15 ms·

New South Wales Attacks Researchers Who Found Internet Voting Vulnerabilities

234 points by spenvo 12y ago

TazeTSchnitzel 12y ago
Exactly the same thing happened in Estonia when serious flaws in their system were discovered: http://estoniaevoting.org/ http://estoniaevoting.org/ And if you, in an Internet comment, dare to suggest that Estonia's system isn't airtight and hyper-secure, you'll get mobbed by Estonian trolls. :/
- femto 12y ago
  As a New South Welshman, I'll mob you if you suggest that the NSW Government is capable of anything but incompetence. Both major political parties are paralysed by corruption [1]. The irony is that a world leading electronic voting system was developed by Andrew Tridgell, who lives in the ACT, which is a stone's throw from NSW (in any direction) [2]. The NSW Electoral Commission was quite free to download the GPL source code and use it as a base. I gather the GPL'd system has since been replaced with a proprietary one by the commercial partner, with the proprietary system being released under the same name [3]. [1] http://www.dailytelegraph.com.au/news/nsw/icac-exposes-the-nsw-legislature-as-the-most-corrupt-parliament-in-australian-history/story-fni0cx12-1227040649242 http://www.dailytelegraph.com.au/news/nsw/icac-exposes-the-n... [2] http://www.elections.act.gov.au/elections_and_voting/electronic_voting_and_counting http://www.elections.act.gov.au/elections_and_voting/electro... [3] http://archive09.linux.com/feature/38285 http://archive09.linux.com/feature/38285
  - bootload 12y ago
    "The irony is that a world leading electronic voting system was developed by Andrew Tridgell" Of Samba, Rsync, rproxy, KnightCap, hacking Tivo, SourcePuller and a host of others. Also COMP8440 at ANU ~ https://www.samba.org/~tridge/ https://www.samba.org/~tridge/
  - kyloon 12y ago
    I concur, the entire Opal/Tcard fiasco is already a good example of how things are done by the NSW Government.
    - triggercut 12y ago
      As an aside, back in the early 2000's the NSW Government contracted ERG (a Perth based technology company) to implement a Smart Card system for public transport. ERG had already successfully rolled out Smart Card systems for other local public transport systems worldwide to much success, most notably for the Hong Kong public transport system, the MTR (Octopus Card), in 1997, which is still the largest such deployment to date with tens of millions of transactions daily. Unfortunately the NSW contract ended in lawsuits back and forth with the NSW Government trying to reclaim the project cost and eventually (arguably) led to ERG's demise. Sad that a successful Australian company, a leader in it's field, able to deploy complicated systems worldwide was (in part) taken down in it's own backyard by a (in comparison) pretty straight forward project.
- mikewilliams 12y ago
  In my opinion it was the patronizing tone Alex Haldermann had when presenting his research, that got certain individuals riled up. About the electronic voting itself, it seemed to me that the most relevant problem that he actually discovered was lapses in the operational security during the vote counting process, where certain procedures weren't done correctly or were outright ignored.
espes 12y ago
iVote in a nutshell: "The NSWEC believes that unfettered access to source code by the general public would not be in the best interest of the State" (http://www.elections.nsw.gov.au/__data/assets/pdf_file/0003/125454/iVote_Strategy_for_SGE_2015_Amendment_4_-_March_2015.pdf http://www.elections.nsw.gov.au/__data/assets/pdf_file/0003/...) This apparently matters so much that it was specifically criminalised: "A person must not disclose to any other person any source code or other computer software that relates to technology assisted voting under the approved procedures, except in accordance with the approved procedures or in accordance with any arrangement entered into by the person with the Electoral Commissioner. Maximum penalty: 5 penalty units, or imprisonment for a term not exceeding 6 months, or both." (http://www.austlii.edu.au/au/legis/nsw/consol_act/peaea1912382/s120ag.html http://www.austlii.edu.au/au/legis/nsw/consol_act/peaea19123...) Oh, and the whole thing runs on custom javascript crypto: https://cvs.ivote.nsw.gov.au/scy-libs/crypto-lib.js https://cvs.ivote.nsw.gov.au/scy-libs/crypto-lib.js
- rtpg 12y ago
