Posts Tagged


Verizon: Companies will sacrifice mobile security for profitability, convenience

Despite an increase in the number of companies hit by mobile attacks that led to compromises, four in 10 businesses sacrificed security to meet profit goals or avoid “cumbersome” security processes, according to Verizon’s third annual Mobile Security Index 2020.

It showed that 43% of organizations sacrificed security. More typical reasons for companies exposing themselves to risk, such as lack of budget and IT expertise, trailed “way behind” things such as expediency (62%), convenience (52%) and  profitability targets (46%). Lack of budget and IT expertise were only cited by 27% and 26% of respondents, respectively.

“In fact, the study found that 39% of respondents reported having a mobile-security-related compromise. Sixty-six percent of organizations that suffered a compromise called the impact ‘major,’ and 55% said the compromise they experienced had lasting repercussions,” Verizon stated.

Verizon mobile security Verizon

The findings are based on a survey of more than 850 IT professionals responsible for buying, managing and securing mobile and IoT devices. In addition to insights from Verizon’s analysts, the report includes real-world data from security and management companies, including Asavie, IBM, Lookout, MobileIron, NetMotion, Netskope, Symantec, VMware and Wandera.

This year, Verizon added questions to find out why companies are knowingly exposing themselves to risks. The need to meet targets was the most commonly stated reason, whether it was time (62%) or money related (46%).

Despite an increase in the number of companies hit by mobile attacks that caused breaches, Verizon’s data does show a reduction in the proportion saying that they had knowingly compromised security (down from 48% in FY2019 to 43% in FY2020).

“It seems that many companies still see mobile security as an impediment to their business objectives rather than a business imperative in itself,” Verizon said. “But attitudes are changing. Eighty-seven percent of respondents said they were concerned that a mobile security breach could have a lasting impact on customer loyalty, and 81% said that a company’s data privacy record will be a key brand differentiator in the future.”

Dionisio Zumerle, a senior director of research at Gartner, said enterprises today have a plethora of security challenges; for many, it is simply not possible to tackle everything at once.

“For a number of reasons, mobile today is a smaller issue than many others,” Zumerle said via email. “Among other factors, the operating system is more hardened, and mobile devices have less access to critical enterprise infrastructure and data.”

The Verizon report found that 39% of organizations admitted to suffering a security compromise involving a mobile device — up from 33% in the 2019 report and 27% in 2018. Of those that suffered a compromise, 66% said the impact was major and 36% said it had lasting repercussions.

Twenty-percent of organizations that suffered a mobile compromise said a rogue or insecure Wi-Fi hotspot was involved.

“Although the risks of public Wi-Fi are becoming well known, convenience trumps policy – even common sense — for many users. Some organizations are trying to prevent this by implementing Wi-Fi-specific policies, but inevitably, rules will be broken,” Verizon said.

According to MobileIron, 7% of protected devices detected a man-in-the-middle (MitM) attack in the past year.

According to Wandera, employees connect to an average of 24 Wi-Fi hotspots per week. The company also found that 7% of devices encounter a hotspot that presents a low-to-medium severity risk, and 2% encounter one rated as a high risk—one known to be affected by MitM, or a protocol attack like SSL Strip.

Overall, the average mobile device connects to two to three insecure Wi-Fi hotspots per day. The most common settings are retail, hospitality and transportation hubs, including airports. 

Despite the risks, less than half (42%) of organizations said that they prohibit employees from using public Wi-Fi to perform work-related tasks.

Verizon mobile security Verizon

“Open Wi-Fi networks are convenient, but they are as open to users as they are to attackers,” Zermerle said. “There are a number of ways to achieve this, but essentially an attacker can conduct a MitM attack where he can see everything that a user sends over the network. This includes account credentials and confidential information among other data.

“There are a number of ways to respond,” Zermerle continued, “such as using adequate transport security (e.g. a VPN with certificate pinning), or an MTD solution …  that can identify MitM attacks.”

