Re: Request 2 CVE-IDs for Zeus Voting System

[DaKnOb <daknob.mac () gmail com>]

I would like to update the topic below on some information I got.
I admit that it was a mistake of me saying that the developers said some things, mainly because I read really quickly a 
related blog post somewhere by a person working in the same company, so after a talk with the blog post author and the 
development team of Zeus, I’d like to let you know that Zeus development team does not consider the mathematical proof 
of the technology the same as the implementation and additionally:

“We have not requested real security audits because there are not funds for Zeus, so no money to pay for the auditor. 
Of course we welcome work pro bono. Our argument is that you can have verifiable elections by using strong 
cryptography, but of course algorithms may be perfect but systems are not, and humans even less so”.

Additionally, the two XSS vulnerabilities have been patched in the master branch in less than 24 hours.

Sincerely,
Antonios A. Chariton

On May 13, 2015, at 19:09, DaKnOb <daknob.mac () gmail com> wrote:

> Zeus (https://github.com/grnet/zeus) is a fork of Helios that is actively developed by GRNET (http://www.grnet.gr/) 
> and is considered to be used in Greek Elections (starts with small and rolls out to larger elections). 
>
> Two XSS vulnerabilities that allow JavaScript Execution have been found, one of which has a PoC running JavaScript / 
> Modifying HTML in the voter’s browser during the voting process.
>
> XSS #1 - https://github.com/grnet/zeus/issues/28
> XSS #2 - https://github.com/grnet/zeus/issues/29
>
> Thank you,
> Antonios A. Chariton