Posts Tagged


MIT researchers say mobile voting app piloted in U.S. is rife with vulnerabilities

Elections officials in numerous states have piloted various mobile voting applications as a method of expanding access to the polls, but MIT researchers say one of the more popular apps has security vulnerabilities that could open it up to tampering by bad actors.

The MIT analysis of the application, called Voatz, highlighted a number of weaknesses that could allow hackers to “alter, stop, or expose how an individual user has voted.”

Additionally, the researchers found that Voatz’s use of Palo Alto-based vendor Jumio for voter identification and verification poses potential privacy issues for users.

The study comes on the heels this month’s trouble-plagued Iowa Democratic Presidential Caucus, which used an online app to store votes but failed to do so accurately because of a coding flaw and insufficient testing.

Some security experts have long argued that the only secure form of voting is paper ballots.

iPhone iOS voatz blockchain voting Voatz

Voatz iPhone mobile voting application.

The Voatz mobile voting application has been used in small pilots involving  only about 600 voters total in Denver, West Virginia, five counties in Oregon, Utah and Washington State, where the main focus was on inclusivity for absentee voters living overseas.

In response, Voatz called the MIT report “flawed” because it based its analysis on a long-outdated Android version of the app.

“Had the researchers taken the time, like nearly 100 other researchers, to test and verify their claims using the latest version of our platform via our public bug bounty program on HackerOne, they would not have ended up producing a report that asserts claims on the basis of an erroneous method,” Voatz stated in a blog post today.

“We want to be clear that all nine of our governmental pilot elections conducted to date, involving less than 600 voters, have been conducted safely and securely with no reported issues,” Voatz said.

In 2018, West Virginia piloted Voatz’s mobile voting app for resident service members and family living overseas who wanted to vote in the midterm general election. 

West Virginia Secretary of State’s office pointed to a Department of Homeland Security security assessment of the 2018 Voatz pilots indicating there was “no threat actor behaviors or artifacts of past nefarious activities were detected in the vendor’s networks.”

Audits of paper ballots created by the Voatz plaform on election day also confirmed the results were accurate, according to the Secretary of State’s office.

“We want to get the word out to media outlets like Computerworld to ensure WV voters that we are taking every possible precaution to balance election security and integrity with WV requirement to provide absentee ballots electronically to overseas, military and absentee voters living with physical disabilities,” Mike Queen, deputy chief of staff for West Virginia Secretary of State Mac Warner, said via email.

The MIT study, however, underscored the need for Voatz’s mobile app design to be more transparent because public information about the technology is “vague” at best.

Voatz’s platform uses a combination of biometrics, such as mobile-phone based facial recognition, and hardware-backed keystores to provide end-to-end encrypted and voter-verifiable ballots. It also uses blockchain as an immutable electronic ledger to store voting results.

Voatz has declined to provide formal details about its platform, citing the need to protect intellectual property, the researchers said in their paper.

In a blog post today, Voatz called the researchers’ approach “flawed,” which “invalidates any claims about their ability to compromise the overall system.

“In short, to make claims about a backend server without any evidence or connection to the server negates any degree of credibility on behalf of the researchers,” Voatz said.

The researchers also called Voatz out for reporting a University of Michigan researcher who in 2018 conducted an analysis of the Voatz app. “This resulted in the FBI conducting an investigation against the researcher,” the MIT researchers said.

It’s not the first time Voatz has been criticized for not being more open about its technology. Last May, computer scientists from Lawrence Livermore National Laboratory and the University of South Carolina, along with election oversight groups, published a paper that criticized Voatz for not releasing any “detailed technical description” of its technology.

“There are at least four companies attempting to offer internet or mobile voting solutions for high-stakes elections, and one 2020 Democratic presidential candidate has included voting from a mobile device via the blockchain in his policy plank,” the MIT researchers said in their paper. “To our knowledge, only Voatz has successfully fielded such a system.”

Along with Voatz, Democracy Live, VotemSecureVote and Scytl have all piloted mobile or online voting technology in various public or private balloting that included company stockholder and college board elections. Most recently, a Seattle district piloted the Democracy Live technology in a board of supervisors election that was open to 1.2 million registered voters.