All vertical industries were included in the survey results, including manufacturing (where 41% suffered a mobile-related compromise) and the public sector (39%). And companies of all sizes were hit — from small and medium-sized businesses (28%) to those with more than 500 employees (44%).

At the same time, 80% of organizations said mobile will be their primary means of accessing cloud services within five years. 

Mobile end users were the primary vector for attacks, Verizon found. In fact, even among companies with defenses in place, including mobile device management (MDM) systems and at least one form of email filtering, many users still received – and clicked on – phishing links.

The main issue is that mobile management and mobile application management tools are just that – primarily management tools and not detection and remediation tools, according to Phil Hochmuth, IDC’s vice president of research for enterprise mobility

“That’s where mobile threat management/mobile threat defense (MTM/MTD) tools come in,” he said via email. “These are sometimes called (mistakenly) ‘iOS/Android antimalware.’ [They] look for more than malicious apps and on-device software. These tools also look for malicious Wi-Fi activity, as well as app-level threats.”

Verizon mobile security Verizon

Of the users who fell for a phishing attack, most were repeat victims. More than half (53%) of users that clicked on a phishing link clicked on more than one, the data showed.

Hochmuth agreed the biggest mobile app-level threat is phishing, “or, using the communication channel in any app … not just e-mail or SMS apps … to trick and phish users.

“Almost every app has some form of built-in messaging feature and attackers are using all of these to get at targets – social media apps and websites, etc,” Hochmuth said. “While the industry has not seen the extremely costly effects of malware and targeted attacks on PC operating systems vs. mobile, smartphones are now the primary access device for most Internet users, and are ubiquitous in enterprises.”

While it’s generally harder to compromise mobile OSes, they do represent a “huge attack” and “growing” attack vector, Hochmuth said.

If companies don’t become more proactive in addressing mobile threats, governments and industry bodies may well force their hands, Verizon’s report said.

Following the passage of the EU’s General Data Protection Regulation (GDPR) in 2016 and California’s Consumer Privacy Act in 2018 (they went into effect in May 2018 and January 2020, respectively), there has been increased momentum behind comprehensive privacy legislation.

In the U.S., several states, from Hawaii to Rhode Island, have initiated such measures. Four other states, including Texas and Louisiana, have set up task forces to look into the issue, Verizon noted.

While only 33% of companies said regulatory penalties are a consequence they are worried about, that could be because governments have given them adequate time to prepare. Sixty-seven percent said that increased regulation had driven them to spend more on security as a whole.

Gartner’s Zumerle said IT security leaders who want to address mobile threats should start from a security hygiene standpoint: device vulnerability management (removing vulnerable, unpatchable devices) and application vetting (disallowing leaky and malicious apps).

“In the long term, we see mobile security solutions such as MTD converging and being part of a unified endpoint security solution,” Zumerle said.

Indeed, over the past year and a half, vendors have touted a marriage between unified endpoint management (UEM) and security tools, offering a more comprehensive strategy for securing all enterprise endpoints, according to Nick McQuire, a senior vice president of research at CCS Insights.

Artificial intelligence and machine learning tools are at the core of some of the latest “zero-trust” frameworks being deployed by vendors, which is more about threat detection even while an employee is already logged into a corporate system via a mobile device.

“A lot of [threat detection] has to do with knowing what the device is, who the user is…, the health of the device and making sure the user is tied to their credential and that credential is tied to the device,” said Bill Harrod, federal CTO at MobileIron. “Then it’s about being able to evaluate the risk in all those places.”

Copyright © 2020 IDG Communications, Inc.

Source link

University’s mobile app streaming idea has enterprise IT potential. But, oh yes, there’s that security annoyance.

Purdue University has announced an interesting mobile concept, a means to free up lots of space that is now housing apps and app data. Why not, the university asks, stream the apps themselves from the cloud?

