I’ve mentioned my general opinions regarding this topic. But I guess it would be helpful to drill down deeper.

The thing that makes this issue complicated is that both sides have their respective legitimate arguments – and the “problem” I see is how people assume something has happened simply based on the possibility that it can.

That mindset, while legitimate to a certain extent, is unfair to use in the field of technology because it is an uncontested fact that any system, given enough time, can be compromised. The goal of security experts has always been to, at the very least, make it extremely difficult for any hacker to accomplish such a task in a reasonable amount of time.

So given the elections, that’s quite a slim window of opportunity to get anything done unless you’ve already got a hack in place. That means the system already has to have defeated from the get-go – wether it by knowing the 128bit encryption cypher, or that you’ve tampered with all the PCOS machines, or that you somehow managed to tamper with all remote receiving servers.

Again, these are all possibilities… but you can see how foolish it can be to assume any one of them has happened based on unsubstantiated claims.

The Role of Cryptography

People underestimate the role cryptography plays in all of this. One of the podcasts I listen to is specifically geared to explaining internet security – and they discuss cryptography heavily.

Sufficed to say, without belaboring the subject, it’s safe to generalize that cryptography has matured far enough that as long as you had a robust implementation, ¹ on the encryption level having access to the source code doesn’t necessarily compromise the security of the encryption. It’s worth mentioning that I’m talking about the source code on the implementation of the encryption – not necessarily the actual “OS” of the PCOS.

The 128bit key is the cypher that’s used to manipulate the data, as long as you don’t know what the key is, it doesn’t matter even if you knew how it manipulated the data. If I had said that I shifted letters by X amount (X being the “key”)… it would only be helpful if you knew what X was.

So here you have me practically giving you the source code; by telling you how I intended to “encrypt” the data ² By shifting the characters depending on X – and that “key” is the only thing that I left out in the equation. Of course it’s a given that brute forcing a single digit is simple since you only have 10 possible values. This type of cyphering is a far cry of what real secure encryption algorithms use.

What they’re implying that they have compromised a 128bit cypher. That’s claiming that they have successfuly found the single correct value out of 2¹²⁸ or 3.40282367 × 10³⁸ possible values/combinations.

Assuming you had a [as yet non-existent] computer (or supercomputer cluster) that can process 1 trillion passwords a second. On average, it would still take you around 2×10¹⁸ years ³ Yeah, that’s 2 million-million-millinon to find that key via brute-force – and that’s assuming that the “system” you’re trying to crack allows that many “tries” in a second. Banks usually only allow 3 tries, then they lock you out.

Sufficed to say, as far as that “scenario” goes; the only way to get the key is if SmartMatic gave it to them in a silver platter. Because any other way would involve words like “God,” “immortality,” and “time travel.”

So Koala Boy’s claim of cheating by mere interception of the [encrypted] data, and sending modified data remotely is practically impossible… unless they knew the key, and that would imply SmartMatic itself was in on the action. That, or that SmartMatic programmers are incompetent fools who didn’t use encryption with their transmitted signals – either scenario is highly unlikely.

Server Hack

I’ll use the iPhone as an example for this topic of discussion. The whole jailbreaking scene, up to this day, hasn’t found/guessed the encryption key Apple uses for its hardware. At best, they are able to circumvent it locally in the device. But this sometimes isn’t enough IMHO; in some cases, there’s still the server you’ll have to deal with.

The best example of this when you try to downgrade your firmware. Apple has put in an “extra step” when installing firmware on your device; iTunes has to “phone home” to ask permission from Apple servers if what you’re doing is allowed. In a nutshell; the servers do not allow you to downgrade your firmware… you can only upgrade it.

No matter what hack you do on the device itself, you cannot fool the server into letting you downgrade. But the workaround Saurik has come up with was to create another server that acts like the Apple server – and by editing your machines’ hosts file, you can redirect all calls to that server instead – and the fake server fools iTunes into thinking it’s talking to the official server, and “allows” it to downgrade the device.

In case you missed my point, my point is that in spite of all this, the official Apple server is still untouched. And all these hacks/workarounds are ultimately for manipulating data coming towards your computer/device.

This is hardly the case with the elections; where you ultimately send data out to the official servers. And the concept of a “fake” server is not applicable in this scenario; everyone’s polling data from COMELEC and all other official servers that were tasked to handle the results. The only way to compromise the system on this level is if you had access and had hacked all the official servers.

Possible, but again, what are the chances of that happening?

PCOS Hack

Most hardware hacks rely on exploiting some memory bug (what they call a buffer overflow/overrun) this allows you to inject arbitrary code. Jailbreaking iPhones naturally use this type of exploit as well.

I guess it is possible to say insert code that would fit right in between the part after the device recieves the votes, and before the data is encrypted and sent remotely. In the case of a jailbroken iPhone, this certainly seems to be the case; that’s why iTunes or the official Apple server still recognizes your hacktivated iPhone as a legitimate unit.

The analogy I would use here is person A handling the vote receiving, person B handling the vote counting, person C is the messenger, and person D being the recepient. Persons’ A, B and C are all within the PCOS machine, and person D is the server which only accepts official transmissions from person C – because only person C knows the “secret handshake”. If you can somehow get between A and C or B and C, you would have a shot, as you were able to manipulate the data locally before it was even “officially” encrypted (person C).

I’m not going to lie, this is possible. In fact there’s a video on YouTube demonstrating exactly this with the whole DieBold debacle.

Still, to successfully affect the election results significantly, you’d have to have compromised a lot if not all PCOS machines. Interception outside of the machine will not work (because person D will not accept person X masquerading as C, unless X also knew the handshake… which they probably don’t because of the crypto discussion mentioned above.)

But again, being a possibility doesn’t mean it is the reality. For one, the video’s pretty old, if SmartMatic is worth its salt, they should’ve had dealt with that possibility a long time ago. Plus DieBold algorithms are not necessarily SmartMatics, so you cannot assume that the same approach will work for SmartMatic. There are too many unknowns.

The Bottomline

The bottomline is that all these “possibilities” no matter how compelling they are – are still speculation. The only way of really knowing if Koala Boy’s telling the truth is if his side can procure a working implementation of their “system” – specifically showing that it has compromised SmartMatic’s proprietary system. To believe his claims at face-value is quite sad as it speaks volumes of how fear/rumors play a huge part in how our people think. Perhaps it’s that same fear-mongering that led us to select less than ideal leaders. But I digress…

If you still can’t get the idea, try to remember “Iron Man 2” – Tony Stark was correct in claiming that his technology doesn’t exist anywhere else. And that would be a reasonable assumption. That his claim was disproven was precisely because there was a real-world implementation that refuted his claim… not because some asshole just claimed that “it’s out there… somewhere”

It is possible that there’s a flying teapot (from some damaged spacecraft) in orbit… does the possibility mean that it does exist? Remember, we’re not talking about the existence of God here, this sort of argument can be proven/disproven quite easily if the whistleblower just step forward and put his money where his mouth is.