilities in the Brazilian Voting Machines
01h 01mPrinting Votes — Is It a Hack?
45mFrom Ballots to Code: Exploring Election Security
25mFrom Voting Machines to Discord: A Path to Technological Activism
01h 02mIntroduction to Election Security
22mBuilding a Voting Machine Everyone Can Trust
58mElections: Trust and Critical Infrastructure
12mIncreasing security without decreasing usability: A comparison of various verifiable...