  I realize the inherit issues with rewriting crpyto, but does the javascript-ness of it matter? Serious question, I feel like I've heard saying that it can be a factor.
  - gtank 12y ago
    People who object to javascript crypto usually mean that in the context of "browser javascript", which is fraught with peril [1]. The javascript language itself isn't necessarily the problem (although parts of it are dodgy by the standards of what you'd like to implement crypto with). [1] http://matasano.com/articles/javascript-cryptography/ http://matasano.com/articles/javascript-cryptography/
  - RKoutnik 12y ago
    gtank explains the browser crypto problem well - there are a few issues writing JS crypto on the server though. I've been going through the CryptoPals challenges with Node.js and have hit a few snags, virtually all of them involving types. I've switched to TypeScript and things have gone much smoother. The crypto module does add some padding unexpectedly, though I'm not knowledgeable enough to say if that's according to spec or not.
carrotleads 12y ago
I find the main media silence regarding vulnerabilities in the Electronic Voting Machines in India similarly baffling.
- woah 12y ago
  Maybe vulnerabilities in the tech are simply not that important.
  - carrotleads 12y ago
    I think its the assumption that EVM's are built as a blackbox and so unhackable. Snowden has revealed enough to suggest that may not be the case, so it is quite surprising.
  - _lce0 12y ago
    missing /sarcasms? I hope so..
zaroth 12y ago
The narrative here is confusing.. The Chief Information Officer of the Electoral Commission, Ian Brightwell, claimed Halderman and Teague’s discovery was part of efforts by “well-funded, well-managed anti-internet voting lobby groups,” an apparent reference to our friends at VerifiedVoting.org, where Halderman and Teague are voluntary Advisory Board members. So, the CIO complains it's a smear job by an anti-internet-voting lobby group, (which it apparently was?) Yet at the same time, Brightwell concluded that it was indeed possible that votes were manipulated. Happily, despite criticizing the messengers, the Electoral Commission admitted that there was a FREAK flaw with iVote and scrambled to promptly patch it. Then they admitted the vulnerability and rushed to patch it. Which is exactly the hoped-for response? So what is South Wales doing wrong here, you know, other than trying to let people vote over the internet, which is a horrible idea, only perhaps matched by the absurdity of our current generation of e-voting machines? I understand their hands are not clean in many other regards with this program, but patching their cipher suite just doesn't seem newsworthy... BTW, an open source voting machine platform (for use at the polling station) sounds like a great project for USDS or 18F.
- madeofpalk 12y ago
  > So what is South Wales doing wrong here FYI, it's New South Wales (NSW). Nothing to do with the lower portion of Wales in the UK.
- nknighthb 12y ago
  There is only one correct response: "We thank the researchers who pointed out our mistakes, and apologize to all voters for our failure to adequately secure a vital system.". The only correct response now, on the other hand, is the immediate firing of this "CIO", who clearly does not have the mentality necessary to be a CIO or a public servant.
  - sthreet 12y ago
    They should also thank the researchers for not making 66,000 votes count towards something ridiculous, because unless I thought they would freak out about my way of proving a point, I would probably have did that when I told them how to secure their thing.
DigitalSea 12y ago
Everyday Australia inches one step towards being the new China. This is a drop in the bucket compared to the kind of legislation the TPP when passed will impose on Australians.
- 13 12y ago
  The "emergency" bulk internet surveillance is chilling too.
  - PebblesHD 12y ago
    I'm not terribly worried about this actually, it seems more like general incompetence and pandering to our friends in Hollywood rather than an intentionally malicious step toward mass surveillance. I don't think its really capable of tracking anything more than who is download GoT on a regular basic... /sarcasm Seriously though it is indeed concerning the way both major parties are heading with this, even if they had the best intentions its a nasty path.
    - 13 12y ago
      https://i.imgur.com/0pmIted.jpg https://i.imgur.com/0pmIted.jpg
- anigbrowl 12y ago
