Diebold Systems Vulnerable

rhester · Mar 30, 2006

Deckard said:

the country has lurched back on track to preserve our system of government, as we have known it.
Keep D&D Civil.
Click to expand...

Deckard- If you wanted to turn a Constitutional Republic full of patriotic citizens with the right to bear arms into a federal dictatorship without the people even realizing it you couldn't come up with a better method.

Between entertainment, apathy and credit cards today's 'patriots' wouldn't listen if you told them that the system of government that kicked out 4 central banks, one league of nations and once had honest statesmen running for elected office long ago bit the dust.

If this isn't a plan someone should document it for the ruin of future Republics.

I hope with you that things lurch back on track, way back...

Deckard · Mar 30, 2006

rhester said:

Deckard- If you wanted to turn a Constitutional Republic full of patriotic citizens with the right to bear arms into a federal dictatorship without the people even realizing it you couldn't come up with a better method.

Between entertainment, apathy and credit cards today's 'patriots' wouldn't listen if you told them that the system of government that kicked out 4 central banks, one league of nations and once had honest statesmen running for elected office long ago bit the dust.

If this isn't a plan someone should document it for the ruin of future Republics.

I hope with you that things lurch back on track, way back...
Click to expand...

Color me optimistic, rhester. If the Democratic Party doesn't win big in the Fall, and doesn't capture at least one branch of Congress (and I think they have a shot at both), then I will share your concern.

Keep D&D Civil.

rhadamanthus · May 12, 2006

http://www.insidebayarea.com/ci_3805089

Worse and worse:

New security glitch found in Diebold system
Officials say machines have 'dangerous' holes
By Ian Hoffman, STAFF WRITER

Elections officials in several states are scrambling to understand and limit the risk from a "dangerous" security hole found in Diebold Election Systems Inc.'s ATM-like touch-screen voting machines.

The hole is considered more worrisome than most security problems discovered on modern voting machines, such as weak encryption, easily pickable locks and use of the same, weak password nationwide.

Armed with a little basic knowledge of Diebold voting systems and a standard component available at any computer store, someone with a minute or two of access to a Diebold touch screen could load virtually any software into the machine and disable it, redistribute votes or alter its performance in myriad ways.

"This one is worse than any of the others I've seen. It's more fundamental," said Douglas Jones, a University of Iowa computer scientist and veteran voting-system examiner for the state of Iowa.

"In the other ones, we've been arguing about the security of the locks on the front door," Jones said. "Now we find that there's no back door. This is the kind of thing where if the states don't get out in front of the hackers, there's a real threat."

This newspaper is withholding some details of the vulnerability at the request of several elections officials and scientists, partly because exploiting it is so simple and the tools for doing so are widely available.

A Finnish computer expert working with Black Box Voting, a nonprofit organization critical of electronic voting, found the security hole in March after Emery County, Utah, was forced by state officials to accept Diebold touch screens, and a local elections official let the expert examine the machines.

Black Box Voting was to issue two reports today on the security hole, one of limited distribution that explains the vulnerability fully and one for public release that withholds key technical details.

The computer expert, Harri Hursti, quietly sent word of the vulnerability in March to several computer scientists who advise various states on voting systems. At least two of those scientists verified some or all of Hursti's findings. Several notified their states and requested meetings with Diebold to understand the problem.

The National Association of State Elections Directors, the nongovernmental group that issues national-level approvals for voting systems, learned of the vulnerability Tuesday and was weighing its response. States are scheduled to hold primaries in May, June and July.

"Our voting systems board is looking at this issue," said NASED Chairman Kevin Kennedy, a Wisconsin elections official.

"The states are talking among themselves and looking at plans to mitigate this."

California, Pennsylvania and Iowa are issuing emergency notices to local elections officials, generally telling them to "sequester" their Diebold touch screens and reprogram them with "trusted" software issued by the state capital. Then elections officials are to keep the machines sealed with tamper-resistant tape until Election Day.

In California, three counties — San Joaquin, Butte and Kern — plan to rely exclusively on Diebold touch screens in their polling places for the June primary.

Nine other counties, including Alameda, Los Angeles and San Diego, will use Diebold touch screens for early voting or for limited, handicapped-accessible voting in their polling places.

California elections officials told those counties Friday that the risk from the vulnerability was "low" and that any vote tampering would be revealed to voters on the paper read-out that prints when they cast their ballots, as well as to elections officials when they recount those printouts for 1 percent of their precincts after the election.

"I think the likelihood of this happening is low," said assistant Secretary of State for elections Susan Lapsley. "It assumes access and control for a lengthy period of time."

But scientists say that is not necessarily true.

Preparations could be made days or weeks beforehand, and the loading of the software could take only a minute or so once the machines are delivered to the polling places. In some cases, machines are delivered several days before an election to schools, churches, homes and other common polling places.

Scientists said Diebold appeared to have opened the hole by making it as easy as possible to upgrade the software inside its machines. The result, said Iowa's Jones, is a violation of federal voting system rules.

"All of us who have heard the technical details of this are really shocked. It defies reason that anyone who works with security would tolerate this design," he said.
Click to expand...

rhester · May 12, 2006

electronic voting machines should never be used.
hand ballots- hand counted and verified.

keep America 'of the people'

rimrocker · May 14, 2006

I find it interesting that the GOP spin these days is that the national numbers look really bad for Repubs but if you look at the individual races, neither house will be lost to the Dems.

It will be interesting to see if those individual races correlate to certain types of voting systems.

Rocket River · May 14, 2006

Deckard said:

RR, do you have faith that our government is going to insure that these voting machines are used properly? I do not. Frankly, I think this may become one of the most gigantic scandals of our time. The Diebold system, from everything I've read about it, and I've been following this, off and on, for a long time, simply cries out to be hacked.

Why don't they simply print out a paper copy of each vote? How hard could that be? If there were hints of fraud, then you could check the paper ballot copies, which would have remained locked up, against the computer voting. Why isn't this being done? That is almost as big a mystery, to me, as using these machines in the first place.

Keep D&D Civil.
Click to expand...

they probably don't have a papy printout of the voting summary
NO
I do not beleive they will use the boxes' properly
Seriously
I beleive these machines could say I voted A when I voted B
and I would never know
nor
would the common man ever know if his vote was registered
like he put it in.

So . . basically. . . I guess I'm saying I have little faith
in the election process . . .esp one so easily tampered with

Rocket River

rhadamanthus · Jul 31, 2006

Still getting worse:

http://openvotingfoundation.org/

PRESS RELEASE -- JULY 31, 2006

FOR IMMEDIATE RELEASE

Subject: WORST EVER SECURITY FLAW FOUND IN DIEBOLD TS VOTING MACHINE
Contact: Alan Dechert
Reference: PICTURES
(Click on thumbnail. Click again on lower half of picture for high resolution)

SACRAMENTO, CALIFORNIA -- “This may be the worst security flaw we have seen in touch screen voting machines,” says Open Voting Foundation president, Alan Dechert. Upon examining the inner workings of one of the most popular paperless touch screen voting machines used in public elections in the United States, it has been determined that with the flip of a single switch inside, the machine can behave in a completely different manner compared to the tested and certified version.

“Diebold has made the testing and certification process practically irrelevant,” according to Dechert. “If you have access to these machines and you want to rig an election, anything is possible with the Diebold TS -- and it could be done without leaving a trace. All you need is a screwdriver.” This model does not produce a voter verified paper trail so there is no way to check if the voter’s choices are accurately reflected in the tabulation.

Open Voting Foundation is releasing 22 high-resolution close up pictures of the system. This picture, in particular, shows a “BOOT AREA CONFIGURATION” chart painted on the system board.

The most serious issue is the ability to choose between "EPROM" and "FLASH" boot configurations. Both of these memory sources are present. All of the switches in question (JP2, JP3, JP8, SW2 and SW4) are physically present on the board. It is clear that this system can ship with live boot profiles in two locations, and switching back and forth could change literally everything regarding how the machine works and counts votes. This could be done before or after the so-called "Logic And Accuracy Tests".

A third possible profile could be field-added in minutes and selected in the "external flash" memory location, the interface for which is present on the motherboard.

This is not a minor variation from the previously documented attack point on the newer Diebold TSx. To its credit, the TSx can only contain one boot profile at a time. Diebold has ensured that it is extremely difficult to confirm what code is in a TSx (or TS) at any one time but it is at least theoretically possible to do so. But in the TS, a completely legal and certified set of files can be instantly overridden and illegal uncertified code be made dominant in the system, and then this situation can be reversed leaving the legal code dominant again in a matter of minutes.

