#rC3 - Hacking German Elections

rC3 preroll music

Herald: Now, our next talk is Hacking
German elections, insecure electronic

voting count, vote counting, how it
returned and why you don't even know about

it. For the Germans listening here, did
you noticed that in Germany, voting became

more electronic recently? In case you're
out of Germany. I do live in Germany and I

did not notice that myself. However, both
of our speakers volunteered as election

workers in Germany and research on the
topic of security for elections. And they

promised to tell us how this can be, how
elections can be made more secure again.

Our speakers are Tobias, he is an IT-
Security researcher focusing on offensive

security, automotive security and capture
the flag challenges. And Johannes. He's a

post-doctoral IT-Security researcher and
both work together at the

Fraunhofer AISEC Institute.
Enjoy the talk.

Stille

Johannes: Hello and welcome to our
presentation on Hacking German Elections.

Insecure electronic vote counting, how it
returned and why you don't even know about

it. My name is Johannes Obermaier
Tobias: and I am Tobias Madl. We are both

very much involved in elections in Bavaria
because we're election workers and offer

support here in Germany.
J: And we are offensive IT-Security

researchers.
T: First of all, we want to talk about the

scope we are presenting today. We got our
information and the software from today,

from the municipal elections in Bavaria
happening in the early 2020. And it was a

computer based vote counting technology.
So we were very concerned, when we

interacted with it. And in the end, we
featured the questions, are elections

still secure? Next, I presented the
outline we are talking about today, and

first of all, we are looking at the
electronic vote counting system. And next,

we identified some conceptual and
practical issues with this technology.

Afterwards, we also inspected the software
and found some insecurities. And in the

end, we have summary and conclude our
presentation.

J: To understand why we need electronic
vote counting, let's just have a look at

the voting ballot. This voting ballot is
in its paper form about one meter wide and

50 centimeters high. So, that's a quite a
large ballot, that's a lot of candidates.

Let's just sum up the facts. So, we have a
total of 599 candidates that are spread

out over nine parties. Each citizen is
allowed to cast up to 70 votes in this

election. So, that sounds simple, but it
gets even more complicated now, because

you can cast up to three votes per
candidate and you can even choose multiple

candidates of different parties up to your
70 votes. And even if you decide yourself

to vote for a single party, you can still
strike out candidate that you personally

don't like. And so they don't get any
votes from your ballot. That means, this

voting system gives a lot of power to the
citizens and voting is fun.

However, counting out those ballots is very
difficult because you need to know a lot

of special rules in this voting system to
really count each ballot correctly. That's

the reason that a software such as OK.VOTE
has been developed. OK.VOTE is a typical

software for elections that's also used in
the polling stations for vote counting.

So, OK.VOTE has a quite large market
share. They say they have a like 75% in

Germany. So that software is used in
several states. OK. VOTE has several

different modules for organizing
elections, for example. But what we know

have a look at in this talk is only the
vote counting module of OK.VOTE Where the

election voters insert each paper ballot
and manually type it in all the votes in

each ballot and then they are stored in
the computer system. So, and the task of

OK.VOTE is to process each ballot to count
the votes, to find out if the ballot is

correct, then it stores all the ballots
into its database and finally it does some

magic and computes the final result. So,
this sounds quite similar to what a voting

machine does. But wait a moment. Voting
machines, in my Germany?

T: Wait, that's illegal.
J: Is it really illegal? Let's have a look

at the legal regulations about it. So,
yes, in 2009, there was an important

decision by the German federal
constitutional court and they said, that

the use of voting computers in the 2005
Bundestag election was unconstitutional.

Because, for example, the voting computers were
not transparently enough. So, that is very

similar to that what we have also found
for the municipal elections. But wait, we

are here talking about the Bundestag
election. But this is the municipal

election and we have different rules for
the municipal elections. For example,

there is the GLKrWO, that's the Gemeinde-
und Landkreiswahlordnung Bayern,

which basically translates to the Bavarian
municipal election rules. And those rules

say, that we are indeed not allowed to use
a computer for voting, but computers can

be used for vote counting. So, and in this
situation, I would expect, that we have

some sort of security requirements there
in those regulations. But I try to find

them. And I was really surprised. There
are exactly zero.

T: So, if there are no legal requirements,
are there at least any software side

requirements or certifications for
OK.VOTE which promise some security?

J: Yes, there are. So, I had a look at the
website and I saw this nice little

paragraph here. And it says, Elections
with security and during the development

of OK.VOTE, they put the highest emphasis
on the topic security. They follow the BSI

and OWASP recommendations on security, and
they have a certified data center with

very high security standards
T: And how does this look like in

practice?
J: Oh, I rather would not show you this

here. It's it's really scary. This is what
I have seen here, when I walked in the

election room. This is not a stock photo.
I took this photo myself and this is the

reality. So, I walked up to the guys and
said, well, shall we really use these

computers to count out the elections and
they said, yes, that are the computers

that are available here. So, and I pray to
God that for some reason does not work

out. And Windows XP did not disappoint me
because when I tried to start the

software, it failed because that are 32
bit systems and OK.VOTE needs 64 bits. So,

yeah, that was great. So, we did not use
that Windows XP machine. So, instead we

had to search for another machine and came
across this one here. That's a Windows 10

machine. That's fine. However, it has an
outdated virus scanner. So, well, it it's

better than nothing. So, this machine was
used instead then. So, but just let's keep

in mind what they are promising us:
election security. We really doubt that.

