[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 14 May 2015 19:55:08 +0300
From: DaKnOb <daknob.mac@...il.com>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: Re: Request 2 CVE-IDs for Zeus Voting System
I would like to update the topic below on some information I got.
I admit that it was a mistake of me saying that the developers said some things, mainly because I read really quickly a related blog post somewhere by a person working in the same company, so after a talk with the blog post author and the development team of Zeus, I’d like to let you know that Zeus development team does not consider the mathematical proof of the technology the same as the implementation and additionally:
“We have not requested real security audits because there are not funds for Zeus, so no money to pay for the auditor. Of course we welcome work pro bono. Our argument is that you can have verifiable elections by using strong cryptography, but of course algorithms may be perfect but systems are not, and humans even less so”.
Additionally, the two XSS vulnerabilities have been patched in the master branch in less than 24 hours.
Sincerely,
Antonios A. Chariton
On May 13, 2015, at 19:09, DaKnOb <daknob.mac@...il.com> wrote:
> Zeus (https://github.com/grnet/zeus) is a fork of Helios that is actively developed by GRNET (http://www.grnet.gr/) and is considered to be used in Greek Elections (starts with small and rolls out to larger elections).
>
> Two XSS vulnerabilities that allow JavaScript Execution have been found, one of which has a PoC running JavaScript / Modifying HTML in the voter’s browser during the voting process.
>
> XSS #1 - https://github.com/grnet/zeus/issues/28
> XSS #2 - https://github.com/grnet/zeus/issues/29
>
> Thank you,
> Antonios A. Chariton
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
