Source Code Review Test Report

Tenex Software Solutions Precinct Central 4.0 Electronic Poll Book System Source Code Review Test Report for California TEN-18001SCRTR-01 Prepared for: Vendor Name Tenex Software Solutions Vendor System Precinct Central 4.0 Prepared by: 4720 Independence St. Wheat Ridge, CO 80033 303-422-1566 www.SLICompliance.com Accredited by the Election Assistance Commission (EAC) for Selected Voting System Test Methods or Services Tenex Precinct Central 4.0 Electronic Poll Book System California Certification Source Code Review Test Report v1.0 Copyright 2018 by SLI ComplianceSM, a Division of Gaming Laboratories International, LLC Revision History Date Release Author Revision Summary May14th, 2018 1.0 M. Santos Initial Release Disclaimer The information reported herein must not be used by the client to claim product certification, approval, or endorsement by NVLAP, NIST, or any agency of the Federal Government. Trademarks • SLI is a registered trademark of SLI Compliance. • All products and company names are used for identification purposes only and may be trademarks of their respective owners. California Certification Software Test Report Page 2 of 9 Report Number TEN-18001SCRTR-01 Tenex Precinct Central 4.0 Electronic Poll Book System California Certification Source Code Review Test Report v1.0 TABLE OF CONTENTS OVERVIEW ................................................................................................................................................... 4 REFERENCES ............................................................................................................................................... 4 REVIEW PROCESS ...................................................................................................................................... 4 SECURITY CODE REVIEW PROCESS .............................................................................................................. 4 INTEGRITY CODE REVIEW PROCESS.............................................................................................................. 4 VULNERABILITY CODE REVIEW PROCESS ...................................................................................................... 5 REVIEW RESULTS....................................................................................................................................... 6 SECURITY SOURCE CODE REVIEW ANALYSIS ................................................................................................ 6 INTEGRITY SOURCE CODE REVIEW ANALYSIS ................................................................................................ 7 VULNERABILITY SOURCE CODE REVIEW ANALYSIS ........................................................................................ 8 FINDINGS ..................................................................................................................................................... 9 SECURITY SOURCE CODE REVIEW DISCREPANCIES ....................................................................................... 9 INTEGRITY SOURCE CODE REVIEW DISCREPANCIES ...................................................................................... 9 VULNERABILITY SOURCE CODE REVIEW DISCREPANCIES ............................................................................... 9 CONCLUSION .............................................................................................................................................. 9 California Certification Software Test Report Page 3 of 9 Report Number TEN-18001SCRTR-01 Tenex Precinct Central 4.0 Electronic Poll Book System California Certification Source Code Review Test Report v1.0 Overview This Test Report details the Security, Integrity, and Vulnerability review of the source code of the Tenex Precinct Central 4.0 electronic poll book system. References The following key documents were used in preparing this test plan. 1. California Electronic Poll Book Regulations 2. Objective-C Style Guide (google.github.io/styleguide/objcguide.html) Review Process Security Code Review Process A manual Security review of the source code was conducted to analyze the Objective C code for findings against the following requirements: • Evaluation of the use and correct implementation of cryptography and key management. • Search for embedded, exploitable code (such as “Easter eggs”) that can be triggered to affect the system. • Evaluation of the likelihood of security failures being detected. o Are audit mechanisms reliable and tamper resistant? o Is data that might be subject to tampering properly validated and authenticated? • Evaluation of the risk that a user can escalate his or her capabilities beyond those authorized. Integrity Code Review Process A manual Integrity review of the source code was conducted to analyze the Objective C code for findings against the following requirements: • Search for use of runtime scripts, instructions, or other control data that can affect the operation of security relevant functions or the integrity of the data. • Analysis of the program logic and branching structure. • Adherence to other applicable coding format conventions and standards including best practices for the coding language used, and any IEEE, NIST, ISO or NSA standards or guidelines which the contractor finds reasonably applicable. • Evaluation of whether the design and implementation follow sound, generally accepted engineering practices. California Certification Software Test Report Page 4 of 9 Report Number TEN-18001SCRTR-01 Tenex Precinct Central 4.0 Electronic Poll Book System California Certification Source Code Review Test Report v1.0 • Is code defensively written against: o Bad data; o Errors in other modules; o Changes in environment; o User errors; and o Other adverse conditions. • Evaluation of whether the system is designed in a way that allows meaningful analysis, including: o Is the architecture and code amenable to an external review (such as this one)? o Could code analysis tools be usefully applied? o Is the code complexity at a level that it obfuscates its logic? • Analysis of error and exception handling. Vulnerability Code Review Process A manual Vulnerability review of the source code was conducted to analyze the Objective C code for findings against the following requirements: • Search for exposures to commonly exploited vulnerabilities, such as buffer overflows, integer overflow, and inappropriate casting or arithmetic. • Evaluation of potential vulnerabilities and related issues (code quality and standards compliance), considering that an exploitable issue in a component that is not in itself security relevant could be used to subvert more critical data. This is an issue whenever the architecture of the system does not provide strong separation of the components. • Search for dynamic memory access features which would permit the replacement of certificated executable code or control data or insertion of exploitable code or data. Should any vulnerability be discovered, SLI will identify the particular requirement applicable to each vulnerability. To the extent possible, reported vulnerabilities will include an indication of whether the exploitation of the vulnerability would require access by: • Voter: Usually has low knowledge of the Electronic Poll Book System’s software and/or hardware design and configuration. Some may have more advanced knowledge. May carry out attacks designed by others. • Poll worker: Usually has low knowledge of the Electronic Poll Book System’s software and/or hardware design and configuration. Some may have more advanced knowledge. May carry out attacks designed by others. They have access to the software and/or hardware for up to ten days, but all physical security has been put into place before the machines are received. California Certification Software Test Report Page 5 of 9 Report Number TEN-18001SCRTR-01 