Let's now look at the IT environment and
why it came to that situation. So, first

of all, this is not fully the fault of
OK.VOTE, because it's the task for the

local administration to provide hardware
for vote counting and AKDB, the vendors of

OK.VOTE say, that they recommend to use
secure administration computers. That's

fine so far, but we simply don't have
enough secure administration computers for

that purpose. So, for example, in the town
where I'm from, we needed around 8

computers to count out this election and
we simply did not have enough in the town

hall. And whats even more, the election
room, it was in a school and there are

already school PCs available there. So,
they were just using the school PCs. So,

and those were even elementary school
computers. So, I'm not really sure about,

if all the pupils know, which link they
are allowed to click and which one they

should rather not click on. So, this
systems might be insecure, there might be

malware within, and even if it's possible
that someone had manipulated them in

advance, we cannot really exclude that.
However, I don't want to blame the

administration here because they did a
great job in organizing this election.

It's really much to do for them and it did
really well. So, everything worked out

well at the end. However, they are no IT-
Security specialists and we cannot demand

from them, that they know each detail on
how to set up a system correctly and what

are the risks that are associated with
insecure computer systems in elections?

That's just not their job. So, however, we
still ended up with untrustworthy systems

here. Because, as we have seen before,
there are no legal regulations against it.

Now, let's see how we create a digital
result.

T: Exactly. So, we went to our voting
places. We were presented with each one

got a PC and we got the ballot stack we
had to count and then enter the results.

So, Johannes is Team 2 and I was Team 1
and we started entering the ballots in the

PC. And from this on, they were digitized
Team 1 in green and Team 2 in blue.

J: As soon as I was finished entering my
ballots, I put them on a USB drive and

handed them over to Team 1.
T: Exactly. I imported these votes,

because I was the master machine at this
time, and the OK.VOTE software then

finalised these voting elections and
exported their results finally again on an

USB stick. And these were then delivered
on for further processing.

J: What is the problem with that all?
First of all, there's a lot of

intransparency. So, for example, the
software that is being used for vote

counting, OK.VOTE, it's not an open source
software. It's closed source and nobody

was able to analyze this yet. So, and
since this is closed source software, it

is also very hard to understand how the
software works and if it really counts

correctly, Because we have, in the end, we
have hundreds of ballots there and it's

really difficult to tell, if they have,
indeed, been counted correctly. So, and

although we have seen this before, there
is no basis for a secure vote counting, if

we have possibly rigged computer system.
So, we cannot exclude that someone has

manipulated them pre-election wise. So, if
there is some manipulation, this would

hardly be detectable by a standard
election worker. So, this means that the

entire election process becomes very
intransparent and hard to understand for a

person who just wants to observe the
election. So, that is strictly against the

idea of a public counting of votes.
T: So, now let's talk about the step that

happens after we finish counting
in each of the teams.

J: So, what do you do after you have
exported the final election results?

How do they come to the
central administration?

T: Yeah, I've just entered my vehicle and
took the USB sticks in my pocket and drove

to the master PC. But, as you maybe know,
Election Day is always very busy day and

might some teams are slower at counting.
Some teams are faster. So, the master team

doesn't know when these USB sticks arrive.
If they take two or three hours or half an

hour, they don't know really. So, I could
just go and grab something to eat on my

way. Or I can manipulate the vote. I mean,
deliver the votes. And yeah, in the end,

one day, when I arrive at the master PC, I
just give them my USB stick, they enter it

and they take the data that is stored on
there and nothing else. And afterwards,

they just uploaded the final
results on the page.

J: Now you might think, why is it possible
for him to manipulate election results?

Because there's no authenticity. There's
only integrity protection of the file that

he is transporting. So some CRC32 and a
SHA hash, but nothing like a cryptographic

signature. So, even if he alters the data,
he can just regenerate all the integrity

protection data and the data will just be
accepted. So, the main issue here is also,

that this is one of the few spots where
only a single person has unsupervised

access to the data during transport of the
voting data at all. And that makes

manipulations possible and easily feasible
in this case. And that should not be the

case, especially in an electronically
supported election. Now, let's have a look

at the vote counting software itself,
because there we found even more

interesting results.
T: Exactly. Let's begin with the system

architecture. First of all, this is the
local or decentralized version of the

software system. So all this is taking
place on the local host, on the machine we

encountered in the lecture rooms and on
these machines, where it was an Apache Tomcat