Tusk Philanthropies, a nonprofit focused on promoting mobile voting as a way to increase voter turnout, has helped fund and promote Voatz and Democracy Live.

In a statement to Computerworld, Tusk said it feels confident in the results of all the pilot elections because it conducted independent, third-party audits “which showed that votes cast over the blockchain were recorded and tabulated accurately.”

“With that being said, we always welcome new security information and will work with security experts to review this paper,” Tusk said. “Security is an iterative process that can only get better over time. There is no room for error in our elections, especially when it comes to data leakage, compromised encryption, broken authentication, or denial-of-service attacks.”

Medici Ventures, the wholly-owned investment subsidiary of, has also backed Voatz, whose application has mainly been used to allow absentee voter service members and their families to cast their ballots via their smartphones from anywhere in the world.

Jonathan Johnson, CEO of Overstock and president of Medici Ventures, responded in a statement to a New York Times article about the MIT study, saying he believes the Voatz technology is responsible and safe.

“It not only prevents voting fraud, but it also protects the privacy of each voter. The Voatz app even generates a paper ballot that can be audited to guarantee the fidelity of the vote,” Johnson said. “This is, we believe, the right path forward to safe innovation in election technology. We should not let ourselves derail the future of voting.”

Critics of mobile or online voting, including security experts, believe it opens up the prospect of server penetration attacks, client-device malware, denial-of-service attacks and other disruptions — all associated with infecting voters’ computers with malware or infecting the computers in the elections office that handle and count ballots.

Jeremy Epstein, vice chair of the Association for Computing Machinery’s US Technology Policy Committee (USTPC), has been a vocal critic of mobile voting platforms, including Voatz. He said the MIT study was “very thorough” and demonstrates exactly what experts have been saying for years.

“Internet voting is risky. It’s no surprise that the Voatz system is vulnerable to many kinds of attacks, even to an attacker with no access to source code or other inside information,” Epstein said via email. “The attacks demonstrated by MIT are well within the capabilities of nation-state adversaries who are interested in manipulating US elections, and such an adversary won’t publish their results as the MIT team has done, leaving us with an election that may be undetectably manipulated.”

The five-year-old Voatz slammed the MIT researchers for never connecting even the outdated app they used to the company’s servers, which are hosted by Amazon AWS and Microsoft Azure.

In the absence of connecting to the actual servers recording public votes, “the researchers fabricated an imagined version of the Voatz servers, hypothesized how they worked, and then made assumptions about the interactions between the system components that are simply false,” Voatz said.

Epstein retorted that Voatz’s comments “demonstrate that they don’t understand either the severity of the attacks or the way security works in general.

“Any election official using Voatz products would be well advised to cancel their plans, before a stealthy attack in a real election compromises democracy,” Epstein said.

Copyright © 2020 IDG Communications, Inc.

Source link

Google strengthens Chrome’s site isolation to protect browser against its own vulnerabilities

Google is telling Chrome users that it has extended an advanced defensive technology to protect against attacks exploiting vulnerabilities in the browser’s Blink rendering engine.

Chrome 77, which launched in September but was supplanted by Chrome 78 on Oct. 22, received the beefed-up site isolation, wrote Alex Moshchuk and Łukasz Anforowicz, two Google software engineers, in an Oct. 17 post to a company blog. “Site Isolation in Chrome 77 now helps defend against significantly stronger attacks,” the two said. “Site Isolation can now handle even severe attacks where the renderer process is fully compromised via a security bug, such as memory corruption bugs or Universal Cross-Site Scripting (UXSS) logic errors.”

As the label implies, Chrome’s site isolation limits each Blink rendering engine process to documents from a single website, thus isolating everything in a rendered site from other sites. The idea is that if a malicious website exploits a vulnerability, the hackers controlling the attack site won’t be able to access any data, say extremely valuable corporate data, outside of their own criminal website.