Let’s let the school explain its own idea: “New software streams data and code resources to an app from a cloud server when necessary, allowing the app to use only the space it needs on a phone at any given time. ‘It’s like how Netflix movies aren’t actually stored on a computer. They are streamed to you as you are watching them,’ said Saurabh Bagchi, a Purdue University professor of electrical and computer engineering, and computer science, and director of the Center for Resilient Infrastructures, Systems and Processes. ‘Here the application components, like heavy video or graphics or code paths, are streaming instantly despite the errors and slowdowns that are possible on a cellular network.’ Bagchi’s team showed in a study how the software, called AppStreamer, cuts down storage requirements by at least 85 percent for popular gaming apps on an Android. The software seamlessly shuffles data between an app and a cloud server without stalling the game. Most study participants didn’t notice any differences in their gaming experience while the app used AppStreamer. Because AppStreamer works for these storage-hungry gaming apps, it could work for other apps that usually take up far less space, Bagchi said. The software also allows the app itself to download faster to a phone. The researchers will present their findings Feb. 18 at the 17th International Conference on Embedded Wireless Systems and Networks in Lyon, France.” (Note: This press release was written before Feb. 18.)

First off, let me stress that this app wasn’t designed with enterprises in mind, so any concerns I might express could be fairly criticized as being strawman arguments. That said, the concept of freeing up space on an enterprise device — and especially a BYOD device that only gets a small partition for handling any business data and apps — has potential.

In general, of all of the enterprise complaints about mobile, insufficient space has been rarely heard in the last year or two, as handset manufacturers have sharply increased memory while app-makers have done better at shrinking their footprints. Still, IT is a greedy bunch, so squeezing more out of a finite phone is always of interest.

But unlike the Netflix example, move downloads generally don’t worry end users too much about security. As long as the end user gets to see the movie in good quality, he or she doesn’t care if bad guys out there are also watching and getting free content. The notable exception might be porn, where privacy of viewing choices becomes a concern. Getting back to enterprise IT (where, naturally, no porn is ever watched) security issues, streaming enterprise data and apps from a consumer-grade cloud is not a good idea.

Let’s flip the question, though. In an enterprise BYOD situation, if streaming corporate data and apps is a deal-killer, why not encourage employees to use something like AppStreamer to stream their personal apps and data, theoretically freeing up more space for the corporate partition to do its business fun? Is there reasonable potential there?

A problem I see is that other than doing web searches, much of the convenience of mobile devices is that they can perform many of their functions in a non-wireless environment, such as driving in a dead zone. Even more appropriately, consider instances where the mobile user goes out of the way to enter a dead zone (a.k.a. using airplane mode with Wi-Fi shut down) when the user is working on something sensitive and doesn’t want anyone sniffing into the phone. In short, the ability to actively use app executables and downloaded data is a big advantage for an enterprise device. That would interfere with any app or data streaming.

Back on security: even if the enterprise were able to set aside the concerns about the cloud’s security itself (worries about someone breaking in), there is still the issue of the consumer-grade cloud provider itself. Does your CIO and CISO want your sensitive data to exist outside of your device, on-prem systems and their hopefully heavily vetted enterprise cloud environment?

Beyond data leakage fears, there are a host of compliance privacy issues about allowing enterprise data to exist elsewhere. But if mobile memory space is an issue and employees are willing to try this on the consumer side of a BYOD phone, this might eventually have serious potential. 

Copyright © 2020 IDG Communications, Inc.

Source link

Mobile security: Worse than you thought

Many security professionals have long held that the words “mobile security” are an oxymoron. True or not, with today’s mobile usage soaring in enterprises, that viewpoint may become irrelevant. It’s a reasonable estimate that 2020 knowledge workers use mobile devices to either supplement or handle much of their work 98% of the time. Laptops still have a role (OK, if you want to get literal, I suppose a laptop can be considered mobile), but that’s only because of their larger screens and keyboards. I’d give mobile players maybe three more years before that becomes moot.

