Second flaw found in Swiss election system could change 'valid votes into nonsense,' researchers say

It's yet another reminder of what can go wrong when governments shift to electronic voting with no alternative plan.

Researchers have uncovered a second security flaw in the electronic voting system employed by the Swiss government.

The vulnerability involves a problem with the implementation of a cryptographic protocol used to generate decryption proofs, a weakness that could be leveraged “to change valid votes into nonsense that could not be counted,” researchers Sarah Jamie Lewis, Olivier Pereira and Vanessa Teague wrote in a paper published Monday.

This disclosure comes weeks after the same team of researchers announced they had uncovered a flaw in the e-voting system that could allow hackers to replace legitimate votes with fraudulent ones. Swiss Post, the country’s national postal service, which developed the system along with Spanish technology maker Scytl, said earlier this month that first vulnerability had been resolved.

Researchers said at the time that the vulnerability demonstrated what can go wrong when governments shift to electronic voting with no alternative plan. The security and integrity of electronic voting systems vary by country, and the vulnerabilities outlined in this research are specific to Switzerland, but other areas of the world increasingly are moving toward a voting infrastructure where it could soon be impossible to verify whether vote tampering has occurred. Christopher Krebs, head of the U.S. Cybersecurity and Infrastructure Agency told Congress last month election officials must have the ability to audit election results.

“If you don’t know what’s happening and you can’t check back at what’s happening in the system, you don’t have security,” he said.

In the paper published Monday, Lewis, Pereira and Teague said the second flaw is a weakness in the decryption proof known as the Fiat-Shamir heuristic. The vulnerability “allows a cheating authority to produce a proof of proper decryption, which passes verification, but declares something other than the true plaintext.”

Researchers, to examine the ramifications of the issue, wrote that they exhibited “an exploit in which a malicious authority … modifies selected votes during the (partial) decryption procedure and forges decryption proofs that are indistinguishable from valid ones, and would therefore pass verification.”

While such malicious activity would leave evidence “that something went wrong,” the research cited its mere possibility as evidence that the voting system does not offer “complete verifiability,” as its creators have suggested.

SwissPost has not yet confirmed the research team’s latest analysis, according to the paper.

“We are a small team of researchers investigating this code base for the first time,” they wrote. “In a few weeks, and while spending a small fraction of our time on this investigation, we have found critical breaks of both the main components of the proof that there is no server-side fraud – the complete verifiability property. We only inspected a small fraction of this voting system, and we therefore have no reason to believe that it does not contain other critical issues.”

Australia’s New South Wales Electoral Commission, which uses the same voting system, said in a statement it is not affected by the second vulnerability.

Tina Peters, through attorney, backs off formal role in Shasta County elections

Peters still left the door open to working with Shasta County on elections and doubled down on her statements that electronic voting machines should be discontinued.

Supreme Court approves mail-in ballots that arrive after Election Day 

Trump threatens executive order on elections, claims states must obey

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure