Software Vulnerabilities in the Brazilian Voting Machine

Introduction

The Brazilian Superior Electoral Court (SEC) has been increasingly adopting electronic elections since 1996, culminating in the current scenario where nearly all votes are collected by voting machines and a considerable fraction of the machines have fingerprinting devices for voter identification. Important milestones in the history of the initiative were the first purely electronic elections in 2000, the transfer of full responsibility for software development to the SEC in 2006 and the migration to the GNU/Linux operating system in 2008. Although security testing by independent parties should be a part of the process from the start, as a natural way to improve reliability of elections and reassure that the system provides sufficient ballot secrecy and integrity, it only received significant attention after the software components and human procedures for electronic voting became stable. An important movement in this direction has been the public and periodic testing of the voting systems organized by the SEC since 2009. Despite some undesirable restrictions, these tests allow teams of specialists from industry and academia to independently evaluate the security mechanisms adopted by the Brazilian voting system.

The main goal of this work is to present the observations collected by the authors during their participation in the 2^nd iteration of the Public Security Tests organized by the SEC in 2012. Our previous official report of the event was jointly written with the SEC and does not contain sufficient information regarding other security issues not directly attacked by the authors during the event. Our intention is to point out several limitations of the Brazilian electronic voting system and to contribute to its security process. Following standard practices in the security field, we present self-contained descriptions of the observed software and development process flaws with multiple suggestions for correction or mitigation. This way, the interested parties are in an adequate position to implement effective countermeasures. In particular, the main design and implementation problems detected on the security mechanisms of the voting machine software are detailed. An overview of such issues can be found below: