The serious invasion in the middle of the electoral period was made public in the beginning of November / 2018, but which, despite its importance, did not deserve due repercussion in the press.
The Superior Electoral Court (TSE) suffered an alleged unauthorized access to the GEDAI-UE system of the electronic ballot box and had the software charging system code leaked during the week before the second round of the presidential elections, which took place on the 28th of October. In addition to the unauthorized leak, hackers claimed that they were successful in entering the TSE intranet and obtaining privileged and confidential information, such as exchanging emails, sending passwords to judges, access credentials, etc.
TecMundo received the documents through two anonymous sources in October. After internal analysis, the files were sent in their entirety to the Superior Electoral Court for authentication.
⇒ GEDAI-UE is a data, application and interface manager with URNA.
As of the time of this publication, the TSE has not sent a position on the case. On the other hand, JOTA sources, who acted alongside the TecMundo in the investigation, they indicated that there was a mobilization in the Court after receiving the files.
According to the staff of JOTA, when questioned about the fact this week, the TSE checked the data and confirmed that, in fact, people outside the Court may have had access to information about the equipment that the TSE keeps under wraps.
The TSE said: “It is worth noting that the invaders did not have access to the voting secrecy module: this means that it was not possible to access the part of the system that displays voters' votes. In addition, the GEDAI code is “public”: after signing a confidentiality agreement, parties, MPs and OABs, for example, can request access. ”
GEDAI-UE was the main module that hackers accessed. According to the TSE, it is a data manager, applications and interface with the ballot box, which provides the teams of the electoral registries and the Regional Electoral Courts (TREs) with the necessary software support for the loading of the electronic ballot boxes. It is the system responsible for generating charge, voting and media flashes for the ballot box, in addition to receiving and sending correspondence to the TREs.
Basically, this is the system that generates memory cards that contain Uenux (electronic ballot box with Linux), candidates and voters. “Candidates and voters are imported by Gedai-UE from other TSE applications. With these memory cards, the technicians of the regional electoral courts install Uenux in the ballot box with the lists of candidates and voters, a procedure done with each new election ”, explains the TSE on its official website.
Hacked GEDAI code part
How the TSE invasion occurred
One of the hackers detailed the TecMundo how he got privileged access to the TSE system. According to him, the access happened through vulnerabilities in applications developed by the Court itself. Thus, it was possible to have remote access to one of the equipment connected to the network. Follow the complete and complete conversation below.
“With that, (vulnerabilities) I obtained thousands of source codes,
confidential documents and even credentials. ”
Hacker report: hacking for months, logins, passwords and functioning of the voting system.
Note: Sérgio Silveira Banhos, quoted by the source, has been the TSE's replacement minister since 2017. Giuseppe Janino is the technology secretary of the Superior Electoral Court, known for having been the creator of the electronic voting collector.
Confidential TSE document sent by the hacker
⇒ Only the unzipped source code (GEDAI-UE), exceeds 3GBs
The source also explains that he obtained, together with the source code, the keys that are used. "Only the unzipped source code (GEDAI-UE) exceeds 3GBs, and I obtained thousands of other codes, such as Cand-web".
About software, the attacker commented to TecMundo that vulnerable applications ran on outdated versions of JBoss, “Like the Digital Pouch, used by TRE's”. The hacker added that “some TSE technicians, thinking about it, updated the version of an application in Jboss, in this case ELO, a few weeks ago.
Hacker's explanation of outdated and insecure TSE technologies
After this exchange of messages, the hackers involved in the invasion no longer responded to requests for comment.
Some documents hacked in TSE
What researchers say about the case
"It is worth remembering that the voting software is known to have had several serious vulnerabilities and design errors in recent years, despite being classic and well known in the security area. Anyway, exploring the consequences of the event represents an interesting exercise. It is unknown at what point the invasion started or what type of information was accessed by the invader, therefore a possible impact on the results of the last elections is uncertain. In the absence of the possibility of recounting votes by a voter-verifiable physical record, the best measure to try if any impact on the results is estimated, the exit polls, which at least in the presidential race were happily faithful to the published result "
It is also an important moment to rethink your relationship with the technical security research community.
According to Professor Aranha, at the moment, the best move for the TSE would be to fully publish the code bases that make up the critical electoral systems, “as promised before the 2018 elections“.