Hart Verity Voting 3.0.1 Voting System Software Testing Supplemental Report

Source Code Review—Supplemental Results of regression testing through static code analysis of an updated Technical Data Package (TDP) provided after the initial evaluation, supplemental to Source Code Review, Verity Voting System 3.0 Verity Voting System 3.0.1 Report Date: 2018-09-05 Version: 1.1 Status: FINAL Classification: atsec/FCMG Public atsec information security corporation 9130 Jollyville Road, Suite 260 Austin, TX 78759 Tel: +1 512 615 7300 Fax: +1 512 615 7301 www.atsec.com Last update: 2018-09-05 Classification: atsec/FCMG Public Status: FINAL Version: 1.1 ©2018 atsec information security corporation Page 1 of 7 Revision history Version Change date Author(s) Changes to previous version 1.0 2018-08-27 Ryan Hill Initial draft 1.1 2018-09-05 Ryan Hill Updated with client changes Trademarks atsec and the atsec logo are registered trademarks of atsec information security corporation. Verity is a trademark of Hart InterCivic, Inc. FCMG and the FCMG Logo are registered trademarks of the Freeman, Craft, McGregor Group. Microsoft, Windows, .NET, and SQL Server are registered trademarks of Microsoft Corporation. MITRE is a registered trademark of The MITRE Corporation. Last update: 2018-09-05 Classification: atsec/FCMG Public Status: FINAL Version: 1.1 ©2018 atsec information security corporation Page 2 of 7 1 Purpose This report was prepared by atsec information security corporation to review aspects of the security and integrity of the Verity Voting System v. 3.0.1 atsec is an independent, third-party company providing information-security assurance related services. This report is supplemental to Source Code Review, Verity Voting System 3.0 and consists of results of regression testing through static code analysis of an updated Technical Data Package (TDP) provided after the initial evaluation. Last update: 2018-09-05 Classification: atsec/FCMG Public Status: FINAL Version: 1.1 ©2018 atsec information security corporation Page 3 of 7 2 Regression Test Results Table 1 summarizes the findings that arose from the source code review team's assessment of the updated TDP including code and documentation. Original Finding Fix Reported by Regression Test Findings Description Developer Password information is not Use SecureString instead The modules listed in the being stored using an of String. work paper were indeed appropriate/ suitable class. corrected to use The class String was being SecureString for the used for passwords. password. SHA-1 was used for sign- Use SHA-256 for the sign- The functions mentioned in hash and sign-data hash and sign-data the work paper were indeed functions which is not functions. fixed to use SHA-256 supported for FIPS 140-2 instead of SHA-1. The reviewer was unable to Update the “Technical Data The TDP was properly determine how keys and Package” (TDP) with an updated to address the IVs are generated. It was explanation of how these issue. not clear how the keys were are generated. generated or how the IVs for the keys were generated. Usage of authorized check Remove the file with no-op The module had indeed for a plugin could allow function since it was been removed. unauthorized use of the deprecated and no longer plugin and manipulation by used. an unauthorized user. There was a code authorization function in which it did nothing but return. The SQL query strings Change the code to The code addressed in the were constructed in a way parameterize the query finding had been corrected that does not follow best parameters. to parameterize the practices and is vulnerable parameters to the query to SQL injection. A bad function. coding practice of not using parameterized queries was Last update: 2018-09-05 Classification: atsec/FCMG Public Status: FINAL Version: 1.1 ©2018 atsec information security corporation Page 4 of 7 Original Finding Fix Reported by Regression Test Findings Description Developer being used. It was unclear how Update TDP with the The Technical Data configuration files were appropriate information. Package was updated with protected from information on using file unauthorized modifications. encryption software to help Some information on increase configuration file access was extrapolated security by encrypting the from the Technical Data drive (which is where the Package. configuration files are located). Using a Trusted Platform Module (TPM) only authentication model, only the person or people with the right credentials (passwords or USB fobs) can unencrypt the drive at boot time. During the installation of Update the TDP with the The developer added a Service Pack 1 (SP1), an appropriate information. detailed list of Service installation failure can occur Packs and other fixes that where some updates may should be applied to the not get installed. Some system to the Technical examples of the failed Data Package (which updates include includes the KB2949927 (Availability of aforementioned fixes). SHA-2 Hashing Algorithm) Using this list, a user can and KB3033929 (Security determine if the appropriate Update for Windows 7). fixes were applied to the The software system. documentation did not contain details on how it addressed this issue. Microsoft SQL Server 2012 atsec reviewed Verity_SQL atsec agrees with the (MSSQL) is not patched. Server 2012 Security vendor's assessment that Updates Risk Analysis because all the currently dated July 20th, 2018, known vulnerabilities provided by the vendor require either remote summarizing the known authenticated user access open vulnerabilities in SQL or cross-site scripting in a Server and assessing the browser to be exploitable, a risk of each to the product. product deployed in the Last update: 2018-09-05 Classification: atsec/FCMG Public Status: FINAL Version: 1.1 ©2018 atsec information security corporation Page 5 of 7 Original Finding Fix Reported by Regression Test Findings Description Developer atsec performed a similar field and configured vulnerability search and properly will not be confirmed the vendor's susceptible to any of these open vulnerability findings. known open vulnerabilities. atsec agrees that having not patched SQL Server currently results in no additional vulnerability to the product. Use of SHA-1 to sign Moving from the use of The vendor has updated hashed data. SHA-1 to SHA-2. the code to use SHA-2 instead of SHA-1 per the NIST requirement. The product is no longer None The third-party FIPS 140-2 certified or cryptographic module used compliant as claimed. by the product has an expired FIPS 140-2 certificate. Unless the provider of the cryptographic module performs such a certification the only resolution is to use another cryptographic module, that is FIPS 140-2 certified as a COTS component in this product. Note that FIPS 140-2 conformance is not the same as the pre-requisite CAVS certificates for the security functions used by the module, but includes conformance with many other requirements such as interfaces, self-tests, design assurance, and key management. Table 1: Summary of Regression Testing Findings Last update: 2018-09-05 Classification: atsec/FCMG Public Status: FINAL Version: 1.1 ©2018 atsec information security corporation Page 6 of 7 References Documentation provided for the regression testing included updated Verity EVS product documentation. Verity Documents Change Notes Verity Voting Version 3.0, August 15, 2018 Verity California Use Procedures – Modified Opening Section, August 3, 2018 Workstation WES7 Creation Process Document, August 5, 2018 Verity 3.0 Workstation Configuration Process Document, August 3, 2018 Verity Key Design Technical Document, July 31, 2018 Verity Voting 3.0 Notice of Protected Information, August 6, 2018 Verity_SQL Server 2012 Security Updates Risk Analysis, July 20th, 2018 HP Z240 Verity Workstation Manufacturing Process Document, July 31, 2018 Last update: 2018-09-05 Classification: atsec/FCMG Public Status: FINAL Version: 1.1 ©2018 atsec information security corporation Page 7 of 7