Software to capture votes in upcoming German national election is insecure
Here's the report: <a href="https://ccc.de/system/uploads/230/original/PC-Wahl_Bericht_CCC.pdf" rel="nofollow">https://ccc.de/system/uploads/230/original/PC-Wahl_Bericht_C...</a><p>It's truly disastrous. Some of the findings:<p>- The automated software updates have no signature and are downloaded insecurely over HTTP<p>- The webserver the updates are downloaded from is hosted using a shared hosting package at 1&1, on a host with >5000 other customers (implying an easy takeover using local privilege escalation)<p>- The reason they know this? They found multiple PHP scripts vulnerable to arbitrary read and write vulnerabilities, so they got full RCE on the server.<p>- FTP access credentials for the website were contained in a public ZIP file (named test.zip)<p>- Vote results are transmitted using either insecure FTP whose credentials weren't rotated for years or an equally insecure XML protocol. No signatures in sight.<p>- Said insecure XML protocol is a <i>government standard</i><p>They also took a look at one of the local government's infrastructure:<p>- test/test were valid VPN credentials<p>- FTP credentials were publicly downloadable with R/W access to vote results<p>- Vote result encryption was reversible thanks to a hardcoded symmetric key<p>The report goes on to detail even more trivial security issues, including home-grown "encryption" algorithms worse than what you'd find in a beginner CTF challenge.<p>None of the steps taken in response addressed the fundamental, obvious security policy issues. Even their band-aid fixes were broken. For example, they started signing their binaries, but forgot to check the signature.<p>Given the lack of any security awareness whatsoever, even if they properly sign their binaries, their build server is probably easy to compromise.<p>RCE demo: <a href="https://vimeo.com/232581770" rel="nofollow">https://vimeo.com/232581770</a><p>Have a look at the site in question: <a href="https://www.wahlinfo.de/" rel="nofollow">https://www.wahlinfo.de/</a><p>The local government they worked with responded by enforcing verification and transmission of the results using an independent channel.