Detailed audit of Voatz' voting app confirms security flaws

The honest answer is that I have no idea. In the version we reverse engineered, there's no proof of inclusion of any of the data in the blockchain in the client, and the receipt system was via a PDF. The vote selections (ballot?) are also never signed by the client.

It's also worth noting that, according to the ToB article, the backend blockchain is a permissioned hyperledger instance, which runs PBFT[1] rather than proof of work. PBFT is controllable with roughly 1/3 of the network, 100% of which has been controlled by the company.

[1]http://pmg.csail.mit.edu/papers/osdi99.pdf

My bet would be: marketing. Blockchain is hot, blockchain is sexy -- at least among people who aren't really technically inclined. (The technically inclined passed over the blockchain hype curve several years ago.)

There are tons of blockchain projects out there whose only real use for the blockchain is to be able to slap "now with blockchain!" on the sales materials.

Er... the word 'blockchain', obviously. Catnip to a certain type of VC.

I don't think we can with the current commodity devices / ecosystem, even assuming that voting system software is well-written. Keeping electronic-only systems secure from nation-state level adversaries is hard.

Anyway, I'll let Tom Scott take it: https://www.youtube.com/watch?v=LkH2r-sNjQs

The biggest reason is that banking and other financial transactions have a very different threat model from voting.

In particular, voting requires a secret ballot. In addition to preventing an adversary from learning how you voted, a secret ballot requires you to be unable to prove how you voted, to prevent vote selling and coercion.

So, unlike financial transactions, how you do validation / remediation of failures is very unclear. Ben Adida has a blog post with further thoughts here (https://benlog.com/2007/03/02/on-voting-banking-and-bad-anal...).

We really can't. Banking is riddled with fraud, and I say that as someone who works in banking and has designed online banking software. Even with continually ratcheting up security in banking software, use of MFA, encouraging customers to more-secure platforms (Android/iOS), fraud detection (various approaches on the back ends, edge, etc), fraud through online applications is many orders of magnitude higher than fraud in traditional voting systems.

It doesn't matter so much in banking because we can (and do) give customers their money back. We can't fix a broken election.

And that's before we get into the way online voting completely fucks election practises around vote buying, coercion, etc.

I wish people who think they understand computers and are clever would actually make the effort to learn something about either domain before saying stuff like this. It's very disappointing.

The biggest thing the measures do is significantly decrease the known ROI on a target. For example, a credit card can be cancelled. Even if the bank doesn't notice and the person doesn't notice and you do get 100k off it, the fact attackers don't know that still reduces the value of the stolen credit card and therefore the incentive to steal them. Further the gain of 100k by an attacker may be split amongst cardholder, card issued, insurance, merchants, etc. so no one person actually loses 100k. These things all matter when building and securing new systems.

If you look at the cryptocurrency space in general, you can see what happens when you replace a credit card or swift with transactions that are similtaneously immutable, very valuable, and easily anonymous enough. The monetary value on anyone's Coinbase account, let alone all the Coinbase accounts, is so high that we've seen attacks[2] usually reserved for nation-state actors and by actual nation state actors[3], including sophisticated + targetted zero-days and bgp hijacks and all sorts of fun stuff. Not to mention the very high density of attacks that require lower effort and talent like sim swaps, phishing, spear-phishing, impersonation, typosquatting, on and on.

Regardless, if the potential gains to hack a bank are level 1, and crypto exchanges or private keys are a 10, then voting is 1,000,000.

The zero-sum nature of winning an election coupled with the potential gains from doing so are so large and so unfathomable that we have to assume that the lengths people will go to are unfathomably more than everything else we've ever tried to secure. Bc if you can gaurentee a win for a candidate or choose the candidate or change the candidate, you can do anything. You can own anything. You can control anything. You can make any amount of money. The limit is only your talents, abilities, moral compass, and appetite for risk.

To protect against a huge number of attackers, including nation state ones with essentially unlimited resources and the incentive to use those unlimited resources is…it's never been done. Again, back to Coinbase, they secure their crypto with...wait for it…paper. Generated and printed using randomly chosen, single-time, fully-airgapped machines. In a random location. In a Faraday cage.[4] That's how you secure billions when you don't have an undo button. With paper. While not even trusting the electricity flowing thru the cable.

As we saw in the 2016 election, Brexit, and lesser know elections across the globe, it takes very little to secure a win. With the right data (which is even more accessible today than it was in 2016) you only need to manipulate relatively small amount of voters. I'm too lazy to look it up but the numbers were insane when you looked at who was targeted by VoteLeave and Trump's campaign. They may have served 40m ads but it was only to like 40k people.

And that wasn't hacking anything. And those were huge-scale elections. And we still don't know who gained what from their outcomes, just that a lot of people spent a decent amount of money and a huge amount of effort to do so. And it wasn't selfless.

Small towns make gains more obvious. If small town mayor decides who gets the contract for building the new 10M town hall and if you can build it for 5M, you have 4.9M to spend on winning that contract. (Well 5M - resources to rig election - gain required for you to take the risk and put in the effort.) And, given the size of government contracts and their ongoing nature, the financial gains alone are massive. Military contractors: trillions and trillions.[5]

Even securing a single contract early on can ensure your success down the line. Maximus handles tons of Los Angeles welfare programs and now all sorts of programs around the globe. They have for 40+ years. They have billions in annual revenues from doing so. E.g. "In September 2012, the Illinois Department of Healthcare and Family Services awarded Maximus Health Services a two-year, $76.8 million contract to help the state with its Medicaid program. That same month, Maximus announced a $23.5 million contract with the State of Oklahoma."[6] Most of these contracts are decided not by the president but a random group of 5-7 officials at a meeting no one knows about where there is no competition and no real discussion.