That means that security on mobile needs to become a top priority. To date, that usually has been addressed with enterprise-grade mobile VPNs, antivirus and more secure communication methods (such as Signal). But in the latest Verizon Data Breach Investigations Report — always a worthwhile read — Verizon eloquently argues that aside from wireless, the form factor of mobile in and of itself poses security risks.

From the Verizon report: Users are “significantly more susceptible to social attacks they receive on mobile devices. This is the case for email-based spear phishing, spoofing attacks that attempt to mimic legitimate webpages, as well as attacks via social media. The reasons for this stem from the design of mobile and how users interact with these devices. In hardware terms, mobile devices have relatively limited screen sizes that restrict what can be accessed and viewed clearly. Most smartphones also limit the ability to view multiple pages side-by-side, and navigating pages and apps necessitates toggling between them—all of which make it tedious for users to check the veracity of emails and requests while on mobile. Mobile OS and apps also restrict the availability of information often necessary for verifying whether an email or webpage is fraudulent. For instance, many mobile browsers limit users’ ability to assess the quality of a website’s SSL certificate. Likewise, many mobile email apps also limit what aspects of the email header are visible and whether the email-source information is even accessible,” the report said. “Mobile software also enhances the prominence of GUI elements that foster action — accept, reply, send, like, and such — which make it easier for users to respond to a request. Thus, on the one hand, the hardware and software on mobile devices restrict the quality of information that is available, while on the other they make it easier for users to make snap decisions. The final nail is driven in by how people use mobile devices. Users often interact with their mobile devices while walking, talking, driving, and doing all manner of other activities that interfere with their ability to pay careful attention to incoming information. While already cognitively constrained, on screen notifications that allow users to respond to incoming requests, often without even having to navigate back to the application from which the request emanates, further enhance the likelihood of reactively responding to requests.”

In short, users dealing with email on a mobile device — an incredibly common happening in corporate campuses — are far more susceptible to a phishing attack then on a typical desktop device. You can be confident this point has not been lost on cyberthieves and cyberterrorists. They already know the likely OS of a device that clicks on one of their evil phishing attacks, which makes them quite happy.

What to do about this? First, all phishing/malware training must now prominently feature mobile-only training. Yes, training only helps so much, but it’s a good start. Secondly, when you are testing your own people by trying to trick them into clicking, design the tricks to assume mobile. Your success rates will go up and people will learn faster what would have happened had your test been a real attack.

Third, pressure handset manufacturers and the two mobile OS giants — Google and Apple, of course — to address the most shameful part of Verizon’s concerns, which is that “many mobile browsers limit users’ ability to assess the quality of a website’s SSL certificate. Likewise, many mobile email apps also limit what aspects of the email header are visible and whether the email-source information is even accessible.”

Although both points are critical and should have been addressed long ago, it’s the email header part that is the most irresponsible. Granted, most consumers rarely bother to check even on desktop devices, but Fortune 1,000 employees need to told that checking is mandatory before clicking. Although some phishers are sophisticated and make the attempt to craft reasonable-appearing fake domain names, most don’t bother. And with the expectation that far more of those messages are going to be seen via a tiny mobile screen over the next couple of years, I’d guess that most will continue to not bother. I’m still impressed by phishing attempts I see every day and a quick peek at the email header makes everything quite clear.

Hence, full headers musts be easily accessed on any mobile device and there is no reason — not business-based, not marketing-based, certainly not security-based — for Apple and Google to not fix this. Let both firms know that this will influence which phones you’ll buy later this year and you’ll have their attention.

