On the use of Internet Voting on Compromised Computers
Résumé
Internet voting is the process of letting voters cast their vote over the Internet, at home or on public computers. It is a way to reduce the cost associated with elections and to obtain higher participation, but it also raises important security problems. In this paper, we study shortcomings related to this technology, and more particularly shortcomings due to the presence of dedicated malware on the voters' computers. Common literature usually focuses only on designing a secure voting protocol, either discarding the malware issue or proposing prohibitive solutions, such as the use of dedicated hardware. However the purpose of Internet voting is precisely to allow anyone to vote from home, making the use of dedicated hardware a non conceivable solution. Therefore, we analyse the reliability of possibly malware-infected mainstream computers. Specifically, we do not consider the security of the voting protocol but define the data available to the malware and the attacks that can be carried out thereby. We show that current Internet voting implementations are vulnerable to these attacks, due to weak or irrelevant security measures. Thus we describe reasonable solutions that aim at coping with the lack of security of current implementations on general-purpose computers, even though some attacks cannot be prevented but can only be mitigated. For example, it is impossible to prevent the malware from stealing the user credentials with no hardware support, but it is easy to design a system in which user credentials are useless to an attacker: therefore we can prevent more serious attacks such as automatic vote changing and voter impersonation. Among other solutions, we describe and study reliability of hybrid voting mechanisms, using a medium which can not be accessed by the malware, as well as of Human Interaction Proof implementations to prevent automatic vote changing and the election invalidation that could result from this class of attacks.