Digivote replay attack

[D V <digivoter () hotmail com>]

There is no integrity control for the communication between a URN external magnetic card reader
(DVDEK) and a URN PC (DVURN). As the data cable with D25 and D9 connectors connecting
DVDEK and DVURN is a standard data cable, it is possible to replace it with a similar data cable
with a hidden micro controller embedded in the connector. This hidden micro controller plays the
role of man-in-the-middle. It intercepts all communication between the URN external magnetic card
reader and the URN PC. Each time it wants to discard a vote, the micro controller replaces the data
read from the voting magnetic card with the data from a previous voting magnetic card. Otherwise
it relays the original data. Modifying the data is impossible, as this will invalidate the 8 byte MAC
signature at the end of the voting magnetic card data and thus fraud will be detected by the URN
software. But replacing the data of one vote by another previous valid vote is possible without
triggering the fraud detection systems.

One scenario for discarding votes for political party A.
To discard votes for political party A, replace the data cable by a data cable with a embedded micro
controller programmed to act like this:

    1. Act transparently (relay all data without substitution) until a voting magnetic card is inserted
       that has not been inserted in a MAV PC (this is a initialized voting magnetic card with blanc
       vote, the Usage Flag in the data indicates that this card has not been inserted in a MAV PC).
       Store the data of this blanc voting magnetic card in the memory of the micro controller, and
       relay it to the URN PC. From now on, the micro controller acts as man-in-the-middle.
    2. In man-in-the-middle mode, intercept all data. If it is the data of a voting magnetic card for
       political party A, discard the data and relay the stored blanc voting magnetic card data to the
       URN PC. Relay all other data unmodified to the URN PC.

Mitigation: certify and seal the data cables.

http://en.wikipedia.org/wiki/Electronic_voting_in_Belgium
3E054CF44706D1DF82D4BECF86C86EFB

                                          
_________________________________________________________________
Hotmail: Free, trusted and rich email service.
https://signup.live.com/signup.aspx?id=60969

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/