Zühlke – Empowering Ideas

Security review of gaming app

Game Design for Democracy: A Zühlke security review of ‘Projekt CH+ Games for Democracy’

Michael Hartmann

What makes an application using highly sensitive data containing users’ political beliefs safe? Getting inside the mind of a criminal. Understanding how a cybercriminal thinks and what entry points they’ll exploit is essential to cyber defense.

Two Zühlke engineers, Michael Hartmann and Pascal Wiesmann, give us an insight into one of their latest security projects that they implemented together with a game design graduate of Zurich University of the Arts, who is now project lead of Project CH+ and founder of a studio specialising in the creation of educational games (Serious Games).

Insight in brief

  • Learn how our security team at Zühlke helped launch an app built to encourage users to learn about political candidates and make democratic choices when voting for leaders.
  • We explore how to think like a cybercriminal when looking for ‘vulnerabilities’ and how to protect data.
  • The secret to safeguard users’ political beliefs data? Scroll down to get the full story.

A new era is upon us, one that promises total connectivity. The power of emerging technologies is so great, it has the potential to change the world beyond recognition. But unsullied connectivity makes us especially vulnerable to attack. And while new innovations have the potential to make the world a better place, the stakes are higher than ever.

Data breaches can have far-reaching consequences for both individuals and organisations. The risks range from identity theft, malware and ransomware to hijacking. But that’s no reason to ignore the potential gains innovation offers.

Take, for example, ‘Projekt CH+ Games for Democracy,’ an app designed as a political education tool. The app’s aim is to make politics more inviting and empower individuals to make informed political decisions.

The project began as Sophie Walker’s Master Thesis in Game Design at the Zurich University of the Arts and developed into a gamified voting aid. Its playful design helps users learn about political candidates. Think Tinder, but for voting. Swipe through the candidates and their profile and if you like them, swipe right.

Still, such an application is especially susceptible to attacks and cyber criminals wanting access to users’ political views. Knowing the app contained highly sensitive data, Sophie approached me for my opinion as a security engineer.

At our first meeting late one afternoon, Sophie showed me the app’s features and ran through how the application worked. Initially, the app asks a few questions to generate a personalised chart of your political views. Then, you’re introduced to candidates and their political party, main agendas, policies and motivations. If you like their views, you swipe right and it adds the candidate to your ‘favourites’ list.

The app’s elegant design and clever premise were enough to pique my interest. After our meeting, I knew we had to help Sophie.

So, I jumped the gun and pitched the project to my line manager. He agreed to let me take the project on as part of the Zühlke continuous learning and training program, in which 10% of Zühlke’s turnover is dedicated to the development of our skills. All of us are offered state-of-the-art education and continuous tailored training, which can take many different shapes. Project-based and intentional learning on the job is one part of it and something that’s highly valued. With this in mind, my line manager also suggested my colleague Pascal should join, who had a keen interest in learning more about security projects.  

Armed with two Zühlke engineers, Projekt CH+ was well on its way to successful cyber defence.

To secure an app like Projekt CH+, you need to take a 360 degree view, approaching both attack and defence. Working closely with Sophie and taking a holistic ‘Zühlke’ approach, we identified the data that needed protection. And The CH+ team took the privacy of its users seriously, so only a minimal amount of personally identifiable data (PID) is stored on their servers.

Next, we adopted the mindset of a cybercriminal and considered potential entry points susceptible to attack. Then, we created a comprehensive model of the app’s architecture to identify any ‘attack surfaces’. And once we’d identified them, we searched for sufficient countermeasures, or what’s known as ‘attack vectors’.

Attack vectors are methods used by cybercriminals to circumvent security measures in attack surfaces. In a web application this might be an SQL injection, credential sniffing or brute force password guessing. Once identified, we ensured sufficient countermeasures were in place. For example, the most effective countermeasure against a password guessing attack is a rate limit. If any of the countermeasures weren’t enough, it went straight in the report. And finally, we searched for known entry points in the web ecosystem—testing them relentlessly.

Just before the application’s release, we conducted a final review. This review was different. This time, we ran a detailed analysis of the recommended improvements and dug deep into potential loopholes. Luckily, it was a success, and the developers applied our suggestions. A week later, the application launched successfully and now they use it throughout Switzerland to help make informed political decisions. Education is everything when making political choices.

Unlike other applications, Projekt CH+ were refreshingly honest and didn’t want to collect their user’s data to profiteer. As a result, securing the application was a much easier task given the minimal amount of personally identifiable data (PID) on the application.

The connected world is well underway. And to deny it is akin to pretending the industrial revolution never happened. Its promise is as great as its perils. Though it needn’t be perilous. Cybersecurity is no longer an afterthought. Instead, it’s fast becoming an integral part of an organisation’s technology budget. To ignore it is to open Pandora’s box, wasting precious time and money.

Security engineer

Michael Hartmann

Security Engineer
Contact person for Switzerland

Michael Hartmann is a Security Engineer and since February 2016 at Zühlke. He achieved a master's degree in Mathematics at University of Zürich with a focus on Cryptography and a Certificate of Advanced Studies in Information Security at ETH. At Zühlke he worked as a Software Engineer with a focus on Security (OWASP, Kerberos, TLS, PKI) for a large telecom company and a large Swiss bank. Further, he teaches and maintains two courses in web security and network security.

At Zühlke, we have the experts to help our customers secure their products and succeed. Want to become one of them yourself? Look at our current vacancies here: