Comment by Animats | Hacker News Reader

Comment by Animats | Hacker News Reader

For an outline of how to secure embedded devices, see the technical standards of the Nevada Gaming Commission.[1] They've faced these problems for years, with the opposition being organized crime and gambling cheats.

Typical rule:

Interactive gaming systems must be capable of verifying that all control programs contained on the interactive gaming system are authentic copies of approved components of the interactive gaming system automatically, at least once every 24 hours, and on demand using a method approved by the chairman.

Unless otherwise approved by the chairman, the authentication mechanism must employ a hashing algorithm which produces a message digest of at least 128 bits. The results of the authentication must be retained and be accessible for a period of 90 days. The interactive gaming system must provide a mechanism to visually notify the operator of any control program that fails an authentication. This mechanism must also require that an administrator of the interactive gaming system confirm any failed authentication with the system within 72 hours. Failure to confirm a failed authentication must require the interactive gaming system to automatically stop any gaming related functions.

Interactive gaming systems must provide, as a minimum, a two-stage mechanism for verifying all program components on demand via a communication port and protocol approved by the chairman. Unless otherwise approved by the chairman, this mechanism must employ a hashing algorithm which produces a message digest of at least 128 bits and must be designed to accept a user selected authentication key or seed to be used as part of the mechanism (e.g. HMAC SHA-1). The first stage of this mechanism must allow for verification of control programs. The second stage must allow for verification of all program components, including graphics and data components. The interactive gaming system must also provide the same two-stage mechanism for verifying all program components on demand via an operator user interface where the results are displayed on that interface.

[1] http://gaming.nv.gov/index.aspx?page=269#techpolicies

Ironic, http://blackboxvoting.org/

No electronic voting machine is that secure.

How is that actually implemented? The hashing algorithm is running on a microcontroller, right? What is it implemented in, and how is it loaded?

The firmware image is present on the computer requesting authentication. So the seed is sent to gaming machine to calculate digest at the same time the server requesting authentication runs the same algo on stored firmware image. Provided the initial seed is random, barring weakness in the hashing algo, there is no way to beat this check.

This is same process as you computing SHA1 of a file you downloaded and comparing it with the SHA1 provided on the website, if you could also provide a 128 bit number as seed of the SAH1 to the website.

Store a copy of the original version of the modified part of the firmware and use it for the hash calculation instead of the actual version?

There are three phases. First, the machine and its software have to be approved before deployment. That's done at Nevada Gaming Commission's lab in Las Vegas, and they require access to the source code. Here's the application form.[1] The applicant must ("Provide the Lab with all necessary hardware, software and documentation to reproduce programming and executable software. This typically includes a PC that contains no operating system, along with an operating system and compiler that is submitted on OEM media or downloaded from a verifiable source approved by the Lab. The documentation must include procedures for installing and configuring the operating system, compiler tools, libraries, certificates and anything else necessary to reproduce programming and executable software.") The approved version's hash is computed at the lab, and that's what has to match on machines in the field. There's an official state program, the NVSGCB Hash Verifier, to check this.[2] It's a Windows program (yes, I know) which checksums media and has a file of all the approved programs and checksums.

And yes, they look for hardware backdoors: (The chairman may require transportation of not more than two working models of a new gaming device to the new game lab of the board ... The lab may dismantle the models and may destroy electronic components in order to fully evaluate the device.)[3]

The second phase is the field check. In the days of standalone slot machines, the field check involved an Gaming Commission inspector plugging the machine's pluggable EPROM into a reader and computing its hash. Now it's tougher, but if the program is on some removable medium, it can be checked independently. Downloading updates is prohibited.

The third phase is logging. The logging requirements require logging all gambling and maintenance activity on logging media that survive maintenance. Every time a machine is opened, that's logged, too. In multi-machine systems, logs are kept both locally and centrally, and the central logging machine has to be physically inaccessible to the people maintaining the machines. If something funny is going on, there should be enough info in the logs to find out what, and who.

There are lots of specific requirements, from two-factor authentication to random number generator design and testing. There are many statements made under penalty of perjury. They even prohibit pop-up ads on slot machines, although advertising when the machine is idle and has no credit on it is allowed.

Just about everything they check for has been tried at some point by someone trying to cheat. They're up against organized crime. This isn't airtight, but it's far better than what we have now for embedded consumer software.

[1] http://gaming.nv.gov/modules/showdocument.aspx?documentid=27... [2] http://gaming.nv.gov/index.aspx?page=102 [3] http://gaming.nv.gov/modules/showdocument.aspx?documentid=29...

Reply on news.ycombinator.com