Web server running, which was connected to
a MariaDB, and the user was interacting

with the voting system via a portable
Firefox and as AKDB said in before they

were very concerned with security. So,
let's think about what attackers are they

had in mind when they designed the system
and from which the system is to protect

from. Is it the user that maybe attacks
the system, the vote count system, which

is normally just election workers that are
on their free time there to help executing

the election, or are they having the
network attackers in minds that come from

completely different places and try to
manipulate the network from outside? First

of all, we took the user as one of the
possible attackers. And even in this

environment, we found some really broken
stuff. First of all a broken access

control. But how it's how it's all about.
Well, that's the log in page when we just

logged in our voting system and clicked on
administration page where we can change

our password and edit our profile. These
are the buttons on the left. And as you

can see, we are clearly logged in as the
user42. And there is no more things to do

than select which counting part we want
to do, the general regional vote or the

municipal votes. And that's all we can
do on this page. Now let's switch to the

system administrator. There we have the
admin account, as you can see on the left

upper side, where we can now do very much
more than the normal user. We are again on

the administration page, but now we have
the user administration where we can

create or delete users. We have the reopen
or close voting mechanisms. We have

imports, we have exports and also what's
not included in the screenshots submenus

like deleting finalized results or and so
on. So, we picked out two very interesting

URLs for you. First of all, we are taking
the "Bezirk wieder eröffnen" which is

translated just to reopen the election
after election as closed at normal. It's

normally finalized, so no more votes can
be entered in the system. And the other

link is "Löschen". So that translates to
delete data, which then in the end deletes

all the data from from the machine. So, no
more private or secure data is stored on

there. And this is what they look like
when we only open them on the left side.

We see to reopen dialog. On the right
side, we see the data delete. But wait,

this is not the admin view, this is the
user view. So, they did not check if this

user is even allowed. And we also have to
say, that this is not just the view of it,

it is fully working and is completely
functional, when you just go through the

process of deleting or reopening as an
election.

Alarm sound
J: What's the problem with that?

T: Yeah, as you maybe already guessed,
reopening elections could create a

probability of sneaking in some additional
votes for the candidate I favor and

additionally, if I want to mess with all
of the voting, I could just delete all the

election data and we would have to start
from the beginning and completely delay or

deny the voting.
J: But why is this even possible?

T: Yeah, we found out that this is their
access control check in their software

this function is called getZugriffRollen,
which translates to get access roles. So

normally there will also be the software
in place to check if this role is allowed

to access this kind of site. But they just
returned null and not implemented it.

And that's also nice work to implement
access control. However, I think we can

propose some mechanisms that could have
prevented this. First of all, hidden

information is nothing you could rely on.
If you just don't show where you can click

to get to this url or to this page. That's
not really secret because maybe you find

some leaked source code or you make sure
serving at an admin or you just by

accident type in the wrong url and get to
this hidden information. Or you, exactly,

use software scanners to find something
hidden. So hidden data is just not secure.

And on the other hand, you should finalize
your implementation of access control to

have access control and even test it
once to be sure that it works. So in the

end we can conclude that hidden
data is not protected data.

T: Let's now come to another type of
attacks. Cross-site attacks. A cross-site

attack is some sort of interference
between two websites. Where one website,

for example, tries to do something on
behalf of the other. The goal is often to

deceit the user or to trigger the
manipulations. First of all, we were quite

sure that they have thought of cross-site
attacks. Because doing our testing, we saw

that they included some HTTP-Headers that
target a wide range of attack vectors that

use Cross-site scripting attacks. For
example, here we have X-Frame-Options:

same origin. That means that other pages
can not include the voting software into

their own frames and so on. And also
cross-site scripting protection is enabled

via X-XXS-Protection. So this looks quite
good because this already excludes several

attack vectors. But how about cross-site
request forgery? When we first tested

this, we found out that the vote counting
system is not fully protected against it.

What is cross-site request forgery? So in
the first step, the election worker uses

the integrated Firefox Browser to accept
a malicious website. So the user is

triggered to visit this website. For
example, someone sent him a link triggered

him to click on the link by the promise,
for example, of a cute animal picture or

some sort of that. And then the user
visits this website. And this website

contains form fields that resemble the
form fields of the actual vote counting

software. And the malicious website now
triggers your browser to submit this form

data, not to the original website, but
rather to the vote counting software. And

as soon as it reaches the Tomcat web
server, the web server is confused.

Because the web server cannot discern the
input from the cross-site attack from the

malicious website from original user
input. And then the Apache Tomcat server

just thinks that this is original user
input and will process it. And that's

called a cross-site request forgery
attack. So we saw that there is sometimes

a protection against this sort of attacks.
But many pages are not protected against

it. And that is very concerning because
that's a 2001's vulnerability. It's almost

20 years old now and it's still present in
such a software. So this is quite

unsettling here. Now, let's sum this up.
What we can do with it. So, first of all,

the issue is that they have missing CSRF
tokens or any other good countermeasure

against cross site request forgery
attacks. And the second point is here,

that only minimal user interaction is
required. The user often doesn't even see

that a cross-site request forgery attack
is currently being executed on his behalf.

