Today, @mspecter, @jimmykoppel, and @djweitzner released a detailed security analysis of Voatz, a blockchain-based Internet voting app that's used in West Virginia and other states. Their findings are devastating, bit.ly/VoatzPaper. But Voatz has even more problems! 1/
@mspecter @jimmykoppel @djweitzner The paper finds that the Voatz API server, if hacked, can change votes entirely. The authors say the app doesn't actually use a blockchain or an E2E-V protocol to secure app-server vote transmission, but essentially just a regular HTTPS connection to voatzapi.nimsim.com. 2/
@mspecter @jimmykoppel @djweitzner To protect the connection, Voatz uses certificate pinning. That means the app will only trust a specific HTTPS certificate to authenticate the server. For maximal security, the app should pin to a cert that is used only on a specific well hardened server. 3/
@mspecter @jimmykoppel @djweitzner However, the server at voatzapi.nimsim.com uses a wildcard certificate for *.nimsim.com. 4/ 
@mspecter @jimmykoppel @djweitzner We can look up that certificate using Censys (@censysio). censys.io/ipv4?d996355c5…
It turns out Voatz uses the same cert on 7 servers on 3 cloud providers. An attacker who hacked into any of these systems could likely get the private needed to intercept and change votes. 5/
It turns out Voatz uses the same cert on 7 servers on 3 cloud providers. An attacker who hacked into any of these systems could likely get the private needed to intercept and change votes. 5/
@mspecter @jimmykoppel @djweitzner @censysio How hard would that be? One of the servers, censys.io/ipv4/52.5.126.…, returns an HTTP header indicating it runs outdated software: "Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/5.4.16". That PHP version has dozens of CVEs. cvedetails.com/vulnerability-… 6/
@mspecter @jimmykoppel @djweitzner @censysio The bottom line: It looks like there’s a much greater risk than there should be that a network-based attacker, like a malicious WiFi router or ISP, could access Voatz’s private key, impersonate the Voatz API server, and then intercept and change votes. 8/
@mspecter @jimmykoppel @djweitzner @censysio It’s not surprising that the Voatz app has the major security problems MIT found. Election security experts, including me, have been warning for years that Internet voting systems are not safe to use in real elections. 9/
@mspecter @jimmykoppel @djweitzner @censysio What is shocking from the MIT findings is just how primitive the Voatz app is, under the surface, compared to state-of-the-art E2E-V approaches. I myself certainly assumed from Voatz's messaging that it was doing something more sophisticated than what the researchers report. 10/
@mspecter @jimmykoppel @djweitzner @censysio In my view, based on MIT's findings, no responsible jurisdiction should use Voatz in real elections any time soon. It will take major advances in security technology before Internet voting is safe enough. 11/11