Again, these are just a few very, very, very simple incentives people have to manipulate votes. Again, go look at 2016 Trump election or Brexit in depth to understand truly what is currently known about the number of people and the lengths they went to to get an election won. Without hacking. Check back in 40 years after more details emerge. We just don't even know yet.

The reason I have zero faith in any tech being successful in the nearish term with regards to voting is not that I think programmers suck or that politics is corrupt. It's that it's truly unprecedented on an incentives level and risk level. And, it's not just that the risk and potential loss for society or potential gain for attackers is so huge, it's also that we don't even know what it is, and even if we did, we wouldn't be able to comprehend it. How do you secure that when that's what you're up against?

The scope of what we do know about banking fraud, crypto fraud, and paper voting fraud is so great and we are always one step behind attacks and mitigate risk in millions of little ways because we can't fully reduce it. But you can't hedge against election fraud. There's no insurance. There's no undo button. There's no time travel.

And that means that, very unlike financial services, the amount you have to spend to secure an app of this nature is actually one resource more than the attackers are willing to spend to get their way in an election. Or one resource less than the amount lost if an attacker wins. But what even is the value of people, our future, our literal lives? Society, war, money, peace, contracts, the fed, interest rates, all the markets, all the debt, n95 masks, new buildings, old buildings, corruption, legitimacy? We can't know which of these attackers are going after therefore you have to protect against all. And there literally isn't enough resources in the world for that.

Zooming back down to simple: there isn't enough money to even secure an app for a single small town that has a single contract for $10M and will never have another contract and there is, impossibly, no other possible gain for rigging the election. I mean, there literally is enough money. But why spend $1M or $2M or $5M on that app? Why even spend a dollar? Why do so when it doesn't actually reduce all the other risks of election manipulation and corruption that are currently in practice while adding a whole new variety of known and unknown attack surfaces and exacerbates existing ones? You wouldn't. Period.

Why would a company try to build an app knowing this? Well, either they're optimistic and altruistic as fuck and don't know it. Or, second, they are taking advantage of you. Or, third and most terrifying, is the act of building a voting app itself is actually the way to rig the election.

Voatz, without a shadow of a doubt, is not the first. Perhaps the second. But the third? When you consider the timing of Voatz' fundraise, who they raised money from, the goddamn timing, the fact they didn't die when it was discovered they were using old ass php and plesk in 2018, and the fact the app is actually still this fucking completely worthless and insecure and hasn't improved, well, I can't say that it's not an attempt to rig an election but it's def not the US who's doing the rigging. They would go to far greater lengths.[7]

---

1: https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery or great podcast on it for audio lovers https://www.stitcher.com/podcast/mugshot-podcast/mugshot

2: “Responding to Firefox 0-days in the wild” by Philip Martin https://link.medium.com/x8tNj2rc14

3: https://blog.chainalysis.com/reports/cryptocurrency-exchange...

4: https://www.wired.com/story/coinbase-physical-vault-to-secur...

5: https://247wallst.com/special-report/2019/02/21/20-companies...

6: https://en.wikipedia.org/wiki/Maximus_Inc.

7: https://archive.nytimes.com/www.nytimes.com/interactive/2013...

It's not a vulnerability in itself, but the fear/stop energy created by artisanal small-batch infrastructure is a good way to set yourself up for vulnerabilities being exploitable. (See, for instance, Equifax being hacked by a two-month-old Struts vulnerability - you can theoretically argue that Equifax is a big company and should carefully audit their dependencies, but a much more practical argument is that Equifax should have been ready to patch within days, at most, of the vulnerability being announced.)

The actual ToB report identifies another reason which I didn't think of:

> Ensure that all backend infrastructure is re-provisioned between elections and not shared between elections/clients. Each server should also receive its own unique SSL certificate and credentials. Use infrastructure-as-code tools like Ansible and Terraform to automate and manage provisioning.

Apparently there are two concrete problems:

1. All Voatz backend servers share a single wildcard certificate, and they think that automated provisioning would reduce the incentive to do things like this.

2. Every Voatz election uses a custom iOS/Android app delivered via TestFlight / Google Play Beta, because of some design choices in the protocol related to having a single shared backend (S3, MongoDB, etc.). They think that if there were infrastructure-as-code for the shared backends, it'd be easier to provision one instance per election and easier to make the client change to use a single client for each election, blocking potential attacks on the page that links you to the sideloaded app.

Other countries do that, and all attempts to "automate" or improve the UI of voting introduce all sorts of problems.

First, that's a mighty big if, and second, it's not enough!

Voting is a process where unlike online banking or online shopping there is no way for a human to go in and fix errors, there's no way to audit a vote and go "Oh, Bob meant to vote for A and Cindy meant to vote for B, so the machine did it wrong". It's not enough that an electronic voting system is correct, every single voter has to be able to trust the system, and for that it needs to be simple to understand.

You can't look at the electrons inside a silicon chip to determine they're doing the right thing. But with pen and paper and envelopes and urns and observers and counters, you can determine that the system is doing the right thing. Involving lots and lots of citizens in the voting system is not a bad thing, quite the opposite! You want as many eyes as possible on the entire process to ensure there's nothing shady going on, that there's no mistakes.

But if all the votes go into a black box that spits out the results, all of that goes away, all of that trust, all of that ability to verify that the results are correct.

They'd have to give each voter some sort of voting device with a screen, buttons and wireless connectivity, and make sure that the voter doesn't lose it so that it can be reused for the next election, or buy these devices each election. Too much trouble.