So it's almost undetectable by the user.
And it's very simple to trick a user into

clicking a link. So the impact is very
devastating because we can now manipulate

settings in the vote counting software.
And we can even insert fake ballots here.

Alarm sound
T: So what's the result of this?

What we can do with it?
J: Well, we can manipulate the entire

election with this. Let's just use a demo.
How we do this.

T: Nice.
J: We are already logged in into the vote

counting system. Our username is
admin321934. Now let's count some votes.

As we can see here, these are all the
ballots that we can enter. They are still

empty since we haven't entered any ballots
yet. So let's start. For simplicity, we

just have two parties here. On the left
hand side we have the good party. Who

wants the best for the people. On the
right hand side we have the bad party

who wants to take power and is willing to
even commit election fraud. Let us begin

and enter the first paper ballot. The
person has voted for the good party. So we

enter this into the software. Now we save
the ballot and go to the next one. Again,

it's a vote for the good party. Let's
enter it and save it and go to the third

ballot. And again, it's for the good
party. Let's save our third ballot. Now we

go to the ballot overview and we look what
has happened. As you can see, we now have

three ballots that have successfully been
entered. At next, let's check the

preliminary election results. As we can
see here, we have a total of three ballots

that have been entered into the system.
That's correct. Three ballots contained

votes for the good party. That's also
correct. And zero votes have been given to

the bad party. That's fine so far. Next, I
will show you what happens if i open a

malicious website. This website will
execute a CSRF attack and manipulate the

election results. Let's just assume we
want to take a break and simply both

twitter. OK, here we are. There's a cute
cat picture and there's a link to even

more of them. Let's just play along and
get tricked into clicking that link. Oh,

look at all those cute animal pictures,
look a hungry rabbit, a monkey, a little

hedgehog and two cute goats and so on, and
when we are done browsing, we close those

tabs again and return to our vote counting
software. What we notice now is, that our

username has been altered and we just got
pwned. We were tricked into visiting this

malicious website. The website executed a
CSRF attack on the vote counting software

and did some manipulations. Let's see what
else has changed. However, all three

ballots are still there, but now we take a
look at the preliminary election results.

What you can see here is that the number
of ballots that are in the system has been

increased to eight. We now have five
additional ballots that were not entered

by us. As you can see, the good party
still has three votes. That is what we

have entered. But now the bad party has
taken the lead. They have five votes now.

This attack has indeed manipulated the
election results. This is really bad

because we cannot even see those
additional fake ballots that have been

injected. However, we are lucky because we
noticed it since we have expected this

attack. But we won't notice
it in every case.

T: But what happens if we don't notice?
J: Well, that happens. So, for this

example, we just assume that team 1 had
three ballots that they have entered into

the computer system and team 2 has six
ballots that have been entered into the

computer system. Now team one visits a
malicious website and five fake ballots

are injected into the election results. In
this case, the attacker is very smart and

injects the ballots at the location where
the team 2 ballots will be expected in the

future. So what happens now is: team 2
exports their ballots and team 1 tries to

import the ballots of team 2. And now the
following thing happens: Because there are

already ballots present at the location
where the team 2 ballots should go to, the

import process is not fully successful and
only a subset of the ballots are imported

so that the majority of the ballots into
this case, five or six ballots are just

discarded because they don't fit in the
database anymore because that location is

already taken by the fake ballots. So
usually we would expect that this can

generate an error message or at least a
warning. But this does not happen. This is

a silent failure of the software. And
what's even worst is now that the sums

finally are correct. So that means we now
have nine ballots present in the system

and nine paper ballots that were initially
available. So this looks like we have

entered all the ballots and everything
seems to be fine. So we will now close the

election and generate the final result.
And that is what happens now. As you can

see, we have only four votes for the good
party, but five votes for the bad party.

So the bad party has won the election by
manipulating the voting system, using this

CSRF attack. And that should never be
possible because this is not what we

expect for a voting software. And in this
case, the result is rigged. So have we

thought about network vulnerabilities?
T: Yeah, sure, that's exactly the other

side of the coin. First, we checked the
election worker side for attacks, but now

we checked the network side and scanned
and analyzed the system at first. And then

we looked like this: Open ports
everywhere. And as you can see, they fully

exposed the Apache Tomcat and the MariaDB
to each available network on the system.

And with this, we thought, well, let's maybe
try some newly discovered vulnerability,

which was recently found in 2020 called
Ghostcat. And Ghostcat is an attack

against AJP protocol from Apache. But
let's check the Apache system and how it's

built. First, Apache has a web root which
serves static resources and HTML or JSP

files. And additionally, it can include
class files or class sublets which are

combined with this JSPs or HTML files and
then served to the user. So we prepared

our ajpShooter with the URL of the
application, the port and the file we want

to read. In our case, it's a PrivateTest
class file because, what we

could leak about this, but we'll see. And
then we said we only want to read it

because there would even be the
possibility to evaluate it and execute the

code in it. So we've done this attack and
TADA we've got a result. This is the byte

code of the PrivateTest class. So let's
just drop this byte code in our cup of

coffee and maybe we can pull out some
source code from it. And yeah that's what

we've read out because why not. Just test
your encryption mechanism with the string.