  Slavoj Zizek has been persistently arguing (though I don't think he claims the original observation as his own) that 'western' liberal-capitalist democracy has developed a dangerous infatuation with the Singapore model of authoritarian capitalism and its pro-forma ather than substantive approach to democracy.
  - rodgerd 12y ago
    That's not an unreasonable argument. Here in NZ various political leaders (e.g. Don Brash) and prominent business lobbyists (members of the now-defunct Business Roundtable, for example) have been quite open in their desire to see New Zealand be "more like Singapore" (though not, curiously, on topics such as large-scale state intervention in housing or telecommunications, for example).
deleted 12y ago
[deleted]
makeitsuckless 12y ago
Internet voting has two essential, unpatchable vulnerabilities: voters cannot vote anonymously and are exposed to external pressure. That's why we have voting booths: so people are guaranteed to be able to vote without someone looking over their shoulder (or pointing a gun at their heads). If people cannot vote in total freedom and anonymity, it's not a truly free and democratic vote. We should stop trying to "solve" everything with technology. Some things should be "hard", because it's essential to get it right.
- codeka 12y ago
  That would be a problem if internet voting was the only option, but surely if the "normal" way of voting was still to come in to the polling place on the day and cast a paper vote, then online voting as an option for people who are unable to make it to the polling place on the day is not a bad idea?
  - xroche 12y ago
    How do you solve the coercion problem ? How do you solve ballot corruption (ie. I'm selling my vote on ebay) ?
    - tomjen3 12y ago
      Can you do that even now? I can trivially bring a cellphone into a voting booth and take a picture even now.
      - the8472 12y ago
        That picture could be shooped, therefore it does not provide proof to the coercing party. The threat model for coercion-resistance is providing proof to someone after you have cast your vote. The threat model for anonymity is that an observer - either a 3rd party or someone colluding with the voting authority - that does not have access to the voting client itself. Voting-at-gunpoint coercion as threat model cannot really be defended against because it basically implies that the attacker has full control over the voter. Even some scheme that would allow vote retraction/recasting wouldn't help since the attacker could simply keep threatening the voter until the election is over.
l33tbro 12y ago
This was actually reported a couple of weeks ago [1] in the some of the less populist Austrlaian press. Didn't seem to get much more media traction it seems. [1] http://www.abc.net.au/news/2015-03-23/ivote-security-hack-allowed-change-of-vote-security-expert-says/6340168 http://www.abc.net.au/news/2015-03-23/ivote-security-hack-al...
joshfraser 12y ago
Two things would help online voting tremendously: 1) Open-source code. That's how you find the bugs and build confidence. 2) Opt-in privacy. Ballots could be like Facebook-posts - public by default, with optional privacy. After the election closes, the results would be posted on the web where everyone who voted publicly could verify that their own vote was counted correctly.
jobigoud 12y ago
One thing I always wondered about traditional voting, how are the final counts transferred to the central counting system? Electronically? If so, do we know if this transfer is secure?
- jacques_chester 12y ago
  In Australia the ballots are counted multiple times, including an initial count at each of the booths. They're then physically relocated to Electoral Commission offices for recounting, usually twice. All ballot boxes are numbered and a tally of votes cast is kept. Each box is sealed in the presence of party scrutineers with numbered tags and signed for. It's sealed and tagged again before shipment. Each is opened and signed for in the presence of scrutineers. The number of ballots is compared to the number of names marked off the electoral roll at each booth. If a sufficiently large irregularity occurs, one of the political parties will take the matter to the Court of Disputed Returns, which can force fresh elections. This happened recently because several ballot boxes for Federal Senate votes in Western Australia were lost by the AEC. The number of votes in question were enough to leave the 6th Senate seat in doubt, so the Court voided the election.