“These findings underscore the need for open testing and certification. There is no way such a security vulnerability should be allowed. These systems should be recalled”

OPEN VOTING FOUNDATION is a nonprofit non stock California corporation dedicated to demonstrating the need for and benefits of voting technology that can be publicly scrutinized.
Click to expand...

To emphasize:

A single switch is all that is required to cause the machine to boot an unverified external flash instead of the builtin verified EEPROM*.

*electrically erasable programmable read-only memory.

rhester · Jul 31, 2006

How do nations fall?

And has any nation ever learned anything from history?

We are tracking in a bad direction.

rhadamanthus · Oct 2, 2006

Great article in Rolling Stone from Kennedy Jr.:

http://www.rollingstone.com/politic...ennedy_jr__will_the_next_election_be_hacked/1

'Chris Hood remembers the day in August 2002 that he began to question what was really going on in Georgia... "It was an unauthorized patch, and they were trying to keep it secret from the state," Hood told me. "We were told not to talk to county personnel about it. I received instructions directly from [president of Diebold election unit Bob] Urosevich...' According to Hood, Diebold employees altered software in some 5,000 machines in DeKalb and Fulton counties, the state's largest Democratic strongholds. The tally in Georgia that November surprised even the most seasoned political observers. (Hint: Republicans won.)
Click to expand...

rhadamanthus · Jan 4, 2007

It just keeps getting better!

http://www.nytimes.com/2007/01/04/washington/04voting.html?_r=1&oref=slogin

A laboratory that has tested most of the nation’s electronic voting systems has been temporarily barred from approving new machines after federal officials found that it was not following its quality-control procedures and could not document that it was conducting all the required tests.

The company, Ciber Inc. of Greenwood Village, Colo., has also come under fire from analysts hired by New York State over its plans to test new voting machines for the state. New York could eventually spend $200 million to replace its aging lever devices.

Experts on voting systems say the Ciber problems underscore longstanding worries about lax inspections in the secretive world of voting-machine testing. The action by the federal Election Assistance Commission seems certain to fan growing concerns about the reliability and security of the devices.

The commission acted last summer, but the problem was not disclosed then. Officials at the commission and Ciber confirmed the action in recent interviews.

Ciber, the largest tester of the nation’s voting machine software, says it is fixing its problems and expects to gain certification soon.

Experts say the deficiencies of the laboratory suggest that crucial features like the vote-counting software and security against hacking may not have been thoroughly tested on many machines now in use.

“What’s scary is that we’ve been using systems in elections that Ciber had certified, and this calls into question those systems that they tested,” said Aviel D. Rubin, a computer science professor at Johns Hopkins.

Professor Rubin said that although some software bugs had shown up quickly, in other instances “you might have to use the systems for a while before something happens.”

Officials at the commission and other election experts said it was essential for a laboratory to follow its quality-control procedures and document all its testing processes to instill confidence in the results.

Commission officials said that they were evaluating the overall diligence of the laboratory and that they did not try to determine whether its weaknesses had contributed to problems with specific machines.

Computer scientists have shown that some electronic machines now in use are vulnerable to hacking. Some scientists caution that even a simple software error could affect thousands of votes.

In various places, elections have been complicated by machines that did not start, flipped votes from one candidate to another or had trouble tallying the votes.

Until recently, the laboratories that test voting software and hardware have operated without federal scrutiny. Even though Washington and the states have spent billions to install the new technologies, the machine manufacturers have always paid for the tests that assess how well they work, and little has been disclosed about any flaws that were discovered.

As soon as federal officials began a new oversight program in July, they detected the problems with Ciber. The commission held up its application for interim accreditation, thus barring Ciber from approving new voting systems in most states.

Ciber, a large information technology company, also has a $3 million contract to help New York test proposed systems from six manufacturers. Nystec, a consulting firm in Rome, N.Y., that the state hired, filed a report in late September criticizing Ciber for creating a plan to test the software security that “did not specify any test methods or procedures for the majority of the requirements.” The report said the plan did not detail how Ciber would look for bugs in the computer code or check hacking defenses.

A spokeswoman for Ciber, Diane C. Stoner, said that the company believed that it had addressed all the problems and that it expected to receive its initial federal accreditation this month. Federal officials said they were evaluating the changes the company had made.

