Select your language

Electronic voting? Necessary but safe?

Last Sunday in Peru, district, municipal and regional elections were organized. Faced with such an influx of people (only in Lima more than 9 million people voted, almost the 3rd part of Peru) it is increasingly archaic to think that we can make use of large-scale voting in the same way as it has been done all these years.

It also adds the idea that a lot of paper dismissal is being made, so making use of an electronic voting system would help a lot to preserve the environment, such as the speed of vote counting, speed of voters and the elimination of long queues.

In fact, digital voting mechanisms can relieve more than one and an entire population. But (there are always 'BUTS'), is it totally safe? Is it safe that a virtual vote can be considered valid? Is it safe that there are honest people who never threaten the safety and integrity of each of the votes? And not to mention availability, because if the digital voting service goes down, we are fried and scrambled.

In Columbia, a U.S. district, a pilot is being developed in which absentee voters would be allowed to cast their ballots, as well as encouraging citizens to evaluate the safety of the pilot system.
image
The system is based on an open source developed in collaboration with TrustTheVote. It works with the famous Ruby framework and is mounted on an Apache server with a MySQL database.
Absentee voters will receive a letter asking them to visit a page http://www.dcboee.us/DVM/; they will be given a 16-digit PIN. The system offers voters two options:

They can download a PDF ballot and mail it, they can download a PDF vote, fill it out electronically, and then upload the complete ballot in PDF format to the server. The server encrypts the uploaded ballots and saves them in encrypted form, so that after the elections, officials must transfer them to a PC without a network connection, in order to decrypt and print them. Printed ballots have the same procedures used for mail on paper ballots... until there everything OK, right? It seems safe. Now let's get to the beauty of the matter.

One sentence reads: "A vulnerability is as limited as you want it to be" and this applies this time. A small vulnerability has been found, which, no matter how small, can cause very large problems.

- Publicidad -

The vulnerability consists of the way the system processes uploaded ballots is poorly validated. The problem was confirmed with a test installation of the web application, and the following issues were encountered:

You can get the same access privileges as the server application program itself, including read and write access to encrypted votes and database. The ability to collect secret data stored on the server, including usernames and password. Ballots that had already been sent could be modified Investigators installed, during the initial attack, a backdoor to be able to view ballot updates. To prove they were in control of the server, they left a 'business card' on the confirmation page that users see after voting. After 15 seconds the page plays the anthem of the University of Michigan.This gives us an idea of what can be done if a small fault is discovered by some hacker with unscrupulous motives. Our votes can easily be modified by others and who do we blame? To the governmental or private organization that takes care of that, generating suspicions and many problems.

This is just a digital voting mechanism, new mechanisms can be created, other methods, other ways of implementing digital votes, but there will always be new gaps, new vulnerabilities, new flaws, new ways and new methods of HACKING THE SYSTEM.

I am not saying that this type of solutions should not be implemented, moreover, I say the opposite, both Peru and other nations must already implement this solution that is necessary for the well-being of us as well as the planet, but we must try to minimize the margin of horror in the computer systems that are implemented in this type of events.

For more information visit The Trust Vote. Organization that seeks to digitize this type of events of great magnitude, such as the elections of a country.

Source: Cholohack

Authors: Computer Security News

See original.

No comments

• If you're already registered, please log in first. Your email will not be published.

Comments are closed

The comments for this content are closed.

Security becomes a technological platform

Security becomes a technological platform

Mexico. Security is moving from a set of standalone systems to an integrated technology platform that combines artificial intelligence, video analytics, sensors, access control, and data platforms....

Security industry in Mexico and Latin America continues its expansion and professionalization

Security industry in Mexico and Latin America continues its expansion and professionalization

International. The security industry in Mexico and Latin America maintains a growth trend driven by digital transformation, the increase in physical and cyber risks, as well as the need to protect...

Veeam Introduces Agent Commander to Address AI Agent Risks in Enterprise Environments

Veeam Introduces Agent Commander to Address AI Agent Risks in Enterprise Environments

United States. Veeam Software today announced the launch of Agent Commander, a solution aimed at helping organizations detect risks associated with artificial intelligence, protect AI-based systems...

Key and asset management, the key to optimizing operations in logistics, distribution and construction companies

Key and asset management, the key to optimizing operations in logistics, distribution and construction companies

In industries where every minute counts, efficient asset and resource management has become a strategic factor to ensure operational continuity, safety, and productivity. By: Héctor Meléndez,...

Genesis Security Reduces False Alarms by 62% Through Milestone Integration and Actuate AI Analytics

Genesis Security Reduces False Alarms by 62% Through Milestone Integration and Actuate AI Analytics

Puerto Rico. A centralized monitoring operation developed by Genesis Security was able to significantly reduce the volume of false alarms in its security systems, thanks to the integration of...

Case study: Solar cameras and thermal intelligence optimize the safety of aquaculture farms

Case study: Solar cameras and thermal intelligence optimize the safety of aquaculture farms

Türkiye. An open-ocean fish farming farm in Turkey implemented a smart surveillance system based on Dahua solar cameras, thermal monitoring, and wireless data transmission to improve safety and...

 The Hidden Security Gap in Data Centers

The Hidden Security Gap in Data Centers

Imagine the journey of an authorized technician inside a data center. When he arrives, he presents his credential and enters the premises, and before entering the server corridor he needs a key to...

Digital fraud increased at Christmas

Digital fraud increased at Christmas

Colombia. During the holiday season, as e-commerce and digital transactions intensified, online fraud attempts also increased. Fake promotions, impersonation of businesses and messages that...

Milestone XPerience Days arrived in Mexico City with innovations in intelligent video management

Milestone XPerience Days arrived in Mexico City with innovations in intelligent video management

Mexico. Milestone Systems, a leading provider of open platform video management software (VMS), hosted the Milestone XPerience Days Mexico 2025 event, a gathering that brought together industry...

Hikvision Mexico launches the third edition of

Hikvision Mexico launches the third edition of "Hikvision Women"

Mexico. Hikvision Mexico announced the launch of the third edition of its "Hikvision Women" program, an initiative aimed at strengthening the participation and professional development of women in...

Suscribase Gratis
Remember Me
SUBSCRIBE TO OUR ENGLISH NEWSLETTER
DO YOU NEED A SERVICE OR PRODUCT QUOTE?
LATEST INTERVIEWS
SITE SPONSORS










LATEST NEWSLETTER
Latest Newsletter