234 points by spenvo 12y ago

Exactly the same thing happened in Estonia when serious flaws in their system were discovered: http://estoniaevoting.org/ http://estoniaevoting.org/ And if you, in an Internet comment, dare to suggest that Estonia's system isn't airtight and hyper-secure, you'll get mobbed by Estonian trolls. :/

femto 12y ago
As a New South Welshman, I'll mob you if you suggest that the NSW Government is capable of anything but incompetence. Both major political parties are paralysed by corruption [1]. The irony is that a world leading electronic voting system was developed by Andrew Tridgell, who lives in the ACT, which is a stone's throw from NSW (in any direction) [2]. The NSW Electoral Commission was quite free to download the GPL source code and use it as a base. I gather the GPL'd system has since been replaced with a proprietary one by the commercial partner, with the proprietary system being released under the same name [3]. [1] http://www.dailytelegraph.com.au/news/nsw/icac-exposes-the-nsw-legislature-as-the-most-corrupt-parliament-in-australian-history/story-fni0cx12-1227040649242 http://www.dailytelegraph.com.au/news/nsw/icac-exposes-the-n... [2] http://www.elections.act.gov.au/elections_and_voting/electronic_voting_and_counting http://www.elections.act.gov.au/elections_and_voting/electro... [3] http://archive09.linux.com/feature/38285 http://archive09.linux.com/feature/38285
- bootload 12y ago
  "The irony is that a world leading electronic voting system was developed by Andrew Tridgell" Of Samba, Rsync, rproxy, KnightCap, hacking Tivo, SourcePuller and a host of others. Also COMP8440 at ANU ~ https://www.samba.org/~tridge/ https://www.samba.org/~tridge/
- kyloon 12y ago
  I concur, the entire Opal/Tcard fiasco is already a good example of how things are done by the NSW Government.
  - triggercut 12y ago
    As an aside, back in the early 2000's the NSW Government contracted ERG (a Perth based technology company) to implement a Smart Card system for public transport. ERG had already successfully rolled out Smart Card systems for other local public transport systems worldwide to much success, most notably for the Hong Kong public transport system, the MTR (Octopus Card), in 1997, which is still the largest such deployment to date with tens of millions of transactions daily. Unfortunately the NSW contract ended in lawsuits back and forth with the NSW Government trying to reclaim the project cost and eventually (arguably) led to ERG's demise. Sad that a successful Australian company, a leader in it's field, able to deploy complicated systems worldwide was (in part) taken down in it's own backyard by a (in comparison) pretty straight forward project.
mikewilliams 12y ago
In my opinion it was the patronizing tone Alex Haldermann had when presenting his research, that got certain individuals riled up. About the electronic voting itself, it seemed to me that the most relevant problem that he actually discovered was lapses in the operational security during the vote counting process, where certain procedures weren't done correctly or were outright ignored.

espes 12y ago

iVote in a nutshell: "The NSWEC believes that unfettered access to source code by the general public would not be in the best interest of the State" (http://www.elections.nsw.gov.au/__data/assets/pdf_file/0003/125454/iVote_Strategy_for_SGE_2015_Amendment_4_-_March_2015.pdf http://www.elections.nsw.gov.au/__data/assets/pdf_file/0003/...) This apparently matters so much that it was specifically criminalised: "A person must not disclose to any other person any source code or other computer software that relates to technology assisted voting under the approved procedures, except in accordance with the approved procedures or in accordance with any arrangement entered into by the person with the Electoral Commissioner. Maximum penalty: 5 penalty units, or imprisonment for a term not exceeding 6 months, or both." (http://www.austlii.edu.au/au/legis/nsw/consol_act/peaea1912382/s120ag.html http://www.austlii.edu.au/au/legis/nsw/consol_act/peaea19123...) Oh, and the whole thing runs on custom javascript crypto: https://cvs.ivote.nsw.gov.au/scy-libs/crypto-lib.js https://cvs.ivote.nsw.gov.au/scy-libs/crypto-lib.js

