Hacker discovered a new gap in the Post-E-Voting

During a month is tested over 3000 hackers in a public Test of how safe the E-Voting System, the Post . Already in mid-March, they discovered a critical security gap. The error related to the universal verifiability. The Post had asked its technology partner Scytl, to correct the error in the Code immediately.

Now, the canadian cryptologist Sarah Jamie Lewis has uncovered a further instance of maladministration, as the initiators of the popular initiative "For a secure and trusted democracy."

According to Lewis cast votes can be voided, and that this is reliably noted. "Formal would be, however, provided proof that no Manipulation has taken place. Thus were the unwanted voices to Disappear," write the initiators.

The media office of the Yellow giant confirmed: "The Post has received another note from the researchers to the source code of their E-Voting system." It was because the facts of the case in Detail to clarify. The correction will loaded with the next regular Release and published. "The Post is your technology partner Scytl in contact."

That was enough scenario to make the individual votes cast invalid, the Post. "This would not be, in any case, in the decryption and tallying noted, because the E-Voting System of the Post allows it, in principle, invalid votes." It can be excluded that the scenario votes undetected changes or elections could be manipulated.

In reality, it is very difficult to exploit vulnerability, because an attacker would have to employ a number of protective measures. "He would need, for example, the control of the secure IT infrastructure of the Post and would have to also install malicious software on the device of a voter."

Since the end of February of the Confederation and the cantons arranged public intrusion test of the E-Voting system, the Post runs. Over 3000 hackers from around the world tested until yesterday, the System. Whoever cracks it, will receive a prize of up to CHF 50'000.

Lewis took part in the so-called intrusion test to the Post office, but verified by the Post laid-open source code in-house.

The initiators of the E-Voting moratorium request, to prohibit the use of electronic voting, so long as, "until there are systems that are secure against Hacker attacks and in which the Auszählprozedere of the votes cast for the citizens is understandable and transparent".

the Federal government and the cantons will be reviewing the results of the Tests and publish a report. The Federal Chancellery will examine according to its own information, whether further adjustments to the new System are necessary, and whether adjustments have to be made to the existing System.

The electronic ballot box on Sunday, 24. March 2019 closed. The participating researchers are able to on Monday, 25. March 24 at findings to submit. "These last entries are currently being analyzed. The analysis will take a few days. Once completed, it will inform the Post about the conclusion of the public intrusion tests", says the Mail today.

The source code of the E-Voting system would be placed - as in the case of the publication of the source code in front of a good six weeks, already announced, is still open. The Post take continue to feedback on the designated platform GitLab.

(ta)

Created: 25.03.2019, 09:29 PM