When Google fully implemented site isolation in mid-2018 (a year after it debuted) with Chrome 67, the technology’s primary purpose was to defend against the Spectra-style attacks envisioned when in-chip vulnerabilities were revealed earlier that year.

That’s now changed.

“Suppose an attacker discovered and exploited a memory corruption bug in Chrome’s rendering engine, Blink,” Moshchuk and Anforowicz said. “The bug might allow them to run arbitrary native code within the sandboxed renderer process, no longer constrained by the security checks in Blink. However, Chrome’s browser process knows what site the renderer process is dedicated to, so it can restrict which cookies, passwords, and site data the entire process is allowed to receive. This makes it far more difficult for attackers to steal cross-site data.”

For example, when site isolation of the renderer is activated, cookies and passwords can only be accessed by those processes “locked” to their corresponding sites.

There was cause to extend site isolation to cover Blink’s rendering processes. “Past experience suggests that potentially exploitable bugs will be present in future Chrome releases,” the Google-led Chromium team acknowledged in documentation. “There were 10 potentially exploitable bugs in renderer components in M69, 5 in M70, 13 in M71, 13 in M72, 15 in M73. This volume of bugs holds steady despite years of investment into developer education, fuzzing, Vulnerability Reward Programs, etc. Note that this only includes bugs that are reported to us or are found by our team.”

M69, M70 and so on are the Chromium labels for Chrome 69, Chrome 70, etc.

Chrome 77’s additional site isolation capabilities were foreshadowed last year by Justin Schuh, principle engineer and director of Chrome security, when he tweeted, “…work is under way to protect against attacks from compromised renderers.”

At the same time, Schuh said that, while engineers are working up site isolation for Chrome on Android, that’s also unfinished because of “resource consumption issues.” That consumption was one of the prime trade-offs for implementing site isolation, as increasing the number of processes increased the browser’s memory consumption by up to 13%.

As of Chrome 77, the Android version also sports site isolation, Moshchuk and Anforowicz said in their post two weeks ago. The technology wasn’t enabled the same way as on desktop personal computers, though.

“Unlike desktop platforms where we isolate all sites, Chrome on Android uses a slimmer form of Site Isolation, protecting fewer sites to keep overhead low, wrote Moshchuk and Anforowicz. “Site Isolation is turned on only for high-value sites where users log in with a password. This protects sites with sensitive data that users likely care about, such as banks or shopping sites, while allowing process sharing among less critical sites.”

That password-triggered site isolation has been switched on for nearly all – 99%, said Moshchuk and Anforowicz – on Android devices with at least 2GB of system memory.

More information about Chrome’s site isolation – a lot more – can be found in a paper that Moshchuk, along with two Google colleagues, Charles Reis and Nasko Oskov, presented in August at the annual USENIX Security Symposium.

Site isolation has been – or will be – taken up by other browsers. Count Opera, of course, among the former, as the Norwegian browser relies on the fruits of Chromium, the open-source project that produces the technologies, site isolation among them, that power Chrome.

In February, Mozilla said its own “Project Fission” would add site isolation to Firefox but did not spell out a timetable. It’s unclear what progress Mozilla has made since then – an initial newsletter from the Fission engineering group was never supplanted by one newer – but developers have reduced the memory Firefox requires for a typical process, a necessary step if site isolation isn’t to cripple the browser with performance hits.

Microsoft, which late in 2018 dumped the homegrown browser technologies behind Edge for Chromium’s, will almost certainly feature site isolation when it eventually debuts a stable version of the so-called “full-Chromium” Edge.

Not surprisingly, Google remains hot on site isolation. Very hot.

“I’m not exaggerating when I call site isolation the single greatest advance in browser security since the creation of the sandbox,” tweeted Google’s Schuh on Oct. 17. “It has fundamentally changed the kinds of guarantees the browser can provide and sets the strongest security baseline of any real-world platform.”

Copyright © 2019 IDG Communications, Inc.

Source link

Google Discloses iOS “Interactionless” Vulnerabilities

Google, through its Project Zero initiative, disclosed six vulnerabilities in iOS. In each case, a hacker could execute remote code on someone’s iPhone without any interaction by the user. Apple’s iOS 12.3 fixes five of the issues.

