The document discusses the security issues found in Switzerland's e-voting system called PIT. It summarizes that a security researcher found vulnerabilities like command injection and HTTP header injection by exploiting external dependencies and incomplete documentation. It raises discussion points around whether critical code for systems should be public or private, if unexploitable vulnerabilities are still issues, and how secure is secure enough for critical infrastructure.

1. Swiss Cybervoting PIT(falls)

2. Author
• CTF Player
• Independent Security Researcher
• Reverse Engineer & Exploit Dev
• Software Engineer
Jannis Kirschner
@ xorkiwi
Views are my own and not related to my
employer
/in/janniskirschner

3. E-Voting System
Registration Authentication Voting Tallying
Anonymity Verifiability Security
Components of an e-voting system

4. https://www.scytl.com/en/customers
Where‘s e-voting present?

5. Why cybervoting
+ Comfortable to use
+ Accessible
+ Might attract young voters
+ Citizens living abroad
+ Less invalid votes
- Security risks on scale
- Very expensive to maintain
- System must be trusted by users
- Hard to verify

6. „Open Code“

7. General details
250‘000 LOC
5 Components
300 External Dependencies
55MB

9. To build or not to build

10. Documentation

11. Incomplete (Security) Audits

12. PIT Scope

13. SDM Command Injection

14. Crafted X-Forwarded-For HTTP Header Injection

15. Discussion points
• „Should critical code be made public or stay private?“
• „Is an unexploitable vulnerability still a vulnerability?“
• „How secure is secure enough for critical systems?“