Source Code Review Report

Source Code Review Report Voting Solutions for All People (VSAP) Version 2.0 Report Date: 2020-01-06 Version: 1.2 Status: FINAL atsec information security corporation 9130 Jollyville Road, Suite 260 Austin, TX 78759 Tel: +1 512 615 7300 Fax: +1 512 615 7301 www.atsec.com Last update: 2020-01-06 Status: FINAL Version: 1.2 ©2020 atsec information security corporation Page 1 of 105 Revision history Version Change date Author(s) Changes to previous version 1.0 2019-12-06 Ryan Hill Initial draft Ryan Hill Added developer response to finding 1.1 2019-12-20 #24 1.2 2020-01-06 Ryan Hill Incorporated customer feedback Trademarks atsec and the atsec logo are registered trademarks of atsec information security corporation. FCMG and the FCMG Logo are registered trademarks of the Freeman, Craft, McGregor Group. Microsoft, Windows, .NET, and SQL Server are registered trademarks of Microsoft Corporation. MITRE is a registered trademark of The MITRE Corporation. Last update: 2020-01-06 Status: FINAL Version: 1.2 ©2020 atsec information security corporation Page 2 of 105 Table of Contents 1 Executive Summary .................................................................................................................... 5 2 Introduction ................................................................................................................................... 6 2.1 Scope and Basis ............................................................................................................... 6 2.2 Inputs ................................................................................................................................... 7 2.3 Threat Model ...................................................................................................................... 7 2.4 Methodology ....................................................................................................................... 8 2.4.1 Potential vulnerabilities ........................................................................................... 9 2.4.2 Code quality ........................................................................................................... 10 2.4.3 Design ..................................................................................................................... 10 2.4.4 Cryptography ......................................................................................................... 10 2.4.5 Back doors ............................................................................................................. 11 2.4.6 Measurement of findings ...................................................................................... 11 2.4.7 Depth of analysis ................................................................................................... 12 3 Description of the VSAP Voting System ................................................................................ 13 3.1 Voting System Functions ............................................................................................... 13 3.2 Physical Components ..................................................................................................... 14 3.3 Logical Components ....................................................................................................... 14 3.4 Data Interfaces ................................................................................................................ 14 3.4.1 Network interfaces ................................................................................................ 16 3.4.2 Peripheral devices ................................................................................................. 16 3.4.3 Files ......................................................................................................................... 17 3.4.4 Databases .............................................................................................................. 18 4 Static Code Analysis & Documentation Analysis ................................................................. 19 4.1 Design ............................................................................................................................... 19 4.1.1 Components ........................................................................................................... 19 4.1.2 Component interfaces .......................................................................................... 19 4.1.3 Cryptographic functions ....................................................................................... 20 4.1.4 Audit functions ....................................................................................................... 20 4.1.5 Source code organization .................................................................................... 20 4.2 Published Vulnerabilities ................................................................................................ 21 4.3 Code Quality .................................................................................................................... 34 4.4 Cryptography Usage Analysis ....................................................................................... 35 4.4.1 Algorithms ............................................................................................................... 39 4.5 Back Doors ....................................................................................................................... 40 4.6 Documentation Analysis ................................................................................................. 41 4.6.1 Technical Specifications ....................................................................................... 41 4.6.2 User Guides ........................................................................................................... 43 5 Findings....................................................................................................................................... 45 5.1 Public Vulnerability Search ............................................................................................ 45 5.2 Static Code Analysis & Documentation Review ......................................................... 76 Appendix A: Response to Finding 3, Hard Coded Passwords .............................................. 98 Glossary ....................................................................................................................................... 100 References................................................................................................................................... 103 Last update: 2020-01-06 Status: FINAL Version: 1.2 ©2020 atsec information security corporation Page 3 of 105 List of Tables Table 1: Interfaces .......................................................................................................... 15 Table 2: Device/Area Media ........................................................................................... 17 Table 3: Component Versions and Search Terms .......................................................... 34 Table 4: VSAP Algorithms .............................................................................................. 40 Table 5: Summary of Technical Specifications ............................................................... 43 Table 6: Summary of User Guides.................................................................................. 44 Table 7: Potential Vulnerabilities Identified ..................................................................... 75 Table 8: Summary of Issues Discovered During the Static Code Analysis ..................... 97 Table 9: Response to Finding 3, Hard Coded Passwords .............................................. 99 Last update: 2020-01-06 Status: FINAL Version: 1.2 ©2020 atsec information security corporation Page 4 of 105 1 Executive Summary This report was prepared by atsec information security corporation to review aspects of the security and integrity of Voting Solutions for All People (VSAP) Version 2.0. atsec is an independent, third-party company providing information-security assurance related services. This report identifies potential security weaknesses and vulnerabilities found through static code review and searches of public vulnerability sources. The search focused particularly on those that could be exploited to alter vote recording, vote results, critical election data such as audit logs, or to conduct a denial of service attack on the voting system. It should be noted that the public vulnerability search is most likely to identify vulnerabilities that have been reported in commonly used commercial off the shelf system components. Reviewers performed static code analysis, including both automated scans and manual reviews of the provided source code. The code quality was found to be satisfactory, the code is well organized and generally meets the requirements of CVSS, although a few minor non-conformities were found. Cryptographic use was also assessed. No deprecated algorithms were found to be in use. While the cryptographic code itself has been FIPS certified, it is not running on a platform that was tested for the certification. Therefore, the current use of the code does not meet the NIST standard for FIPS certification. See section 4.4, Cryptography Usage Analysis, and finding 1 in section 5.2, Static Code Analysis & Documentation Review, for details. The code was also reviewed for the possibility of back doors. No

Load more