As for SSL certs, I suppose it can’t hurt to fix that glaring hole. But unlike email headers, the very crappy tactics most cert issuers use to verify the authenticity of the request makes me more worried that cyberthieves will turn this to their advantage and trick cert-issuers (not that difficult) to give them legitimate credentials for not-so-legitimate domains. So, yes, certificate verification is important (not so sure how much any browser can do to “assess the quality of a website’s SSL certificate,” but if they think of a way, by all means do so), but I’d first like to dramatic improvements in certificate firm verification methods.

It’s not merely “verify that you are who you claim to be” (unless you have a constantly updated list of bad guys, not sure of the point) nor is it making sure that you own the domain for which you want a certificate. You need to verify that, but that is a remarkably low bar. I want the cert outfits to look at the domain and see if it close to someone else’s well-known domain. I’m not suggesting that you decline all such requests, but at least reach out to the owner of the well-known domain to see if there are issues. And perhaps question the requester far more closely. If a cert is supposed to make a user comfortable to click, let’s put some robust and intelligent authentication into the process. And then make it easy to check a cert’s authenticity. With today’s verification methods, a major cyberthief is more likely to trick a cert player into issuing a real one than is using a fake one. Both problems need to be addressed.

Copyright © 2020 IDG Communications, Inc.

Source link

MIT researchers say mobile voting app piloted in U.S. is rife with vulnerabilities

Elections officials in numerous states have piloted various mobile voting applications as a method of expanding access to the polls, but MIT researchers say one of the more popular apps has security vulnerabilities that could open it up to tampering by bad actors.

The MIT analysis of the application, called Voatz, highlighted a number of weaknesses that could allow hackers to “alter, stop, or expose how an individual user has voted.”

Additionally, the researchers found that Voatz’s use of Palo Alto-based vendor Jumio for voter identification and verification poses potential privacy issues for users.

The study comes on the heels this month’s trouble-plagued Iowa Democratic Presidential Caucus, which used an online app to store votes but failed to do so accurately because of a coding flaw and insufficient testing.

Some security experts have long argued that the only secure form of voting is paper ballots.

iPhone iOS voatz blockchain voting Voatz

Voatz iPhone mobile voting application.

The Voatz mobile voting application has been used in small pilots involving  only about 600 voters total in Denver, West Virginia, five counties in Oregon, Utah and Washington State, where the main focus was on inclusivity for absentee voters living overseas.

In response, Voatz called the MIT report “flawed” because it based its analysis on a long-outdated Android version of the app.

“Had the researchers taken the time, like nearly 100 other researchers, to test and verify their claims using the latest version of our platform via our public bug bounty program on HackerOne, they would not have ended up producing a report that asserts claims on the basis of an erroneous method,” Voatz stated in a blog post today.

“We want to be clear that all nine of our governmental pilot elections conducted to date, involving less than 600 voters, have been conducted safely and securely with no reported issues,” Voatz said.

In 2018, West Virginia piloted Voatz’s mobile voting app for resident service members and family living overseas who wanted to vote in the midterm general election. 

West Virginia Secretary of State’s office pointed to a Department of Homeland Security security assessment of the 2018 Voatz pilots indicating there was “no threat actor behaviors or artifacts of past nefarious activities were detected in the vendor’s networks.”

Audits of paper ballots created by the Voatz plaform on election day also confirmed the results were accurate, according to the Secretary of State’s office.

“We want to get the word out to media outlets like Computerworld to ensure WV voters that we are taking every possible precaution to balance election security and integrity with WV requirement to provide absentee ballots electronically to overseas, military and absentee voters living with physical disabilities,” Mike Queen, deputy chief of staff for West Virginia Secretary of State Mac Warner, said via email.

The MIT study, however, underscored the need for Voatz’s mobile app design to be more transparent because public information about the technology is “vague” at best.

Voatz’s platform uses a combination of biometrics, such as mobile-phone based facial recognition, and hardware-backed keystores to provide end-to-end encrypted and voter-verifiable ballots. It also uses blockchain as an immutable electronic ledger to store voting results.

Voatz has declined to provide formal details about its platform, citing the need to protect intellectual property, the researchers said in their paper.