But this is not a common string as you
later found out. This is the real root

productive password of the MariaDB. And
this was like:

Alarm sound
So what's the problem? As you maybe

clearly see with this attack, we could
leak out the login of the MariaDB and

probably even more logins or passwords.
And additionally, we could leak the whole

source code over the network without ever
accessing the PC in the election room. And

this was only possible because they
completely exposed all machines and

applications to the network and this
should never be the case. So in result:

How can this be prevented? First, you
should never expose these unneeded ports

to internet because they don't even use
the AJP proxy in their application, but

just left it on the 0.0.0.0 interface.
Next is: You should keep your software up

to date. That if some vulnerabilities were
found. You should not be vulnerable to it.

And last but not least: Never use
productive passwords in your unit tests

because that's not the best idea to do. In
the end, to sum it up: Avoid at all costs

any additional attack surface to prevent
these kind of attacks, even if you don't

know about them yet.
J: So, after Tobi has shown us a lot of

interesting and patchy stuff. I tested the
database for its security. For the first

analysis. I was just starting with the
same PC, but also the software was

installed and I tried to gain access to
the database. So it was coming from the

host localhost. I tried to use the
username root and then I saw that I am

asked for a password before I'm allowed to
connect to the database. However, finding

the password was quite trivial to do
because all the stuff I needed to know for

that was included in that last file and I
was able to decrypt the password without

any issue here. And that moment I realized
that also the password that Tobi has shown

us before, that he found with the Ghostcat
vulnerability is indeed the MySQL root

password here. So after I had access to
the MySQL system, I tried to dump the user

table to look which users are allowed to
access the database. So and that is how

the user table looks like. We have four
times the user root and the user root

requires a password if I'm coming from
localhost. But wait a moment. Here we also

have the host pci90309. And as you can see
here, there is no MySQL password

statement. That means that someone coming
from host pci90309 is almost allowed to

connect as root and does not even need to
provide any password for that. And thats

really strange.
Alarm sound

T: So what could happen from this?
J: Well, now someone on the network can

now just lump voting manipulation. That's
quite trivial because as soon as I set my

host to the correct hostname, I get full
access to the database where all my local

voting results are stored. And since I'm
root, I can interfer with them. I can

change them however I want to. And this
vulnerability is so damn weird and

trivial, it takes me no effort to do this
at all. And so we won't even go into a

demo here because it's so stupid simple in
this case. Usually I would say that's

enough for today because we already have
full access to the voting system and can

change whatever we want to. However, this
time we decided to go deeper because we

saw pci90309 is a real door opener. So we
have access to the voting results. We can

change them, but we still don't have
access to the entire voting system. So

what about the PC? Might it be possible,
with that root access to the database

server, to gain remote code execution at
that machine? So for this experiment, I

used the following setup. On the right hand
side we have a voting system with the

exposed MariaDB database server. On the
left hand side that's my system. I named

myself pci90309, just because i can do it,
and I establish a connection to the

MariaDB server. I use root as a username.
I don't need any password. And it is

immediately accepted. So now that I am
connected, I'm allowed to issue commands.

For example, I can now instruct MariaDB to
enable one of its plugins. This plugin is

called ha_connect. It's one of the plugins
that usually come directly with MariaDB.

And this is a very powerful MySQL storage
driver. So now I will show you what I can

do with that storage driver. So at next, I
will now create a table that's called pwn.

And I'm using the ha_connect storage
driver and instruct the storage driver to

create a file that's called pwn.dll and to
place it right into that plugin folder.

There is nothing that stops me from doing
so. So that is one of the special features

of the ha_connect storage driver, that I
can just say, this table is mapped to that

file in the file system. However, this
file is still empty because the table is

empty. But since this is a database, I can
now just issue INSERT INTO statements and

load whatever data I want to, for example,
some malicious DLL. I can just load into

the table, via that INSERT INTO a
statement, and then it is directly written

into our malicious DLL "pwn.dll". Ok, so
at next, after I've finished writing, I

will instruct MariaDB to enable this
plugin that I have just uploaded. And

enabling a plugin means that we are
executing the code that is stored in this

DLL file. So that means we have remote
code execution.

Alarm Sound
T: I don't even ask what you can with

remote code execution.
J: Well, I can do anything. So that means

I have no gate, full control over the
entire vote counting system. So I'm not

only talking about the data in the
database, I'm talking about the entire

computer that I can now fully control and
manipulate however I want to. And that's

possible, only by using the voting
software and accessing it over the network

interfaces that it had exposed. And now
I'll show you how simple this is to

execute an arbitrary program on the system.
T: This is the vote counting computer

system. To begin, let's start the vote
counting software. Now, the Apache Tomcat

Web server and the MariaDB database server
are being launched. Finally, the Firefox

portable is started. The system is now
ready for operation. But beware, the

attacker becomes active, his host name is
the infamous pci90309, immediately it

launches the python attack script
"fun.py". It connects to the MariaDB

server as root without a password and
uploads a malicious DLL plugin. When the

upload has been finished, the malicious
plugin is executed. As we can see, the

calculator was started thus remote code
execution was successful. The vote

counting computer system is now under
control of the attacker.

