8 ms·

Here's the report: https://ccc.de/system/uploads/230/original/PC-Wahl_Bericht_CCC.pdf https://ccc.de/system/uploads/230/original/PC-Wahl_Bericht_C... It's trul

by lima 9y ago

Here's the report: https://ccc.de/system/uploads/230/original/PC-Wahl_Bericht_CCC.pdf https://ccc.de/system/uploads/230/original/PC-Wahl_Bericht_C... It's truly disastrous. Some of the findings: - The automated software updates have no signature and are downloaded insecurely over HTTP - The webserver the updates are downloaded from is hosted using a shared hosting package at 1&1, on a host with >5000 other customers (implying an easy takeover using local privilege escalation) - The reason they know this? They found multiple PHP scripts vulnerable to arbitrary read and write vulnerabilities, so they got full RCE on the server. - FTP access credentials for the website were contained in a public ZIP file (named test.zip) - Vote results are transmitted using either insecure FTP whose credentials weren't rotated for years or an equally insecure XML protocol. No signatures in sight. - Said insecure XML protocol is a government standard They also took a look at one of the local government's infrastructure: - test/test were valid VPN credentials - FTP credentials were publicly downloadable with R/W access to vote results - Vote result encryption was reversible thanks to a hardcoded symmetric key The report goes on to detail even more trivial security issues, including home-grown "encryption" algorithms worse than what you'd find in a beginner CTF challenge. None of the steps taken in response addressed the fundamental, obvious security policy issues. Even their band-aid fixes were broken. For example, they started signing their binaries, but forgot to check the signature. Given the lack of any security awareness whatsoever, even if they properly sign their binaries, their build server is probably easy to compromise. RCE demo: https://vimeo.com/232581770 https://vimeo.com/232581770 Have a look at the site in question: https://www.wahlinfo.de/ https://www.wahlinfo.de/ The local government they worked with responded by enforcing verification and transmission of the results using an independent channel.

