Voting software “PC-Wahl” for German national election is insecure – Updated Sep. 2017
In regards to “PC-Wahl” software, the Chaos Computer Club is now providing first aid. According to the CCC blog article, the PC-Wahl developers made three unsuccessful attempts to solve the biggest issue in their software. An “open source donation” is now supposed to help and the CCC has published sample code which is supposed to prevent manipulated updates to this program and (theoretically) to similar programs. Unfortunately, the blog article isn’t in English available yet but we will update this article with the link as soon as it’s on hand.
In Germany, it’s the election year and it’s all over town. In the past elections were conducted completely analogously but nowadays there’s more technology involved than one might like. Concerns aren’t always unsubstantiated though especially when a software used for the purpose of an election contains vulnerabilities — en masse.
How does such an election work?
But let’s start at the beginning: Usually, every citizen who is eligible to vote and who is willing to participate in the election goes to the local polling place (alternatively there is always the postal vote option of course), enters a voting cabin, and fills in the ballot. After that, the citizen tosses it in the ballot box. In the evening the results will be counted by the poll clerks – by hand. It’s only now that it becomes digital.
PC-Wahl: Problems from soup to nuts
The digital process is taken over by a software called “PC-Wahl” (“PC election”) and the CCC – Chaos Computer Club – doesn’t have anything good to say about it. According to them “the result of this analysis is somewhat of a „total loss“ for the software product”.
„Elementary principles of IT-security were not heeded to. The amount of vulnerabilities and their severity exceeded our worst expectations“, says Linus Neumann, a speaker for the CCC who was involved in the study.
The issues start with the process of how the updates are executed – with the key to decrypt the update packages being identical for all users – and continue to be present in most of the processes, up to the possibility to upload modified results to the census bureaus. This change could be performed by planting malicious code into PC-Wahl.
A complete list of all the PC-Wahl vulnerabilities is visible on the website of the CCC (German only).
Public authorities are informed
Such problems can’t be simply ignored of course which is why public authorities at a federal level are already alerted. The state of Hesse apparently is also using the software and the federal election supervisor already briefed its poll clerks. They’re supposed to check the transmitted results and report irregularities immediately.
We live in a digital age, so it is to be expected that more and more things are being digitalized. This also makes it more important than ever to ensure that the software used for democratic elections is secure.
This article is also available in: German