J: After we have found so devastating
issues with the vote counting Software, we

immediately notified the vendor AKDB
T: And they were very professional about

it and responded very quickly to our
initial emails. So we really like working

together with them and telling them our
results and they were always

positive about it. So they also
recommended some fixes.

J: So, for example, they told us, you
should only use that voting software in a

secure environment like in an
administrational network. However, we

don't really believe that this is a good
solution.

T: Exactly. And we are not very happy
about this proposal, because we have two

problems that still arise, even if it's in
a secure environment. First of all, an

administrative PC could still be infected
with some malware or it could be

manipulated before the election takes
place. And in the second hand, we have

this bug with the broken access control,
you remember. And even if you would have

been in the secure environment, this bug
would have been totally worked and you

could have completely deleted all data
work or reopened elections or something

like this.
J: But we are still quite happy that they

took us seriously, because they even have
announced updates. So, for example, they

wrote us that they are planning on adding
XSRF tokens for the pages where we found

cross-site vulnerabilities. So that's
already a good step into the right

direction. So now let's summarize what we
have presented today. So first of all, we

discovered several problematic aspects
in the concept and its practical

implementation. So, first of all, the
entire voting system, it's running on

untrustworthy computer systems. So it
could have been manipulated beforehand.

They could have malware on them or they
just could not function correctly. So

that's already very problematic from the
beginning, because we have no underlying

trust that we can put into those systems
and we are using them to count out our

votes, to count out the entire election.
So what's even more is, that even if they

use the software and the PC, that lies
beyond it, is secure, it still has not

enough transparency. It's very hard to
understand what the software is exactly

doing and how it is doing this. So, I
cannot really understand how does it come

to its result. Please keep in mind, that
we have almost 600 candidates and several

hundreds of ballots that have all to be
input into that computer system and then

some magic happens and it spits out its
result. So, then we just have to take this

result, because it's just impossible to
check, if really each vote has been

counted correctly or is there anything
strange has happened or any manipulation

took place.
T: And this is also possible, because we

found lots of vulnerable software and not
just the system security was affected, but

it was also absolutely possible to
manipulate the whole election from very

many parts in the network. And this leads
us to conclude that these elections are at

a high risk with this technology.
J: So, and that is the reason that we want

you as election worker. The more eyes are
looking at the election, the more secure

it becomes. And if you are interested in
becoming an election worker, just get into

contact with the local administration.
They are always very happy to have

volunteers, who want to take part as
election workers. So and for my personal

experience, I'm doing this for several
years now. It's also a lot of fun. You get

into contact with a lot of people. So I
enjoyed this a lot and I can just

recommended it and this is a good way, how
everyone of us can support the democracy

in their country.
T: So, to conclude our talk, we found out

that security in this technology is really
bad and that's not all of it.

J: So, this is just the tip of the
iceberg, because we look only at one of

the solutions that is available for vote
counting. And this was also in a special

configuration. So what is even more
difficult to see is, what happens behind

all the stuff we have seen today, because,
when we export the data and bring it to

the central administration and the data is
imported and uploaded, so where does all

this data go, where are all the results
from all this data from all the polling

stations are summarized? We don't know
that yet, how this works. We don't have

the software, that we can analyze. So
there's still a lot of work that has to be

done. Here to really check the entire
system, we just took a look at a very

small portion and that is just the vote
counting software here.

T: Next, we were very shocked that this
information, that vote counting is already

shifted to software, is not publicly
known. And this is also why we we created

this talk today as this is an information,
that is crucial for the democracy, that

there is already this software in use and
it is not really secure. So this was a big

thing for us to keep bringing it out to
the people.

J: So and one other thing is, everything
that we have seen today is entirely legal,

because at least in Bavaria, we don't have
any rules or any laws against the use of

unsecure computer systems, of unsecure
vote counting software. So, as we've seen

in the beginning, we only have very rough
legal guidelines that says, well, you can

just use computers for vote counting, but
we need stricter guidelines here, because

it cannot continue as we've seen it today
and in other states in Germany there is

sometimes something like, let's say,
guidelines or even certification process

for such digital software. But in most
states that I had a look at, there are no

rules at all and nothing that should
continue in the next years that way.

T: Additionally, in the end, before any of
this software to electronically count the

votes should go live, unbiased tests for
everyone should be available to prove

themselves, that this software is secure
and this software is doing what it's

promising to us. Because it is directly
influencing our democracy. And if this

software is manipulated, it manipulates
our voting, our election and our

democracy. So in the end, we can just
leave you with two questions.

T: How much digital support is required?
J: And how much is tolerable?

