Slashdot Mirror
Experts Find Serious Problems With Switzerland's Online Voting System (vice.com)
An anonymous reader quotes a report from Motherboard: Switzerland made headlines this month for the transparency of its internet voting system when it launched a public penetration test and bug bounty program to test the resiliency of the system to attack. But after source code for the software and technical documentation describing its architecture were leaked online last week, critics are already expressing concern about the system's design and about the transparency around the public test. Cryptography experts who spent just a few hours examining the leaked code say the system is a poorly constructed and convoluted maze that makes it difficult to follow what's going on and effectively evaluate whether the cryptography and other security measures deployed in the system are done properly.
"Most of the system is split across hundreds of different files, each configured at various levels," Sarah Jamie Lewis, a former security engineer for Amazon as well as a former computer scientist for England's GCHQ intelligence agency, told Motherboard. "I'm used to dealing with Java code that runs across different packages and different teams, and this code somewhat defeats even my understanding." She said the system uses cryptographic solutions that are fairly new to the field and that have to be implemented in very specific ways to make the system auditable, but the design the programmers chose thwarts this. "It is simply not the standard we would expect," she told Motherboard. [...] It isn't just outside attackers that are a concern; the system raises the possibility for an insider to intentionally misconfigure the system to make it easier to manipulate, while maintaining plausible deniability that the misconfiguration was unintentional. "Someone could wire the thing in the wrong place and suddenly the system is compromised," said Lewis, who is currently executive director of the Open Privacy Research Society, a Canadian nonprofit that develops secure and privacy-enhancing software for marginalized communities. "And when you're talking about code that is supposed to be protecting a national election, that is not a statement someone should be able to make." "You expect secure code to be defensively written that would prevent the implementers of the code from wiring it up incorrectly," Lewis told Motherboard. But instead of building a system that doesn't allow for this, the programmers simply added a comment to their source code telling anyone who compiles and implements it to take care to configure it properly, she said.
The online voting system was developed by Swiss Post, the country's national postal service, and the Barcelona-based company Scytl. "Scytl claims the system uses end-to-end encryption that only the Swiss Electoral Board would be able to decrypt," reports Motherboard. "But there are reasons to be concerned about such claims."
"Most of the system is split across hundreds of different files, each configured at various levels," Sarah Jamie Lewis, a former security engineer for Amazon as well as a former computer scientist for England's GCHQ intelligence agency, told Motherboard. "I'm used to dealing with Java code that runs across different packages and different teams, and this code somewhat defeats even my understanding." She said the system uses cryptographic solutions that are fairly new to the field and that have to be implemented in very specific ways to make the system auditable, but the design the programmers chose thwarts this. "It is simply not the standard we would expect," she told Motherboard. [...] It isn't just outside attackers that are a concern; the system raises the possibility for an insider to intentionally misconfigure the system to make it easier to manipulate, while maintaining plausible deniability that the misconfiguration was unintentional. "Someone could wire the thing in the wrong place and suddenly the system is compromised," said Lewis, who is currently executive director of the Open Privacy Research Society, a Canadian nonprofit that develops secure and privacy-enhancing software for marginalized communities. "And when you're talking about code that is supposed to be protecting a national election, that is not a statement someone should be able to make." "You expect secure code to be defensively written that would prevent the implementers of the code from wiring it up incorrectly," Lewis told Motherboard. But instead of building a system that doesn't allow for this, the programmers simply added a comment to their source code telling anyone who compiles and implements it to take care to configure it properly, she said.
The online voting system was developed by Swiss Post, the country's national postal service, and the Barcelona-based company Scytl. "Scytl claims the system uses end-to-end encryption that only the Swiss Electoral Board would be able to decrypt," reports Motherboard. "But there are reasons to be concerned about such claims."
Surely, the more convoluted a software design is, the more secure it is. And inability to audit is always extra security.
We are talking about job security, right?
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
I fail to understand why online and even electronic voting systems would be so complex. They should all be simple, transparent, and open source. Why the need for "Leaked software"? They should be following the airplane rule with these kinds of things.
who thought this was a good idea? In 2016 Russia was able to significantly interfere with US elections and we're several times their size. China and Iran are doing the same. This is just nuts. Mail paper f'n ballots already. They work, they're secure, and they can't be hacked over the bloody internet.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
"There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult."
Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
Meatballs! Spaghetti code!!!
BORK BORK BORK
It's a voting system. Encryption is irrelevant. What matters is integrity and authenticity.
Like some other Swiss products?
I don't see online voting as ever not being corrupt, except perhaps momentarily, by accident. There's just too much at stake in an election, and the payoff for being able to manipulate the results is too high. BTW, the place to start if you're going to corrupt an online voting system is in the software writing stage. Make it really convoluted so that the attack vectors can't easily be found.
Elections with paper ballots can still be influenced (for instance, accidentally dumping cartons of ballots from precincts with generally the "wrong" political leaning, something that happened recently in my area) but I think it's harder to do, and easier to get caught.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Somebody will inevitably post this xkcd:
https://xkcd.com/2030/
However, it's not a remotely valid comparison. They're comparing planes and buildings operating under normal circumstances with software being attacked by a malicious actor. Software is actually far more robust than aeroplanes and buildings when faced with a malicious attack.
An unskilled person can easily destroy an aeroplane or demolish a building. We saw this on 9/11, when a few people equipped with nothing more than pen knives were able to destroy multiple planes, bring down two buildings, kill thousands of people and do billions of dollars worth of damage. When faced with an attack by a malicious actor both the aviation engineers and the civil engineers failed utterly.
Meanwhile, an electronic voting system would stand up far better to a malicious attack. While an unskilled person can easily bring down a plane, the same unskilled person would have no clue how to circumvent an electronic voting system. With an online voting system like this Swiss one, the best an unskilled person could do is click around a bit on the website, and achieve precisely nothing. Even a skilled person would have trouble circumventing an electronic voting system, and it would likely require considerable research, extensive planning and effective execution.
So, contrary to what the xkcd comic says, aviation engineers and civil engineers are crap at their jobs, and an unskilled attacker with a pen knife can destroy their "safe" products. Meanwhile, software engineers are far better at their job, and an unskilled attacker would be powerless to circumvent their work, while even a skilled attacker will struggle.
Right, I'm glad I could get that off my chest, because that xkcd comic annoys me every time I see it.
Everyone votes on the day with paper.
No mass use of postal votes. Go vote. Vote at a hospital.
Make block voting It gets counted by hand in front of witnesses, gov officials and people selected by political parties.
They all see the count and numbers. The local, regional, national tally is added in front of people.
The numbers match local to city to nation.
Why the secretive rush to computer systems?
Who needs to sway the Swiss elections and referendums by pushing electronics?
Stay with paper and the citizens vote counts.
Every citizen can then be reassured their vote is counted and their views on a referendum are correct.
No think tank, other nation, NGO, security service can sway the vote digitally during the vote.
Give the Swiss their vote back.
Domestic spying is now "Benign Information Gathering"
"You are in a maze of twisty passages, all alike."
In short, it's too complicated for this person to understand, which is not saying that it's insecure. They're basically saying that it's un-auditable by this particular individual.
The question is, was that part of the requirements? I mean, most computer systems are incomprehensible to managers, but management understanding isn't generally a requirement.
She said the system uses cryptographic solutions that are fairly new to the field and that have to be implemented in very specific ways to make the system auditable, but the design the programmers chose thwarts this
One way to interpret this is "our auditors don't understand what's going on in this code".
Is the spec public?
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
e-voting will almost certainly remain impossible to implement in a way that it is secure, autitable and trusted by the population.The last point is the most important one so that democracy works. Security through obscurity does not help. But even if there should be a secure, and auditable and intelligable system, how can one be sure as a voter that this system is really used in the end. How can one audit, whether the data are not tempered with, independent of that secure system? Again, even if there is an audit trail, how can make sure that it so simple that can be understood. There appears currently only one way to make sure that voting is secure and this is to have a paper trail which can be audited by many, also by non-experts and which is more difficult to temper with just because of the physical presence of the paper.
