The Elyze application, supposed to help young people choose a candidate, suspected of manipulation for the benefit of Emmanuel Macron (Update: its co-founder enters the office of the government spokesperson)

The app has been under fire for several days because the code is not open source and several bugs have been found:

– In the event of a tie, the application favors Emmanuel Macron

– Sometimes the displayed order does not correspond to the percentage pic.twitter.com/7OOYtbaB3x

— Mathis Hammel (@MathisHammel) January 15, 2022

By doing research, we quickly come across the list which allows us to find the bug always putting Macron first on the ties: as JavaScript uses a stable sorting algorithm, in the event of a tie it is the original order in the list which is retained. pic.twitter.com/yLToB6xINb

— Mathis Hammel (@MathisHammel) January 15, 2022

To exchange data with the server, Elyze mainly uses a GraphQL database which seems to contain all the information on the candidates’ proposals as well as the user data. pic.twitter.com/wtaXI83kx3

— Mathis Hammel (@MathisHammel) January 15, 2022

Having direct access to GraphQL is not a flaw in itself: of course, it’s better to go through an API that takes care of requests, but if the permissions are correctly configured, you can manage without it.

— Mathis Hammel (@MathisHammel) January 15, 2022

But the problem is that the permissions were misconfigured. Everything related to the candidates was authorized in read and write, in particular the function allowing to add or modify a proposal… pic.twitter.com/tdwlm6Zlr9

— Mathis Hammel (@MathisHammel) January 15, 2022

Fortunately, the other parts of the database were not affected: it would have been really terrible to have leaked user data (date of birth, postal code, voting intentions in 2017 and 2022, result of each swipe on the app) pic.twitter.com/2v5r6F8I4i

— Mathis Hammel (@MathisHammel) January 15, 2022

In summary, the attack path was relatively simple to exploit:
– recovery of the .apk file
– extraction of the bundle.js
– recovery of the GraphQL endpoint and the API key
– identification of the configuration weakness

In all, I had about 3 hours.

— Mathis Hammel (@MathisHammel) January 15, 2022

To conclude, I think the developers of Elyze should make the application open source.

It is clear that security by obscurity absolutely does not prevent attacks, and algorithmic transparency is necessary in the context of elections.

— Mathis Hammel (@MathisHammel) January 15, 2022

On Elyze, accept ALL proposals (367). You therefore agree 100% with ALL candidates. And yet it is Macron who finishes 1st, Hidalgo 2nd and Jadot 3rd! Better you agreed 24 times with Macron and 30 times with Poutou who is…9th!#Elyzemacroniste pic.twitter.com/q7JUixxzl6

— stephane mauran 🔻φ 🏳️‍🌈✊🏿🤟🏽🖖🏻 (@StephaneMauran) January 12, 2022

Exact !

— stephane mauran 🔻φ 🏳️‍🌈✊🏿🤟🏽🖖🏻 (@StephaneMauran) January 12, 2022

Again twisted the app #Elyze… Who benefits from this bad move? Guess… https://t.co/QMvXaL2LTF

— Jean-Luc Melenchon (@JLMelenchon) January 12, 2022

1- I agree 100% with all the candidates on the left, Asselineau and Dupond-Aignan.
2- On the podium I have n.1 Hidalgo, n.2 Mélenchon n.3 Arthaud or I know Mélenchon’s program very well and it had to fall on him in 1.

— Maxime Gil’ Sayan 🔻🕊️🐢 🆙 (@MaxFIme) January 10, 2022

So whoever programmed this application really sucks and doesn’t know anything about politics. It does not deserve the free publicity given to it by the media.

— Maxime Gil’ Sayan 🔻🕊️🐢 🆙 (@MaxFIme) January 10, 2022

Good already, let’s skip the fact that the application gives a political interpretation of the candidates, that it is not enough to align measures to fully understand a global policy and make one’s choice. But let’s move on, because that would call into question the whole concept of the app. pic.twitter.com/Rb4LIyLxNU

— Tortuga roja 🐢 (@Agitateur3) January 11, 2022

Let’s go into the details, we notice that they all have a score of 100% compatible with me. Already there is a big problem. It is easy to understand that the application will rank the candidates who have an equal score (100%), from “least extreme” to “most extreme”. pic.twitter.com/m8QWjX2lZj

— Tortuga roja 🐢 (@Agitateur3) January 11, 2022

Let’s go into even more detail.
1- Macron: 2 measures
2- Hidalgo: 3 measures
3- Jadot: 7 measures
4- Mélenchon: 6 measures
5- Arthaud: 5 measures
6- Poutou: 10 measures
So it’s even worse, they don’t even have an equal score of compatible measures! pic.twitter.com/5paHyWjDzo

— Tortuga roja 🐢 (@Agitateur3) January 11, 2022

📲 How does Elyze, the application to choose your candidate, work?

BFMTV answers your questions ⤵ pic.twitter.com/UPwoVLtDN3

— BFMTV (@BFMTV) January 12, 2022