CM30 9y ago
Forget the problems electronic voting has if it's implemented well, this sort of stuff is the real reason to be worried about systems like this. Because there's a tendency for governments and councils to outsource the work to whatever contractors are the cheapest or to hire developers who don't know a thing about security. A secure evoting system is hard enough to implement, and even a well done version is worse than a paper ballot. But it's the kind of system described here that'd be the likely result of electronic voting being implemented in countries like the US. A hacked together, insecure piece of junk that's wide open to being compromised by bad actors at every level.
- majewsky 9y ago
  > there's a tendency for governments and councils to outsource the work to whatever contractors are the cheapest Not just a tendency. When choosing a contractor, government offices in Germany are required to choose the lowest bidder who fulfils (or rather, claims to fulfil) the requirements stated in the call for bids.
  - Angostura 9y ago
    To be fair, that is more a rationale for having rally good people speccing your system and producing detailed requirements.
    - pfg 9y ago
      That's certainly not wrong, but it also is somewhat at odds with how we know modern software projects should be managed, which is a reasonable explanation for why so many government projects work out the way they do.
    - deleted 9y ago
      [deleted]
    - wiz21c 9y ago
      Ok, let's just do that : spec a voting system. Such a system should be as secure as physical paper and anybody should be able to assess its security by inspecting it (good luck with that one).
    - laumars 9y ago
      The level of detail your talking about to prevent the kind of mistakes they made is so specific that you might as well just develop the thing in house since you clearly already have the experience. Maybe what we need is a rules that any critical government infrastructure should be independently pen tested before it's bought. This should hopefully put off the inexperienced from taking on such projects and offer a way out for governments should the contract go sour.
azeirah 9y ago
... my personal website has better security than this :| This is worrisome
- _asummers 9y ago
  Would you be interested in hosting the next German election? Sounds like they need someone!
  - azeirah 9y ago
    I uh.. Sure :) I'm all up for it, I'll read a book or two on cryptography and security and leggo! Good intentions will definitely be enough.
johansch 9y ago
... well, wow. (Great summary.) How widely is this system used in the the german national elections? Is it just one of the states? (Which one?)
- currysausage 9y ago
  The two products by "vote IT", one of which is the vulnerable "PC-Wahl", are used by 2700 authorities, responsible for ~66% of Germans. ("Insgesamt haben 2.700 Behörden die Produkte von vote iT lizensiert. Damit werden für rund 66 % der Einwohner Deutschlands die Wahlen mit unseren Produkten organisiert und präsentiert.") [1] [1] https://vote-it.de/ https://vote-it.de/
  - johansch 9y ago
    That's insanely messed up. Very high level heads have got to roll for this, right? Like at least one direct report to Merkel?
    - germanier 9y ago
      Direct reports to Merkel have absolutely nothing to do with this. This software was procured by local authorities which are completely independent from the federal government. Even if Merkel wanted, she has no authority whatsoever on local authorities.
      - johansch 9y ago
        Ok. So maybe one conclusion is that the responsibility for the voting process should be on the federal level, then.
        pc86 9y ago
        What indication do you have that any federal solution would be better than the state one? They're operating under the same laws and RFP/selection requirements. The only difference at the federal level would be it affects 100% of Germans instead of 66%.
mtgx 9y ago
This is why electronic voting is such a huge problem to solve. You can't just check one or two boxes like "blockchain" and "biometric authentication" and think "there, we now have secure electronic voting". There are so many other things that should go into securing the electronic voting, including doing thorough audits of the code before the election, keeping the systems up to date, having anti-tampering protection, allowing users to verify their vote in a secure way, and so many other things I can't think of right now. But all of those things will get lost when talked about in the media or on TV, and the politicians won't care to implement them either. It's a little like nuclear energy being "safe" - except for all the problems humans and their corruption could cause around it. But electronic voting is much worse, because I very much doubt the current political climate would want to handle electronic voting with at least as much care (it's the democracy at stake after all) as they do nuclear power plants. If anything, the two main parties would probably be fine with some vulnerabilities if they think only they can exploit them. So I guess what I'm trying to say is that electronic voting has always been doomed to fail and will always be doomed to fail due to all of the other implementation details that always lack from the discussion beyond a few main check boxes. All of that stuff is "nerd talk" so few of the leaders will care about them, which means budgets won't go towards solving those problems and ensuring those other checks exist, too, and are properly managed.
colanderman 9y ago
> None of the steps taken in response addressed the fundamental, obvious security policy issues. Even their band-aid fixes were broken. I feel like it is a universal truth of engineering, that you can't expect anyone who implemented such a grossly broken system in the first place to be capable of anything but band-aid fixes of the specific flaws pointed out to them.
jliptzin 9y ago
Horrific
relyio 9y ago
>- The automated software updates have no signature and are downloaded insecurely over HTTP I have two conflicting thoughts at the moment: 1. It's insane 2. It's awesome. I wish I could get my hands onto one of those machines.

by lima 9y ago

CM30 9y ago

Forget the problems electronic voting has if it's implemented well, this sort of stuff is the real reason to be worried about systems like this. Because there's a tendency for governments and councils to outsource the work to whatever contractors are the cheapest or to hire developers who don't know a thing about security. A secure evoting system is hard enough to implement, and even a well done version is worse than a paper ballot. But it's the kind of system described here that'd be the likely result of electronic voting being implemented in countries like the US. A hacked together, insecure piece of junk that's wide open to being compromised by bad actors at every level.

