The Ballot is Busted before the Blockchain
Discloses reverse engineering findings and side-channel vulnerabilities in the Voatz blockchain mobile voting application.
Summary
Security Analysis of the Voatz Mobile Voting App
In 2018, West Virginia deployed the Voatz mobile phone application for select overseas voters, asserting that permissioned blockchains, biometrics, and mixnets guaranteed ballot integrity.
Reverse Engineering and Cleanroom Server Reimplementation
Researchers reverse-engineered the compiled Android application and implemented a cleanroom server to dissect the proprietary protocol and client verification mechanisms.
Passive Side-Channel Secret Ballot Extraction
Security flaws enable a completely passive network eavesdropper to observe packet lengths and timing characteristics to accurately recover a voter's secret ballot selections.
Vulnerabilities in Third-Party Software Dependencies
The integration of commercial third-party SDKs for analytics and crash reporting exposes sensitive voter data and introduces critical points of failure into the voting pipeline.
Related talks
Recon Conference·45 min
Presenters detail vulnerability discovery and exploitation in Recon 2017 Montreal - Reverse Engineering Of Blockchain Smart Contracts by Patrick Ventuzelo.
Demo Labs·31 min
A demonstration of Mobile Security Framework (MobSF) for performing automated static and dynamic security analysis of mobile apps.
Main Stage·1 hr 4 min
Elinor Mills
Elinor Mills presents the l0pht testimony 20 years later and other things: 2018 is the 20th anniversary of the hacker think-tank L0pht Heavy Industries testimony before the US Senate Homeland Security & Governmental...