Meanwhile in extremely related news, North Carolina's 9th district is provably fraudulent, because all those paper write-in ballots the GOP collected and completed/destroyed/altered had the same people writing the same fake signatures on them, mailed in batches by the same people passing the same cameras. Over and over and over again, the same handwriting.
It's not just that a few witnesses tell investigators they were paid to collect those ballots. There is a paper trail proving the fraud.
Paper ballots, watched by all candidates, counted in front of all candidates is the only solution.
I see his son is now publicly telling people he warned his GOP dad that it was a felony to do this.... he's a lawyer, he's throwing his dad under a bus so that he isn't arrested on a conspiracy charge for not telling the FBI of the crime. He's not an idiot, he knows there is massive documentation of the voter fraud if anyone looks.
https://abcnews.go.com/Politics/video/son-north-carolina-congressional-candidate-warned-absentee-votes-61199843
You need one "file", and a blue or black pen. The Post Office will take care of the rest. If you don't know who the (here) President is for a couple days what's the difference? The country will stumble on regardless.
In a secular society the ballot vote is the only sacrament. That's why so many want to get rid of it.
Internet voting breaks secret ballot. If you are being bribed or threatened into voting for someone & you are voting at booth, then you can vote for anyone without the perpetrator knowing who you actually voted for.
Internet voting, OTOH, doesn't ensure this - the briber or the "threatener" will be looking over your shoulder when you are e-voting.
This is just one of the effects of the ongoing race-to-the-bottom in programmer cost. At some point, things are so bad that they can just be thrown away.
Dear MBA-morons: Get it in your heads that writing good code is vastly more difficult than anything you could ever hope to do in your lives and that this makes the people that can do it expensive and rare. Also remember (as you should have learned) that a project producing an inadequate result is vastly more expensive in its TCO as one that uses more expensive personnel, but produces an adequate result.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Give everyone a public key encryption, have them encrypt their vote with the governments public key, email the vote
Surely, the more convoluted a software design is, the more secure it is. And inability to audit is always extra security.
We are talking about job security, right?
The thing which makes this joke even more bitter is that here the voting tools are required to be autidable by design.
Any citizen could go and check that the counting of booth votes, or of postal votes is going as it should.
(While at the same time enforcing privacy: there shouldn't be a way for a potential repressive adversary to use the system to spy who voted what. Though the current implementation of remote voting over post has a few potential failure points, and relies on everybody along the chain accomplishing their duty... though again, any citizen is supposed to be able to come and check that it's indeed the case).
The current mess that is used in the few pilot e-voting experience is the exact opposite of that.
- non opensource components (mostly criticized by groups such as linux users, freesoftware advocate, etc.)
- extremely complex know-how required to understand what's going on (anybody can understand paper ballot being tallied, not everybody understands the cryptography behind the e-voting system).
On the other hand, we're a direct democracy: there are already people doing bottom-up actions trying to move things forward and get the problem solved.
The meta joke being that the proposal in questions to fix the e-voting system, will partially be voted for using the currently broken e-voting systems.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Team? Wiring? Configured? Who are these people.
I don't know anything about the system, but what kind of statement is this, from Lewis (the primary person interviewed):
"Someone could wire the thing in the wrong place and suddenly the system is compromised."
That's true of any security protocoll I can imagine. Anyway, "wire the thing in the wrong place"? This is the way a supposed security professional describes software vulnerabilities?
Then Matthew Green (the other person interviewed) says: "At this point I think the only appropriate way to evaluate it is through a professional evaluation by someone trained in this sort of advanced cryptography." Well, as it happens, even TFA states "the system has undergone three audits by auditing giant KPMG - among them an audit of the end-to-end encryption". So what problem is he pointing out again?
In addition the code is available to anyone who wants it, and there's now a public penetration test, which lots of people are signing up for. Seems like they're doing everything right. So back to Lewis, who says "Even if you sat down and read every line and determined everything was good, the code still wouldn’t pass the bar for being good code." Um...so good code is not good? Huh?
Again, I know nothing about the voting system being discussed - maybe it's good, maybe it's not. But TFA is just crap, and we have two security researchers who either don't know what they're talking about, or else they have some personal agenda in play.
Enjoy life! This is not a dress rehearsal.
It needs more blockchain.
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.