Tenex Precinct Central 4.0 Electronic Poll Book System California Certification Source Code Review Test Report v1.0 • Elections official insider: Wide range of knowledge of the Electronic Poll Book System’s software and/or hardware design and configuration. May have unrestricted access for long periods of time. Their designated activities include: o Set up and pre-election procedures; o Election operation; o Post-election procedures; and o Archiving and storage operations. • Vendor insider: With great knowledge of the Electronic Poll Book System’s software and/or hardware design and configuration. They have unlimited access to the Electronic Poll Book System’s software and/or hardware before it is delivered to the purchaser and, thereafter, may have unrestricted access when performing warranty and maintenance service and when providing election administration services. SLI will not verify or demonstrate exploitability of the vulnerability but the report of the vulnerability will identify factors involved in the exploitation. Any vulnerability theories developed by the source code review team members shall, to the extent possible, be referred to the Secretary of State staff. SLI does not verify or demonstrate exploitability of the vulnerability. Any vulnerability theories developed by the source code review team members shall, to the extent possible, be referred to the Secretary of State staff. The review process for the code base incorporated the best effort within the time allowed to find and report observations for the above categories. As such, it is understood that there may be undetected vulnerabilities in these categories. Review Results Security Source Code Review Analysis SLI conducted a Security source code review of the Tenex Precinct Central 4.0 electronic poll book system’s Objective C source code for compliance with the California Electronic Poll Book Regulations The source code was reviewed for evaluation of the use and correct implementation of cryptography and key management • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination that no issue was found. The source code was reviewed for embedded, exploitable code (such as “Easter eggs”) that can be triggered to affect the system. California Certification Software Test Report Page 6 of 9 Report Number TEN-18001SCRTR-01 Tenex Precinct Central 4.0 Electronic Poll Book System California Certification Source Code Review Test Report v1.0 • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination that no issue was found. The source code was evaluated for the likelihood of security failures being detected in the following two areas: 1. Are audit mechanisms reliable and tamper resistant? 2. Is data that might be subject to tampering properly validated and authenticated? • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination that that no issue was found. The source code was evaluated for the risk that a user could escalate his or her capabilities beyond those authorized. • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination that that no issue was found. Integrity Source Code Review Analysis SLI conducted an Integrity source code review of the Tenex Precinct Central 4.0 electronic poll book system’s Objective C source code for compliance with the California Electronic Poll Book Regulations. The source code was reviewed for use of runtime scripts, instructions, or other control data that can affect the operation of security relevant functions or the integrity of the data. • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination that no issue was found. The source code was analyzed for program logic and branching structure. • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination that no issues were found in the logic and branching. The source code was reviewed for adherence to other applicable coding format conventions and standards including best practices for the coding language used, and any IEEE, NIST, ISO or NSA standards or guidelines which the contractor finds reasonably applicable. • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination that this system complies with the Objective-C Style Guide. California Certification Software Test Report Page 7 of 9 Report Number TEN-18001SCRTR-01 Tenex Precinct Central 4.0 Electronic Poll Book System California Certification Source Code Review Test Report v1.0 o www.github.io/styleguide/objcguide/html The source code was evaluated for whether the design and implementation follow sound, generally accepted engineering practices. Is code defensively written against: • Bad data; • Errors in other modules; • Changes in environment; • User errors; and • Other adverse conditions. • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination that no issue was found. The source code was evaluated for whether the system is designed in a way that allows meaningful analysis, including: • Is the architecture and code amenable to an external review (such as this one)? • Could code analysis tools be usefully applied? • Is the code complexity at a level that it obfuscates its logic? • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination that there were no issues found. The source code was analyzed for error and exception handling. • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination of an issue that the database does not always send an error message when there are failures. Vulnerability Source Code Review Analysis SLI conducted a Vulnerability source code review of the Tenex Precinct Central 4.0 electronic poll book system’s Objective C source code for compliance to the California Electronic Poll Book Regulations. The source code was reviewed for exposures to commonly exploited vulnerabilities, such as buffer overflows, integer overflow, and inappropriate casting or arithmetic. • The expected outcome was that no issue would be found. • The actual outcome was a determination that no issues were found. California Certification Software Test Report Page 8 of 9 Report Number TEN-18001SCRTR-01 Tenex Precinct Central 4.0 Electronic Poll Book System California Certification Source Code Review Test Report v1.0 The source code was reviewed for evaluation of potential vulnerabilities and related issues (code quality and standards compliance), considering that an exploitable issue in a component that is not in itself security relevant could be used to subvert more critical data. This is an issue whenever the architecture of the system does not provide strong separation of the components. • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination that no issues were found. The source code was evaluated for dynamic memory access features which would permit the replacement of certificated executable code or control data or insertion of exploitable code or data. • The expected outcome for this review was that no issue would be found. • The actual outcome for this review was a determination that no issues were found. Findings This section summarizes any Findings from the Tenex Precinct Central 4.0 Security, Integrity and Vulnerability Objective C source code review. Security Source Code Review Discrepancies • No issues were found in the Tenex Precinct Central 4.0 electronic poll books system Security Objective C source code review. Integrity Source Code Review Discrepancies • One issue was found in the Tenex Precinct Central 4.0 electronic poll books system Integrity Objective C source code review. o The database does not always send an error message when a failure occurs. Vulnerability Source Code Review Discrepancies • No issues were found in the Tenex Precinct Central 4.0 electronic poll books system Vulnerability Objective C source code review. Conclusion For the Security, Integrity, and Vulnerability review of the Tenex Precinct Central 4.0 electronic poll book system code base, one issue was found. California Certification Software Test Report Page 9 of 9 Report Number TEN-18001SCRTR-01