4 ms·

This program is a failure for the get go. > Scalable manipulation of votes that is undetectable by voters and trusted auditors; Such a bug would be a complete

This program is a failure for the get go. > Scalable manipulation of votes that is undetectable by voters and trusted auditors; Such a bug would be a complete worst-case failure and if you report it, it would net you up to 50'000 CHF. This is a ridiculously low amount for such a critical infrastructure. The expected black market value of such a vulnerability is way way higher. Just to give you a frame of reference, in Switzerland we have 4 national votes a year and depending on the topic, affected interest groups and parties spend between 3 to 6 Mio CHF per vote for ads and influence. Now do the math yourself, whats the expected value of a vulnerability "undetectable by voters and trusted auditors" in a 10-20 Mio/y market (just at the national level) for influence?

TheSpiceIsLife 8y ago
I am from a far far away land. Would you mind explaining what Mio means in this context.
- PetitPrince 8y ago
  Mio == million
  - TheSpiceIsLife 8y ago
    There are, what, 6 million or so voting age people in Switzerland. 6 million x 3 to 6 million CHF = I’m confused. 1 CHF = about 1 USD? 36,000,000,000,000 CHF four times a year. M I know I’m very tired. Did I miss something?
    - jobigoud 8y ago
      They mean "3 to 6 M per vote" as in per election, not per citizen.
      - nairboon 8y ago
        Exactly, on any of the 4 voting days a year, there can be multiple issues/proposition/topics and for the important ones of those, we see budgets in the millions
      - TheSpiceIsLife 8y ago
        Oh dear. Talk about fatigue decontextualised misinterpretation. Thanks for clearing that up.
- deleted 8y ago
  [deleted]
spuz 8y ago
But you only need one honest hacker amongst all those who discover the same vulnerability to claim the bounty. There are plenty of hackers and pen-testers out there who do legitimate work and have no interest in breaking the law. The bounty only needs to be as high as the market rate for their work. Still the 150,000 CHF maximum bounty is way too low. Even though the system has already been pen-tested, there could still be dozens of undetectable vote manipulation bugs out there and they should not reduce the incentive of finding them by capping the payouts.
- nairboon 8y ago
  Yes, but even if some bounties are paid out, what guarantee do we have that this one honest white hat did his work? And remember this is not an usual bug bounty for some company, where the failure mode is some lost revenue due to hacking. This could become ultra critical infrastructure, since in Switzerland we do not only elect the politician but we decide on any policy and law if it is of sufficient interest. In the absolute worst case a rigged electronic vote could enable laws bordering human rights violations or even laws to abolish some people's right to vote. So the failure mode here is complete loss of democratic control.
  - mal-2k 8y ago
    That's not a particular problem for e-voting. I don't see a concrete reason why there should be an enhanced risk for manipulation just because you transmit your vote via the internet instead of sending it by letter or visiting the polling station. I rather see an opportunity for the voter to verify that the vote has been correctly carried depending on the implementation of the e-voting system. But for that I still need a closer look into the details of this system (which I will do as it concern myself). At the moment I see the project quite positive. For example in Germany they used a closed sourced software called "PC Wahl" and the ccc had quite some difficulties to get the source code. And when they got it the catastrophe just began. The software included such funny things like a 1 byte (sic!) hash as checksum. Then it had a weird encryption created by the guy who coded the software, which wouldn't even met 80's standards. Also the software was distributed via a cheap, hosted web server with the login credentials "test" "test" (sic!) and there wasn't any signatures for the updates nor for the transmitted results. To see the hole catastrophe you can watch "PC Wahl Hack" with Linus Neumann. It's quite funny especially when you hear that the software company (from that one guy who coded it since the 90s) was sold for about 1 Mio. €.
yholio 8y ago
> whats the expected value of a vulnerability "undetectable by voters and trusted auditors" in a 10-20 Mio/y market You might be low balling it yourself. The influence market has a limited value because players who would want to influence towards outlandish outcomes (ex. a union with Russia, declaring war to Germany or simply self-destruction via civil war) know they are wasting their money since their desired outcome is essentially impossible to achieve. A system where you can enforce a change of leadership in a OECD country with 700 billion GDP is worth at least billions, if not tens of billions. You could recover most of your costs simply by influencing government purchasing for 4 years, and get any politically desired outcomes for free.
jwandborg 8y ago
I'm not sure the maximum is 50000 CHF. They present it as "Minimum compensation: Between 30000-50000 CHF" which is a bit ambiguous.