Ms. Stoner said in a statement that although the Election Assistance Commission had found deficiencies, they “were not because Ciber provided incomplete, inaccurate or flawed testing, but because we did not document to the E.A.C.’s liking all of the testing that we were performing.”

She added that the test plan cited in New York was just a draft and that Ciber had been working with Nystec to ensure additional security testing.

The co-chairman of the New York State Board of Elections, Douglas A. Kellner, said Ciber had tightened its testing. But Mr. Kellner said yesterday that Nystec and Ciber continued to haggle over the scope of the security testing.

New York is one of the last states to upgrade its machines, and it also has created some of the strictest standards for them. Mr. Kellner said only two of the six bidders, Diebold Election Systems and Liberty Election Systems, seemed close to meeting all the requirements.

Besides Ciber, two other companies, SysTest Labs of Denver and Wyle Laboratories, in El Segundo, Calif., test electronic voting machines. Ciber, which has been testing the machines since 1997, checks just software. Wyle examines hardware, and SysTest can look at both.

The chairman of the Election Assistance Commission, Paul S. DeGregorio, said SysTest and Wyle received interim accreditations last summer. Mr. DeGregorio said two other laboratories had also applied to enter the field.

Congress required greater federal oversight when it passed the Help America Vote Act of 2002. Since then, the government also put up more than $3 billion to help states and localities buy electronic machines, to avoid a repeat of the hanging punch-card chads that caused such confusion in the 2000 presidential election.

The commission was never given a substantial budget, and it did not finish creating the oversight program until last month. Until then, the laboratories had been at the heart of the system to evaluate voting machines, a system that seemed oddly cobbled together.

While the federal government created standards for the machines, most of the states enacted laws to make them binding. The states also monitored the testing, and much of that work was left to a handful of current and former state election officials who volunteered their time.

As a result, voting rights advocates and other critics have long been concerned about potential conflicts of interest, because the manufacturers hire the laboratories and largely try to ensure confidentiality.

Michael I. Shamos, a computer scientist who examines voting machines for Pennsylvania, said about half had significant defects that the laboratories should have caught.

Besides certifying the laboratories, the Election Assistance Commission will have three staff members and eight part-time technicians to approve test plans for each system and check the results. The manufacturers will be required to report mechanical breakdowns and botched tallies, and Mr. DeGregorio said those reports would be on the agency’s Web site.

Dr. Shamos said, “This is not the sea change that was needed.”

He said he was disappointed that the commission had hired some of the same people involved in the states’ monitoring program and that it never announced it had found problems with Ciber operations.

Dr. Rubin of Johns Hopkins said the laboratories should be required to hire teams of hackers to ferret out software vulnerabilities.

And the laboratories will still be paid by the voting machine companies, though a bill now in Congress could change that to government financing.

A recent appearance in Sarasota, Fla., by the SysTest Labs president, Brian T. Phillips, also raised eyebrows. After a Congressional election in the Sarasota area ended in a recount last month, the victorious Republican candidate hired Mr. Phillips as a consultant to monitor the state’s examination of whether there had been a malfunction in the voting machines.

Several critics questioned whether Mr. Phillips should have taken such work, either because of its partisan nature or because it represented such a public defense of the industry.

Mr. Phillips said he did not see any conflict because his laboratory had not tested the software used in Sarasota. And the project does not appear to have violated the ethics rules of the election commission.
Click to expand...

rhester · Jan 4, 2007

I think either Lennin or Stalin said it doesn't matter who votes, just who counts the votes.

rockbox · Jan 4, 2007

Why the hell can't they just use the same system they use for the Lotto. It is secure, reliable and proven.

Forums

Diebold Systems Vulnerable

rhester Member

Deckard Blade Runner
Supporting Member

rhadamanthus Member

rhester Member

rimrocker Member

Rocket River Member

rhadamanthus Member

rhester Member

rhadamanthus Member

rhadamanthus Member

rhester Member

rockbox Around before clutchcity.com

Share This Page

About ClutchFans

Rockets Content

Support ClutchFans!

Diebold Systems Vulnerable

rhester Member

Deckard Blade Runner Supporting Member

rhadamanthus Member

rhester Member

rimrocker Member

Rocket River Member

rhadamanthus Member

rhester Member

rhadamanthus Member

rhadamanthus Member

rhester Member

rockbox Around before clutchcity.com

Share This Page

Deckard Blade Runner
Supporting Member