No Audio

Herald: Thank you very much for the
interesting talk, Johannes and Tobias. And

thank you very much for your work on the
topic. I hope you do have time for a

little Q&A. We have quite a few questions,
actually.

J: Sure.
M: All right. So the first question from

the Internet is, is there any suspicion
that these vulnerabilities have been

actively used?
J: Well, it's very hard to tell. So, at

least for the town that I am from, I did
not notice any special occurrences there.

So, however, I don't have an overview of
entire Bavaria, so, that's quite hard to

tell. I think it's even impossible to
tell, if there were any manipulation so

far. So, unfortunately, we cannot say
that.

T: Additionally, we are just at one place
in this whole system. So we don't have an

overview, if there was any mismatching
numbers or any other influences that

happened, but that we didn't see at the
moment, because we were just at one

position in the system, at one station
of the election.

M: OK, thank you for the answer. Ah, do
you believe that it is possible to have a

digital ballot that is as secure and
trustworthy as physical or paper based

voting is?
J: Well, in my opinion, that's not

possible, if you want to have the same
sort of transparency that we have in the

paper based voting system, because, when
we have paper based voting, we can just go

into the voting room and watch what's
going on there. We can see the ballots

that are handed in, the ballots that come
out of the box. Then, they are counted,

are summed up. I can really try to find
out what's going on there. I can have a

look at that. Understand what people are
doing there, but at the moment, that we

have only a digital vote, I cannot really
find out, if the computer is doing the

right thing, if there were some
manipulations. So, in terms of

transparency, I don't think it is possible
in the same. Yeah, in the same way as the

paper based ballots, for example.
T: I would have to add to this, if there

would be the possibility to get the same
traceability and visibility that you can

always see which results came from, from
which position. And if they are signed

very transparent, then it may be possible
in any future, but not with any kind of

this software, we saw there.
M: All right. Thank you. Do you, by any

chance, know which states in Germany use
these software OK.VOTE as far?

T: We cannot directly say which states
actively use them, because we only took

place in elections here in Munich or
Bavaria. But, we can tell, that we found

very much hints in the source code that
they were also used in, for example,

Hamburg, Bremen, Hessen or Rheinland-
Pfalz, but we don't know if they were

already used there or if it's planned to
be used there or did they already used

them in the past elections and decided
against them for future ones. We don't

know about this, exactly.
M: OK, maybe we can stay for a second on

your job as an election worker. The
process of manually entering data into the

system, is there a process for this? Do
you have an idea on the risk of this part

here?
J: Yes. So, it's basically the thing, that

they are at least two or three people
sitting in front of each computer and then

they are entering each ballot. So people
are really cross checking that the ballot

has been entered correctly. So, it's like
one person has the ballot in front of him

or her and the other person reads the
votes and the other person types it in and

they are cross checking each other. So,
that there isn't any error doing typing in

those election results in the computer.
M: All right. Thank you for the

elaboration. Someone is asking, how the
system's connected to the Internet or some

other network of the understanding of the
talk was correctly received by that

person. The results are written to some
physical medium which is turned into

transmit the results. So you sense
something physically. So, why care for the

Windows version or the, what is running on
these machines? Is that correct

understanding?
J: Well, the problem with that is, that it

depends on the local administration, how
they set up their computer systems. So, I

also read this in a chat here. Someone has
written, that they had their voting

software in a, yeah, in a very limited
network connectivity. So, the computer was

not connected to the Internet. However, it
depends very on the administration and on

the computer network that is being used
there. So, it is entirely possible that

computers are connected to the Internet,
because there are no guidelines on how

these computers are allowed to be set up.
So, I cannot fully exclude this. So, and

if someone, for example, just enables the
wireless network or connects to some

unsecured hotspot, they are connected
then. So, it's it's hard to tell here, but

I would not exclude this possibility.
T: To extend this answer. We even try to

find out, if there's any software side
protection that checks, if there is any

internet connection is present and then
would deny this voting system. But, there

wasn't or at least we couldn't find one.
So even if the administration was not

advised, if these PCs should be
disconnected from the network. There isn't

even a security mechanism in place, that
would check this and stop it or even show

a warning, that this is connected and they
should be disconnected from the Internet

before the counting can begin.
M: Interesting. All right. We have one

message on the IRC, from someone who
worked with this particular piece of

software in demo mode by themselves,
obviously. And the question they have, is:

Did you notice the possibility to enter a
negative votes for a candidate? So saying

minus two votes, for instance.
J: Well, that's difficult to tell. I

thought about, if this is possible, so
perhaps you might have to manipulate the

database directly. So I'm not entirely
sure. I'm not sure, if I tried this out

this one. So, but however, as soon as I
have a data, as I have database access,

it's entirely possible to manipulate
anything. So. Well, we could try this out

again. However, I don't think that changes
much in our result. So, yeah, that's

interesting questions of I cannot answer
this right now, so I'm not sure, you Tobi,

have you tried out something like that?
T: We've tried manipulating some already

submitted votes, but I think, this was not
really possible. However, as you showed,

when you export the data and import into
the main PC, the votes that were already

in place, possibly by an attacker, would
then discard the newly imported votes. So,

this would probably replace this data and
these votes, but via the Web interface, I

think it was not possible. However, we
found the enough vulnerabilities with

database access that you could do it by
this way, if you want to.

M: All right. Thank you for your
explanation. Out of pure curiosity, people

ask, how did you get access to the software
in the first place? To start your analysis?

J: Well, that's a good question here,
because, theres a nice story behind that.

So, I was election worker and I was
supporting setting up a system and doing

some IT support in the evening. And at
some point, we tried to merge our results.

So we exported the results from one
computer to move them to the other one.

However, the import failed, because, there
is some artificial limitation in the

software. So, as soon as your export files
are larger than 10 megabytes, they cannot

be imported anymore. So this happens quite
quickly, when you have a few hundreds of

votes, of few hundreds of ballots and then
the import doesn't work anymore. And I had

a look at this file, and that was just a
JSON file with a lot of whitespace. So, I

copied all this stuff to my computer to
fix this. And there was also later on, a

software fix that was published by the
software vendor. However, then I had the

software on my computer, just because I
wanted to fix this election. And it was

very late at night. And I returned home
and I noticed, oh, I still have that

software on my computer. Let's have a look
at this. So, yeah, it was just by chance.

So, I tried to fix something, got all the
software on my PC and then I had it ready

to analyze even with some data on that, so
that I really knew how this works in

practice. And yes, but if someone would
try to gain access to that software,

that's quite simple, because they could
just restore the deleted data from one of

the computers that are in the schools.
Perhaps, someone doesn't even delete the

election software from their computers, in
your school, or some person could just

steal one of the USB sticks, that have
been used for installation. So, I don't

even think, that would be noticed then.
M: Interesting, indeed, you mentioned in

your talk, that the software is certified
by the BSI, that they claim to be

certified by the Open Web Application
Security project, but how could such a

broken system can be certified by both
parties in the first place? And what's

wrong with the certification process? Yes,
this obviously happened. I mean, like, why

not use a certified. What do we do
certified in the first place, if it gets

certified, even if it's broken?
T: I think the first point about this is,

that we already mentioned in the talk,
that there are no legal requirements. You

don't need any certification, that this
software can be used in our voting, in our

elections here in Germany or in most parts
of Germany. And additionally, this

screenshot we show with OWASP and the BSI
was just the promotion of the AKDB for

their software, but I think there was no
real certification attached. So, we don't

know if we the BSI ever saw this software for
real or if they just put it on there and said,

yeah, BSI certificate certified or with
the BSI standards in mind, like they

already have already the IT Grundschutz
and they maybe tried to implement, after

this system architecture. But the BSI
never checked on it. So, I don't think

there's any real certification for the
software.

J: So, just to add a few details here,
that's not really a certification, that

they just said that they follow the BSI
and OWASP guidelines. I think, that was

also the wording that was used on the
website. So, theres no real certification

behind that, so far.
M: Thank you for the answer. Do you know

by chance, how the municipalities
published the election results?

J: Well, I don't know in detail how it
works. So, when we handed in our election

results, they got uploaded onto some other
software. And that's also the end that

I've seen. So end up in the computer
system and they are electronically

transmitted. And that, first of all, it
generates a preliminary file. And finally,

that's a final result generated by it.
However, I don't really know how this

works, but the election results that were
generated, with OK.VOTE are definitely

going into the final result. So, perhaps
there's also some paper based protocol

between them. I don't really know if
they're using the data that's in the

computer or the data that is on the paper.
But, however, it doesn't change very much

here.
M: OK, on. Coming over here a bit, the

last question would be: What, in your
experience, how practical and expensive

are hand recounts here and did you observe
these?

T: I think, this is very different from
election to election and from city to

city, if this is a rather small town, you
could probably easily reelect all this or

all the votes and recount the votes. But,
if this is a big city like Munich, for

example, with millions of votes, and you
would have to recount this, this would

particularly delay the voting or the
results pretty much. And this could have

really bad influences, if this would
happen. That software has shown that kind

of manipulation has happened and they had
to recount all the stuff by hand again.

J: So, counting this by hand is, indeed,
very, very effortful, because they have

like 70 votes per ballot. And even summing
up all that is still error prone, if it's

done by hand. So, it's difficult to do
that. And up to my knowledge, it's not

generally recounted after the election.
So, I try to find something in the

Internet regarding that. And I just found
some PDF, that they said, well, it's not

feasible to recount all the election
results and all the ballots. So, that's

just rather do a meter level check on: is
the protocol complete? How about the

special ballots, that were not really
clear and so on? But it's not like, every

ballot will be recounted, as far as I
understand.

M: OK. Oh, thank you very much Tobias an
Johannes for answering all the questions.

Thank you again for your talk.
J: Thank you.

M: Thank you.

rC3 postroll music

Subtitles created by c3subtitles.de
in the year 2020. Join, and help us!