Diebold Shows Anyone How To Break Into Their E-Voting Machines
from the yikes dept
Well, this is just fantastic. Following the claims that there's no real problems with e-voting machines, almost immediately followed by reports of massive fraud with e-voting machines in Brazil, Alex Halderman is pointing out that Diebold, in their infinite wisdom, are making it ridiculously easy to break into their machines. Halderman was a part of the team that showed that Diebold's locks on their e-voting machines used a default key that was common to many hotel minibars and could be found easily in many places. However, the researchers who noted this were still careful never to show the actual key, preferring not to help anyone who seriously intended on breaking into the machines. Diebold, on the other hand, isn't so careful. The company, that has continually played down reports of security flaws is apparently selling the very key you need to break into their boxes on their online site... with a picture of the key. You need to be a Diebold account holder to buy it, but anyone can look at the key and then figure out how to make their own copy -- and, in fact, that's exactly what someone did. He used the picture to cut his own keys and sent the keys to Halderman, who found that two of the three keys opened the Diebold locks with ease. The guy who discovered this notified Diebold a month ago, but Diebold did not respond and has not removed the image of the key from their website.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
Diebold's e-voting machine security
[ link to this | view in chronology ]
Hooray Beer!
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Choices, choices
a) Improve their security
b) Take down the pictures
c) Sue the guy who made the keys
Hmmmm....
[ link to this | view in chronology ]
That's Amazing!!
[ link to this | view in chronology ]
have you bothered to think.
1. as this is a tech new site I'll assume that many of you know what a CRC/HASH check is. the first action done by the systems bois is a hash check on the CARD and ROM if they fail the system will not boot.
2. the only people with access to the machines that can set the CRC/HASH are your county election staff. not state or national, just the county.
3. the machines are not updated using memory cards. they are plugged in via a Ethernet connection for a push network wipe. I am sure many of you are used to this technology as you use it every time you do a network install of windows.
4. they use a 256 bit floating encryption scheme to protect the results on every machine. that means that a card from one machine would not be able to be accessed by any other machine. they are paired at the election office before ever going to the poll location.
just a thought, but in a lab I can change almost anything to make it look like it will function just as I want it to. however with it being a federal felony with mandatory 5-10 years for election fraud it's funny reading the misinformation being spread.
[ link to this | view in chronology ]
Re: have you bothered to think.
You can say anything you want about 256 floating bit encryption and CRC/HASH all you want.
It seems to me that you're whining because people think you're a moron and/or a Diebold employee.
(Jury is still out on that...)
You think that any of these so-called security features are valid? Are you actually trying to tell us that the machines are safe and tamper-proof?
Wake up, get out of bed and tell me what color the sun is in your world.
It's been proven time and time again that you're WRONG. The machines have been 'adjusted', can and easily be hacked, by many people.
And you think any of your statements about a felony and 5-10 years mean jack to people? Are these the same people that are sending US soldiers over to die for oil?
Or the same a@@holes that send me SPAM from bots and hijacked machines? - oh wait there is really good security on those machines as well- couldn't possibly be any SPAM now could there?
Go back to sticking your head in the sand and keep toting that party line.
[ link to this | view in chronology ]
Re: Re: have you bothered to think.
Angry Poll Worker - is it not the least bit disturbing to you that in all the areas independent people have looked at there have been significant security flaws
I would suggest that not only country election staff have access to machines - I am supposedly the only person with access to my house, it didn't stop me being burgled (by someone with a lot less to gain than a fixed election)
Relying on the security of some automated CRC check and just sitting back smuggly and stating "its all OK then" is maybe a little blind
At the end of the day the physical security on the machine is built to the same standard as a mini-bar, what exactly does that infer about the rest of the security?
Maybe you do update your machines by network -
Is that the same everywhere?
Would it remove a malicious program already present on the machine?
Are you sure?
Have you tested?
How utterly confident are you that there is never one person alone with a machine for over a minute on the entire of election day?
It would probably be unreasonable to seriously respond to Prinston's plea of "We urge public officials to address these issues promptly" http://itpolicy.princeton.edu/voting far more sensible would be stick your fingers in your ears al-la "La, la, laa i'm not listening"
Finally there ARE people out there who fund campaigns (legally) to the tune of millions to get political advantage and there ARE criminals who work for a lot less than this and risk similar penalties. Is it that big a leap of imagination to combine the two?
[ link to this | view in chronology ]
Re: have you bothered to think.
Sorry if I was a little harsher earlier - the face of the polling worker around 16min 20secs on this video has softened me slightly and rightly humbled me http://www.youtube.com/watch?v=fKs12idbZ_I
She has just learnt that the Diebold system she has been responsible for overseeing is vulnerable to a hack and votes can be realistically altered. This is the face of a true believer and stalwart of democracy finding out the security on her systems is not secure
I would urge you to watch the clip and decide - the gentleman supervising the test is not a tin-foil hat man - he is one of Florida's senior election officials
I think when dealing with a technology like this which can be messed with this is always going to be the problem - Diebold have always stated their systems are secure and denied all problems allowing presidents, congressmen, senators etc to be selected using them. They still don't admit any problems with the optical system in use in the test - what aren't they telling you about the system you currently use?
[ link to this | view in chronology ]
1, 2, 3, 4, 5
[ link to this | view in chronology ]
Open sourcing
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
now it's easier to secure the votes are accurate and everyone is claiming they are less accurate.
I guess time will tell.
[ link to this | view in chronology ]
Re: Re:
Ah well guess we're back to "la la la i'm not listening then"
PS: time did tell - it already happened, some people are trying to point out it might be nice if it didn't happen every time? you know like you went back to having a democracy and stuff?
[ link to this | view in chronology ]
Hanging chads anyone?
[ link to this | view in chronology ]
Brazilians don't use Diebold machines
Come to visit Brazil, when you want to learn how to do an election with more than 100 million voters and give the results in less than 24 hours, instead of months of paper counting like US did in Bush junior's first election.
[ link to this | view in chronology ]
Hacking Democracy
[ link to this | view in chronology ]
Re: Hacking Democracy
la,la,la,la,la
[ link to this | view in chronology ]