TheSpiceIsLife 8y ago

I am from a far far away land. Would you mind explaining what Mio means in this context.

PetitPrince 8y ago
Mio == million
- TheSpiceIsLife 8y ago
  There are, what, 6 million or so voting age people in Switzerland. 6 million x 3 to 6 million CHF = I’m confused. 1 CHF = about 1 USD? 36,000,000,000,000 CHF four times a year. M I know I’m very tired. Did I miss something?
  - jobigoud 8y ago
    They mean "3 to 6 M per vote" as in per election, not per citizen.
    - nairboon 8y ago
      Exactly, on any of the 4 voting days a year, there can be multiple issues/proposition/topics and for the important ones of those, we see budgets in the millions
    - TheSpiceIsLife 8y ago
      Oh dear. Talk about fatigue decontextualised misinterpretation. Thanks for clearing that up.
deleted 8y ago
[deleted]

spuz 8y ago

But you only need one honest hacker amongst all those who discover the same vulnerability to claim the bounty. There are plenty of hackers and pen-testers out there who do legitimate work and have no interest in breaking the law. The bounty only needs to be as high as the market rate for their work. Still the 150,000 CHF maximum bounty is way too low. Even though the system has already been pen-tested, there could still be dozens of undetectable vote manipulation bugs out there and they should not reduce the incentive of finding them by capping the payouts.

nairboon 8y ago
Yes, but even if some bounties are paid out, what guarantee do we have that this one honest white hat did his work? And remember this is not an usual bug bounty for some company, where the failure mode is some lost revenue due to hacking. This could become ultra critical infrastructure, since in Switzerland we do not only elect the politician but we decide on any policy and law if it is of sufficient interest. In the absolute worst case a rigged electronic vote could enable laws bordering human rights violations or even laws to abolish some people's right to vote. So the failure mode here is complete loss of democratic control.
- mal-2k 8y ago
  That's not a particular problem for e-voting. I don't see a concrete reason why there should be an enhanced risk for manipulation just because you transmit your vote via the internet instead of sending it by letter or visiting the polling station. I rather see an opportunity for the voter to verify that the vote has been correctly carried depending on the implementation of the e-voting system. But for that I still need a closer look into the details of this system (which I will do as it concern myself). At the moment I see the project quite positive. For example in Germany they used a closed sourced software called "PC Wahl" and the ccc had quite some difficulties to get the source code. And when they got it the catastrophe just began. The software included such funny things like a 1 byte (sic!) hash as checksum. Then it had a weird encryption created by the guy who coded the software, which wouldn't even met 80's standards. Also the software was distributed via a cheap, hosted web server with the login credentials "test" "test" (sic!) and there wasn't any signatures for the updates nor for the transmitted results. To see the hole catastrophe you can watch "PC Wahl Hack" with Linus Neumann. It's quite funny especially when you hear that the software company (from that one guy who coded it since the 90s) was sold for about 1 Mio. €.

yholio 8y ago

> whats the expected value of a vulnerability "undetectable by voters and trusted auditors" in a 10-20 Mio/y market You might be low balling it yourself. The influence market has a limited value because players who would want to influence towards outlandish outcomes (ex. a union with Russia, declaring war to Germany or simply self-destruction via civil war) know they are wasting their money since their desired outcome is essentially impossible to achieve. A system where you can enforce a change of leadership in a OECD country with 700 billion GDP is worth at least billions, if not tens of billions. You could recover most of your costs simply by influencing government purchasing for 4 years, and get any politically desired outcomes for free.

jwandborg 8y ago

I'm not sure the maximum is 50000 CHF. They present it as "Minimum compensation: Between 30000-50000 CHF" which is a bit ambiguous.