Recent anaylsis by the Chaos Computer Club have found German voting software PC-Wahl 10 to have fundamental security issues. Their report highlights a host of vulnerabilities which are trivial to exploit. Exploitation could tamper with voting results at municipal polling offices and transmitted to state election authorities.
The Vulnerabilities
- Automated software updates have no signature and are downloaded insecurely over HTTP
- Updates are hosted on a public shared hosting provider.
- PHP scripts on shared host allow read-write and full RCE was accomplished.
- FTP credentials for the update site were found in a publicly available ZIP file
- Vote results are transmitted using plain FTP or XML without signatures.
Local government Infrastructure
- test/test were valid VPN credentials
- FTP credentials were publicly downloadable.
- Vote results could be decrypted due to embedded symmetric key.
Other issues
- Home brewed encryption algorithms were used.
- When signatures were added they were not verified.
Media
- RCE Demo
- Site used https://www.wahlinfo.de/