Project Zero is Google’s initiative to discover zero-day vulnerabilities and disclose them to the appropriate manufacturer, followed by a public announcement of the problem.

Recently, two members of the project team described six vulnerabilities in iOS. In each case, an attacker could send a malformed message through iMessage and the code would execute as soon as the victim opened and viewed the item. The announcement included proof-of-concept code and full details for five of the vulnerabilities.

Apple fully patched those five issues in iOS 12.3, so if you haven’t fully updated your devices, you should. Google withheld details of the sixth vulnerability for now as Apple hasn’t fully patched that issue yet. [ZDNet]

In Other News:

  • Samsung announces Galaxy Tab S6: The Galaxy S6 is official and the tablet has impressive specs to take on competitors. Boasting a Snapdragon 855 chipset, 6GB or 8GB of RAM, and 128GB or 256GB of storage, the tablet checks all the boxes to hit the high-end market. The Galaxy Tab S6 starts at $649 and includes an S-Pen. Samsung is also offering an optional keyboard and kickstand case for $179. [Samsung]
  • Apple’s Credit Card launches in August: In March, Apple announced the Apple Card. The company said the credit card would come in both digital and physical forms, although the titanium card wouldn’t display any card numbers, CCV, or expiration date. Now, Apple says it will start accepting applications for the card in August. [The Verge]
  • Wyze will offer smart plugs at insanely cheap prices: You could describe the entire Wyze business model as “smart things for cheaper than dirt.” The company is continuing that trend with upcoming smart plugs. The plugs will cost $14.99 for a two-pack, more than half the price of iClever plugs. Pre-orders ship in September. [Wyze]
  • Chrome 76 released yesterday with new features in tow: Google took the wraps off Chrome 76 yesterday. Once you receive this update, Chrom will block Flash by default, prevent websites from detecting incognito mode, and more. You should get the update automatically, but you can force it in Chrome’s “About” dialog. [How-To Geek]

Facebook wants to read your mind, but not in the usual creepy way. A few years ago, the company announced an effort to create technology that can read brain patterns and interpret thoughts without using invasive technology, like implanted electrodes. Technology like that could enable someone to communicate who otherwise can’t speak or move their limbs.

The company has been experimenting with patients with electrodes implanted in their brains and made new progress in the ultimate goal. Research subjects were asked to answer out loud a list of simple multiple-choice questions ordered randomly. During that process, by monitoring brain patterns, Facebook’s algorithms correctly detected what question the patient heard 75 percent of the time and what answer they chose 61 percent of the time.

The company is still many years away from a non-invasive method, but these are significant first steps. [IEEE Spectrum]

Want More? You can get the full Daily News Roundup by email every day in our newsletter. Just enter your email address and click the button.

Source link

What Are Permanent and Unpatched Security Vulnerabilities Referred To As?

Fingers typing on a backlit keyboard
Colin/Wikimedia Commons

Answer: Forever-Day Exploits

In computer security, a vulnerability that is attacked before the company responsible for maintaining the software or hardware has a chance to respond is known as a “zero-day exploit”. The zero-day attacks occur in the window between when the vulnerability becomes known to the company responsible for the product and when it releases some sort of patch or update to counter the attacks and seal over the security hole.

Increasingly, and to the alarm of many people within the security industry and beyond, many zero-day exploits are slowly morphing into forever-day exploits. Forever-day exploits arise when the company responsible for the software or hardware in question fails to do anything to correct the exploit.

This can occur because a product is near the end of its life cycle and the company no longer wishes to invest energy and money into maintaining it. In other instances, the company considers the exploit to be obscure enough or far enough removed from mission-critical elements of the system that plugging the hole is a non-priority. In instances where the exploit is part of the firmware of a device, it’s possible that the device cannot be patched and the exploit is permanent.

Unfortunately, as more and more systems are connected to company-wide and global networks, there is an ever-increasing chance that malicious users will be able to access devices with forever-day exploits and cause real harm.

Source link