rtpg 12y ago
I realize the inherit issues with rewriting crpyto, but does the javascript-ness of it matter? Serious question, I feel like I've heard saying that it can be a factor.
- gtank 12y ago
  People who object to javascript crypto usually mean that in the context of "browser javascript", which is fraught with peril [1]. The javascript language itself isn't necessarily the problem (although parts of it are dodgy by the standards of what you'd like to implement crypto with). [1] http://matasano.com/articles/javascript-cryptography/ http://matasano.com/articles/javascript-cryptography/
- RKoutnik 12y ago
  gtank explains the browser crypto problem well - there are a few issues writing JS crypto on the server though. I've been going through the CryptoPals challenges with Node.js and have hit a few snags, virtually all of them involving types. I've switched to TypeScript and things have gone much smoother. The crypto module does add some padding unexpectedly, though I'm not knowledgeable enough to say if that's according to spec or not.

carrotleads 12y ago

I find the main media silence regarding vulnerabilities in the Electronic Voting Machines in India similarly baffling.

woah 12y ago
Maybe vulnerabilities in the tech are simply not that important.
- carrotleads 12y ago
  I think its the assumption that EVM's are built as a blackbox and so unhackable. Snowden has revealed enough to suggest that may not be the case, so it is quite surprising.
- _lce0 12y ago
  missing /sarcasms? I hope so..

zaroth 12y ago

The narrative here is confusing.. The Chief Information Officer of the Electoral Commission, Ian Brightwell, claimed Halderman and Teague’s discovery was part of efforts by “well-funded, well-managed anti-internet voting lobby groups,” an apparent reference to our friends at VerifiedVoting.org, where Halderman and Teague are voluntary Advisory Board members. So, the CIO complains it's a smear job by an anti-internet-voting lobby group, (which it apparently was?) Yet at the same time, Brightwell concluded that it was indeed possible that votes were manipulated. Happily, despite criticizing the messengers, the Electoral Commission admitted that there was a FREAK flaw with iVote and scrambled to promptly patch it. Then they admitted the vulnerability and rushed to patch it. Which is exactly the hoped-for response? So what is South Wales doing wrong here, you know, other than trying to let people vote over the internet, which is a horrible idea, only perhaps matched by the absurdity of our current generation of e-voting machines? I understand their hands are not clean in many other regards with this program, but patching their cipher suite just doesn't seem newsworthy... BTW, an open source voting machine platform (for use at the polling station) sounds like a great project for USDS or 18F.

madeofpalk 12y ago
> So what is South Wales doing wrong here FYI, it's New South Wales (NSW). Nothing to do with the lower portion of Wales in the UK.
nknighthb 12y ago
There is only one correct response: "We thank the researchers who pointed out our mistakes, and apologize to all voters for our failure to adequately secure a vital system.". The only correct response now, on the other hand, is the immediate firing of this "CIO", who clearly does not have the mentality necessary to be a CIO or a public servant.
- sthreet 12y ago
  They should also thank the researchers for not making 66,000 votes count towards something ridiculous, because unless I thought they would freak out about my way of proving a point, I would probably have did that when I told them how to secure their thing.

DigitalSea 12y ago

Everyday Australia inches one step towards being the new China. This is a drop in the bucket compared to the kind of legislation the TPP when passed will impose on Australians.