In a blog post today, Voatz called the researchers’ approach “flawed,” which “invalidates any claims about their ability to compromise the overall system.

“In short, to make claims about a backend server without any evidence or connection to the server negates any degree of credibility on behalf of the researchers,” Voatz said.

The researchers also called Voatz out for reporting a University of Michigan researcher who in 2018 conducted an analysis of the Voatz app. “This resulted in the FBI conducting an investigation against the researcher,” the MIT researchers said.

It’s not the first time Voatz has been criticized for not being more open about its technology. Last May, computer scientists from Lawrence Livermore National Laboratory and the University of South Carolina, along with election oversight groups, published a paper that criticized Voatz for not releasing any “detailed technical description” of its technology.

“There are at least four companies attempting to offer internet or mobile voting solutions for high-stakes elections, and one 2020 Democratic presidential candidate has included voting from a mobile device via the blockchain in his policy plank,” the MIT researchers said in their paper. “To our knowledge, only Voatz has successfully fielded such a system.”

Along with Voatz, Democracy Live, VotemSecureVote and Scytl have all piloted mobile or online voting technology in various public or private balloting that included company stockholder and college board elections. Most recently, a Seattle district piloted the Democracy Live technology in a board of supervisors election that was open to 1.2 million registered voters.

Tusk Philanthropies, a nonprofit focused on promoting mobile voting as a way to increase voter turnout, has helped fund and promote Voatz and Democracy Live.

In a statement to Computerworld, Tusk said it feels confident in the results of all the pilot elections because it conducted independent, third-party audits “which showed that votes cast over the blockchain were recorded and tabulated accurately.”

“With that being said, we always welcome new security information and will work with security experts to review this paper,” Tusk said. “Security is an iterative process that can only get better over time. There is no room for error in our elections, especially when it comes to data leakage, compromised encryption, broken authentication, or denial-of-service attacks.”

Medici Ventures, the wholly-owned investment subsidiary of, has also backed Voatz, whose application has mainly been used to allow absentee voter service members and their families to cast their ballots via their smartphones from anywhere in the world.

Jonathan Johnson, CEO of Overstock and president of Medici Ventures, responded in a statement to a New York Times article about the MIT study, saying he believes the Voatz technology is responsible and safe.

“It not only prevents voting fraud, but it also protects the privacy of each voter. The Voatz app even generates a paper ballot that can be audited to guarantee the fidelity of the vote,” Johnson said. “This is, we believe, the right path forward to safe innovation in election technology. We should not let ourselves derail the future of voting.”

Critics of mobile or online voting, including security experts, believe it opens up the prospect of server penetration attacks, client-device malware, denial-of-service attacks and other disruptions — all associated with infecting voters’ computers with malware or infecting the computers in the elections office that handle and count ballots.

Jeremy Epstein, vice chair of the Association for Computing Machinery’s US Technology Policy Committee (USTPC), has been a vocal critic of mobile voting platforms, including Voatz. He said the MIT study was “very thorough” and demonstrates exactly what experts have been saying for years.

“Internet voting is risky. It’s no surprise that the Voatz system is vulnerable to many kinds of attacks, even to an attacker with no access to source code or other inside information,” Epstein said via email. “The attacks demonstrated by MIT are well within the capabilities of nation-state adversaries who are interested in manipulating US elections, and such an adversary won’t publish their results as the MIT team has done, leaving us with an election that may be undetectably manipulated.”

The five-year-old Voatz slammed the MIT researchers for never connecting even the outdated app they used to the company’s servers, which are hosted by Amazon AWS and Microsoft Azure.

In the absence of connecting to the actual servers recording public votes, “the researchers fabricated an imagined version of the Voatz servers, hypothesized how they worked, and then made assumptions about the interactions between the system components that are simply false,” Voatz said.

