Welcome to HACK SIV!
"Never thought I'd say it, but… we are excited to get hacked." - Ariana
- Official launch tweet from Harri (Founder of the Voting Village): x.com/harrihursti/status/1820910389208453577
- If the (unverifiable) X numbers are to be believed: 15k views in the first few hours already
- Many reposts, lots of interest and enthusiasm shared. Seems to have really struck a chord.
- Around a dozen people signed up for live mock election hacking.
- Two security issues were posted to SIV’s public Issue Tracker (github.com/siv-org/siv/issues), both by @cjackett, and now resolved:
A. One — a possible injection attack — confirmed wasn't really exploitable, some other logic was protecting against it, but we tightened up validation around it nonetheless. github.com/siv-org/siv/issues/177
B. The other — unnecessarily weak RNG on auth token generation. We had an issue open on this from months prior already, plus alerting if anyone tried to trigger it (so we know no one has). But despite those excuses it's still unnecessary and embarrassing. Fortunately, very easily patched. Now done. github.com/siv-org/siv/issues/178
FYI although we marked those issues as closed, they're still visible. Here's a github search query for "All issues created on Aug 6 or later, open or closed": github.com/siv-org/siv/issues?q=is%3Aissue+created%3A%3E%3D2024-08-06+
Even before Live Mock Elections begin, you are invited to:
- Search for vulnerabilities in the SIV Protocol, the foundation of the Secure Internet Voting system - docs.siv.org/technical-specifications. After all, if the blueprint of the system is not sound, the implementation can’t possibly help.
- For a lighter start to the protocol, here’s a simpler illustrated overview: siv.org/protocol
- And of course, you can run the SIV code on your own machine for local testing: github.com/siv-org/siv
So, can you find novel ways to…?
1) Vote multiple times
2) Change someone else's vote, without detection
3) Destroy a vote already confirmed submitted
4) Learn how someone voted, without their help
5) Learn other personal info about voters
Bonus: Convince us of major score updates to docs.siv.org/compare
If you haven't already, check out the detailed contest rules (now posted to the site proper): hack.siv.org/rules
Feel free to ask us any questions. We also have a Signal group you can join here, if you wish.
Thank you for participating,
SIV Team
Welcome to HACK SIV!
"Never thought I'd say it, but… we are excited to get hacked." - Ariana
A. One — a possible injection attack — confirmed wasn't really exploitable, some other logic was protecting against it, but we tightened up validation around it nonetheless. github.com/siv-org/siv/issues/177
B. The other — unnecessarily weak RNG on auth token generation. We had an issue open on this from months prior already, plus alerting if anyone tried to trigger it (so we know no one has). But despite those excuses it's still unnecessary and embarrassing. Fortunately, very easily patched. Now done. github.com/siv-org/siv/issues/178
FYI although we marked those issues as closed, they're still visible. Here's a github search query for "All issues created on Aug 6 or later, open or closed": github.com/siv-org/siv/issues?q=is%3Aissue+created%3A%3E%3D2024-08-06+
Even before Live Mock Elections begin, you are invited to:
So, can you find novel ways to…?
1) Vote multiple times
2) Change someone else's vote, without detection
3) Destroy a vote already confirmed submitted
4) Learn how someone voted, without their help
5) Learn other personal info about voters
Bonus: Convince us of major score updates to docs.siv.org/compare
If you haven't already, check out the detailed contest rules (now posted to the site proper): hack.siv.org/rules
Feel free to ask us any questions. We also have a Signal group you can join here, if you wish.
Thank you for participating,
SIV Team