13 12y ago
The "emergency" bulk internet surveillance is chilling too.
- PebblesHD 12y ago
  I'm not terribly worried about this actually, it seems more like general incompetence and pandering to our friends in Hollywood rather than an intentionally malicious step toward mass surveillance. I don't think its really capable of tracking anything more than who is download GoT on a regular basic... /sarcasm Seriously though it is indeed concerning the way both major parties are heading with this, even if they had the best intentions its a nasty path.
  - 13 12y ago
    https://i.imgur.com/0pmIted.jpg https://i.imgur.com/0pmIted.jpg
anigbrowl 12y ago
Slavoj Zizek has been persistently arguing (though I don't think he claims the original observation as his own) that 'western' liberal-capitalist democracy has developed a dangerous infatuation with the Singapore model of authoritarian capitalism and its pro-forma ather than substantive approach to democracy.
- rodgerd 12y ago
  That's not an unreasonable argument. Here in NZ various political leaders (e.g. Don Brash) and prominent business lobbyists (members of the now-defunct Business Roundtable, for example) have been quite open in their desire to see New Zealand be "more like Singapore" (though not, curiously, on topics such as large-scale state intervention in housing or telecommunications, for example).

deleted 12y ago

[deleted]

makeitsuckless 12y ago

Internet voting has two essential, unpatchable vulnerabilities: voters cannot vote anonymously and are exposed to external pressure. That's why we have voting booths: so people are guaranteed to be able to vote without someone looking over their shoulder (or pointing a gun at their heads). If people cannot vote in total freedom and anonymity, it's not a truly free and democratic vote. We should stop trying to "solve" everything with technology. Some things should be "hard", because it's essential to get it right.

codeka 12y ago
That would be a problem if internet voting was the only option, but surely if the "normal" way of voting was still to come in to the polling place on the day and cast a paper vote, then online voting as an option for people who are unable to make it to the polling place on the day is not a bad idea?
- xroche 12y ago
  How do you solve the coercion problem ? How do you solve ballot corruption (ie. I'm selling my vote on ebay) ?
  - tomjen3 12y ago
    Can you do that even now? I can trivially bring a cellphone into a voting booth and take a picture even now.
    - the8472 12y ago
      That picture could be shooped, therefore it does not provide proof to the coercing party. The threat model for coercion-resistance is providing proof to someone after you have cast your vote. The threat model for anonymity is that an observer - either a 3rd party or someone colluding with the voting authority - that does not have access to the voting client itself. Voting-at-gunpoint coercion as threat model cannot really be defended against because it basically implies that the attacker has full control over the voter. Even some scheme that would allow vote retraction/recasting wouldn't help since the attacker could simply keep threatening the voter until the election is over.

l33tbro 12y ago

This was actually reported a couple of weeks ago [1] in the some of the less populist Austrlaian press. Didn't seem to get much more media traction it seems. [1] http://www.abc.net.au/news/2015-03-23/ivote-security-hack-allowed-change-of-vote-security-expert-says/6340168 http://www.abc.net.au/news/2015-03-23/ivote-security-hack-al...

joshfraser 12y ago

Two things would help online voting tremendously: 1) Open-source code. That's how you find the bugs and build confidence. 2) Opt-in privacy. Ballots could be like Facebook-posts - public by default, with optional privacy. After the election closes, the results would be posted on the web where everyone who voted publicly could verify that their own vote was counted correctly.

jobigoud 12y ago

One thing I always wondered about traditional voting, how are the final counts transferred to the central counting system? Electronically? If so, do we know if this transfer is secure?

jacques_chester 12y ago
In Australia the ballots are counted multiple times, including an initial count at each of the booths. They're then physically relocated to Electoral Commission offices for recounting, usually twice. All ballot boxes are numbered and a tally of votes cast is kept. Each box is sealed in the presence of party scrutineers with numbered tags and signed for. It's sealed and tagged again before shipment. Each is opened and signed for in the presence of scrutineers. The number of ballots is compared to the number of names marked off the electoral roll at each booth. If a sufficiently large irregularity occurs, one of the political parties will take the matter to the Court of Disputed Returns, which can force fresh elections. This happened recently because several ballot boxes for Federal Senate votes in Western Australia were lost by the AEC. The number of votes in question were enough to leave the 6th Senate seat in doubt, so the Court voided the election.