Epstein retorted that Voatz’s comments “demonstrate that they don’t understand either the severity of the attacks or the way security works in general.

“Any election official using Voatz products would be well advised to cancel their plans, before a stealthy attack in a real election compromises democracy,” Epstein said.

Copyright © 2020 IDG Communications, Inc.

Source link

Iowa Caucus chaos likely to set back mobile voting

A coding flaw and lack of sufficient testing of an application to record votes in Monday’s Iowa Democratic Presidential Caucus will likely hurt the advancement and uptake of online voting.

While there have been hundreds of tests of mobile and online voting platforms in recent years – mostly in small municipal or corporate shareholder and university student elections – online voting technology has yet to be tested for widespread use by the general public in a national election.

“This is one of the cases where we narrowly dodged a bullet,” said Jeremy Epstein, vice chair of the Association for Computing Machinery’s US Technology Policy Committee (USTPC). “The Iowa Democratic Party had planned to allow voters to vote in the caucus using their phones; if this sort of meltdown had happened with actual votes, it would have been an actual disaster. In this case, it’s just delayed results and egg on the face of the people who built and purchased the technology.”

The vote tallying app used yesterday in the Iowa Caucus was created by a small Washington-based vendor called Shadow Inc.; the app was funded in part by a nonprofit progressive digital strategy firm named Acronym. Today, Acronyn strived to make it clear through a tweet it did not supply the technology for the Iowa Caucus, and it is no more than an investor.

Last year, the Iowa Democratic Party (IDP) paid Shadow Inc. more than $60,000 for a website that was to upload caucus results, which it failed to accurately do yesterday. The problem with Shadow’s app was blamed on “a coding error” that has since been fixed, the IDP said in a statement. Results from the caucus were due out later today, according to the IDP.

The IDP said it determined “with certainty” that the underlying data collected using the app is accurate and sound, but was only reported out partially.

“We have every indication that our systems were secure and there was not a cybersecurity intrusion. In preparation for the caucuses, our systems were tested by independent cybersecurity consultants,” Iowa Democratic Party chairman Troy Price said in the statement.

Shadow Inc. apologized for the malfunction in a series of tweets.

The Nevada Democratic Party, which had planned on using Shadow’s app, said in a statement today they’re abandoning it.

As the desire to increase voter turnout remains strong and the number of online voting pilot projects grows in the U.S. and abroad, some security experts warn that any internet-based election system is wide open to attack, regardless of the underlying infrastructure.

“It’s yet another nail in the coffin of internet voting. If a vendor can’t get a relatively simple app like this right, what’re the odds that they can get a much more complicated voting system right?” Epstein said. “Voting systems require accurate identification of voters and maintenance of secret ballots, all while protecting against malware in voters’ phones and attacks against servers – and all this system needed to do was capture a few values and send them to a server, which had to be protected from attacks. I hope that folks who were responsible for selection of this app will learn a lesson.”

Others believe the blowback from the Iowa Caucus debacle will dissipate if “a good app were to surface” and can be used to vote in an effective manner, according Jack Gold, principal analyst for J.Gold Associates.

“I have to believe that this was never tested in a real-world scenario before the use in the caucuses, otherwise they would have known of the flaws in the app,” Gold said. “Was it rushed? Did they not go to a competent app creator? Did they spec the app incorrectly? Did the user interface actually work? There are lots of questions that need to be answered about this.

“Will this have a long-term negative effect? Probably. The publicity around this will put some doubt into the public trust of mobile voting.”

While mobile or online voting applications hold the promise of opening up the polls to absentee voters and making voting more accessible in genral, security concerns have been at the forefront of election officials since Russia’s interference in the 2016 presidential contest.

Tusk Philanthropies, a non-profit organization that promotes mobile voting and has funded past projects enabled by two vendor platforms, reacted to an IDG video about online voting today saying its vendors’ technology has been tested and successfully used in hundreds of elections.