majewsky 9y ago
> there's a tendency for governments and councils to outsource the work to whatever contractors are the cheapest Not just a tendency. When choosing a contractor, government offices in Germany are required to choose the lowest bidder who fulfils (or rather, claims to fulfil) the requirements stated in the call for bids.
- Angostura 9y ago
  To be fair, that is more a rationale for having rally good people speccing your system and producing detailed requirements.
  - pfg 9y ago
    That's certainly not wrong, but it also is somewhat at odds with how we know modern software projects should be managed, which is a reasonable explanation for why so many government projects work out the way they do.
  - deleted 9y ago
    [deleted]
  - wiz21c 9y ago
    Ok, let's just do that : spec a voting system. Such a system should be as secure as physical paper and anybody should be able to assess its security by inspecting it (good luck with that one).
  - laumars 9y ago
    The level of detail your talking about to prevent the kind of mistakes they made is so specific that you might as well just develop the thing in house since you clearly already have the experience. Maybe what we need is a rules that any critical government infrastructure should be independently pen tested before it's bought. This should hopefully put off the inexperienced from taking on such projects and offer a way out for governments should the contract go sour.

azeirah 9y ago

... my personal website has better security than this :| This is worrisome

_asummers 9y ago
Would you be interested in hosting the next German election? Sounds like they need someone!
- azeirah 9y ago
  I uh.. Sure :) I'm all up for it, I'll read a book or two on cryptography and security and leggo! Good intentions will definitely be enough.

johansch 9y ago

... well, wow. (Great summary.) How widely is this system used in the the german national elections? Is it just one of the states? (Which one?)

currysausage 9y ago
The two products by "vote IT", one of which is the vulnerable "PC-Wahl", are used by 2700 authorities, responsible for ~66% of Germans. ("Insgesamt haben 2.700 Behörden die Produkte von vote iT lizensiert. Damit werden für rund 66 % der Einwohner Deutschlands die Wahlen mit unseren Produkten organisiert und präsentiert.") [1] [1] https://vote-it.de/ https://vote-it.de/
- johansch 9y ago
  That's insanely messed up. Very high level heads have got to roll for this, right? Like at least one direct report to Merkel?
  - germanier 9y ago
    Direct reports to Merkel have absolutely nothing to do with this. This software was procured by local authorities which are completely independent from the federal government. Even if Merkel wanted, she has no authority whatsoever on local authorities.
    - johansch 9y ago
      Ok. So maybe one conclusion is that the responsibility for the voting process should be on the federal level, then.
      - pc86 9y ago
        What indication do you have that any federal solution would be better than the state one? They're operating under the same laws and RFP/selection requirements. The only difference at the federal level would be it affects 100% of Germans instead of 66%.

mtgx 9y ago

This is why electronic voting is such a huge problem to solve. You can't just check one or two boxes like "blockchain" and "biometric authentication" and think "there, we now have secure electronic voting". There are so many other things that should go into securing the electronic voting, including doing thorough audits of the code before the election, keeping the systems up to date, having anti-tampering protection, allowing users to verify their vote in a secure way, and so many other things I can't think of right now. But all of those things will get lost when talked about in the media or on TV, and the politicians won't care to implement them either. It's a little like nuclear energy being "safe" - except for all the problems humans and their corruption could cause around it. But electronic voting is much worse, because I very much doubt the current political climate would want to handle electronic voting with at least as much care (it's the democracy at stake after all) as they do nuclear power plants. If anything, the two main parties would probably be fine with some vulnerabilities if they think only they can exploit them. So I guess what I'm trying to say is that electronic voting has always been doomed to fail and will always be doomed to fail due to all of the other implementation details that always lack from the discussion beyond a few main check boxes. All of that stuff is "nerd talk" so few of the leaders will care about them, which means budgets won't go towards solving those problems and ensuring those other checks exist, too, and are properly managed.

colanderman 9y ago

> None of the steps taken in response addressed the fundamental, obvious security policy issues. Even their band-aid fixes were broken. I feel like it is a universal truth of engineering, that you can't expect anyone who implemented such a grossly broken system in the first place to be capable of anything but band-aid fixes of the specific flaws pointed out to them.

jliptzin 9y ago

Horrific

relyio 9y ago

>- The automated software updates have no signature and are downloaded insecurely over HTTP I have two conflicting thoughts at the moment: 1. It's insane 2. It's awesome. I wish I could get my hands onto one of those machines.