“From what we know, the app used in the IA Democratic Caucuses was brand new, untested and created in secrecy,” a Tusk Philanthropies spokeswoman wrote via email. “This couldn’t be in more stark contrast to the eight pilots we have completed transparently, safely and securely.”

Tusk Philanthropies has been a proponent of mobile voting apps from Voatz and Democracy Live, which is currently being used in the election of a board of supervisors in the Seattle area.

Tusk Philanthropies wanted to “make clear” Shadow Inc.’s app is not “indeed a mobile voting option or app.

“There will be lots of calls to go back to paper ballots today, but we cannot forget that paper ballots brought us hanging chads and the Iraq War. Or that unsecure voting machines are also vulnerable to hacking,” a Tusk Philanthropies’ spokesperson said. “We need to stop relying on outdated approaches to voting like caucusing in gyms or having people congregate around a bunch of voting machines in a school basement.”

Critics of mobile or online voting, including security experts, believe it opens up the prospect of server penetration attacks, client-device malware, denial-of-service attacks and other disruptions — all associated with infecting voters’ computers with malware or infecting the computers in the elections offices that handle and count ballots.

The problem with online voting isn’t that it’s more or less secure than current polling systems; it’s more about public perception and how that may affect turnout, according to Julie Wise, elections director for Seattle’s King County.

“I don’t think they’re ready for it,” Wise said in an interview last week. “Critically important to running elections as an administrator is having voter confidence and trust in the electoral system. There’s understandable concern around election security and hacking of anything on the internet whatsoever.”

Atif Ghauri, cybersecurity practice leader and principal at global consulting firm Mazars USA, said the ubiquity of mobile devices has created a massive new frontier for cyber threats to mobile apps from Shadow Inc. and any other mobile app providers.

“The public’s concern is certainly warranted, as mobile apps not only expose software threats, but also location-based threats based on where the device is physically located. Knowing specific GPS coordinates adds another dimension to the attack,” Ghauri said via email. “The use of mobile devices by the less tech-savvy or aware also increases the likelihood of an attack.”

There are strategies mobile voting vendors and public officials can take to alleviate public concerns. First and foremost, Ghauri said, is the use of multi-factor authentication to provide a biometric, such as facial or finger print recognition, and a passcode from the user – all of which reduce the possibility of security threats. The use of a blockchain ledger for transactions will help substantially with transaction integrity, Ghauri said.

There are a small number of mobile voting platforms, including Democacy Live, VoatzVotemSecureVote and Scytl.

Voatz’s mobile application uses blockchain as an immutable electronic ledger to record voting results.

In a blog, Voatz said it had never heard of Showdow Inc. or its technology and was quick to distant itself from the Iowa caucus.

“And using an app to tabulate in-person caucus votes is not mobile voting,” the company argued. “Voatz is a mobile elections platform built to ensure an accessible, secure voting method for groups that otherwise face difficulties with the voting options currently available (i.e. overseas citizens, deployed military, and voters with disabilities). We’ve been in the industry for [five] years and have run more than 50 safe and secure elections.”

Voatz said it works with the Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency (CISA), and other independent third parties for security testing and infrastructure analysis of its app.

Democracy Live’s OmniBallot web portal does not use blockchain as the basis for collecting and securing electronic ballots. Instead, it uses Amazon Web Services’ (AWS) Object Lock, which is NIST compliant and has FedRamp certification, a government program that provides a standardized approach to security assessment, authorization and continuous monitoring for cloud services.

The OmniBallot portal has been deployed in more than 1,000 elections across the U.S. and used by 15 million voters in hundreds of jurisdictions since 2008, according to the company.

“The bottom line is, if you are going to deploy a mission-critical mobile app, especially one with this public visibility, you better test the heck out of it and make sure it works as expected, and under full load (not just on someone’s smartphone in the office),” Gold said.

Copyright © 2020 IDG Communications, Inc.

Source link