The Diebold Voting-Machine Hack 277
Warm John writes to mention a short article on Doctor Dobbs Journal about the Hack that couldn't be done. "Hacking a Diebold voting machine was the focus of Cigital's Gary McGraw's keynote at SD Best Practices. He discussed 'Security Analysis of the Diebold AccuVote-TS Voting Machine,' a paper released by Edward Felten, Ari Feldman, and Alex Halderman of the Princeton Center for Information Technology Policy. 'The paper details a simple method whereby the Princeton team was able to compromise the physical security of a Diebold voting machine, infecting it with a virus that could change voting results and spread by memory-card to other machines of the same type.'"
firmware flash (Score:3, Funny)
Re:firmware flash (Score:5, Funny)
Re: (Score:3, Funny)
meme seems appropriate (Score:5, Funny)
America Has A Rootkit (Score:5, Funny)
Re: (Score:2)
Would suggesting a re-format put me on an FBI watch-list?
Money more important than a fair vote? (Score:4, Insightful)
However, Demma seems more incensed at Funk because he may cost the state $40,000 for Diebold's astronomical recertification fee. He doesn't seem to be worried that people might not trust these machines. He doesn't seem to care that a state officer was worried enough to call in a non-profit third party to verify the integrity of these machines. I mean, these things could possibly affect the outcome of a vote, the foundation for a democratic republic! But instead of worrying about these machines he's clearly more upset about the $40,000 and Funk not talking to him about his concerns regarding the voting machines.
And of COURSE Diebold is going to tell you the machines are fine and fair. Sheesh, they want to make money don't they?
Isn't it great that chief elections officers have their priorities straight?
Give me a ballot sheet and a pencil any day over these closed, proprietary black box machines.
Re:Money more important than a fair vote? (Score:4, Insightful)
Re:Money more important than a fair vote? (Score:5, Insightful)
Nobody in their right mind who understands what's going on can condone the existence of closed-source software in the vote counting or vote taking process at all, whether by Diebold or otherwise.
If elections officials told the public, "We're going to count by a secret counting method and we won't tell you how we're going to count; you'll just have to trust us that we picked the right person for the job," the public would burn down city hall. Unfortunately, the public hasn't yet realized that this is exactly what is happening....
Anybody want to raise money for a front page ad in the NY Times? Maybe with a little extra money left over to donate to local fire departments? :-)
Re: (Score:2, Insightful)
Nothing suggests to me that the American public are that concerned to do anything. It barely flinched with the NASA wiretapping incident, and more recently the passing of
Re:Money more important than a fair vote? (Score:5, Funny)
If elections officials told the public, "To protect your Freedom we are going to count by an undisclosed counting method and we won't help terrorists by telling the evildoers how we're going to protect the public and count the votes; you'll just have to support our troops and the person we picked for the job," the public would greet you as liberators
There, corrected it for ya.
Re: (Score:2)
Actually, open source doesn't matter here (Score:3, Insightful)
There is no way for you to independently verify that the VERSION of the OSS software on a machine is actually what you think it is.
You MUST have a system where the voter can verify what their machine thinks their vote is (eg a slip of paper) in such a way that you can reliably recount it by hand (and by multiple people, of course) However, once you HAVE a recountable system suddenly it doesn't really matter how trustworthy the machin
Re:Money more important than a fair vote? (Score:4, Insightful)
Funny, I didn't get the feeling the poster mentioned closed source so much to advocate open source software, as to draw the clear paralell between that and a secret ballot counting method implementation. Let me re-read... Yep, he didn't mention using Open Source at all, he mentioned closed source and then followed it with the very valid, extremely painfully obvious paralell between that and a secret ballot counting procedure.
Do you see that now or is there a problem with YOUR reading comprehension or critical thinking skills?
Re: (Score:2, Informative)
I think it sad and scary that the re
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
We vote for the lower house and the PM by voting for one person (with a preference based system, where you number each box 1 - n) in fairly small districts. As with the US this devolves into a 2 party system, though some independant candidates are elected from time to time, and can sometimes hold the balance of power.
The upper house is voted at the state level, again by a preference system. And while this is dominated by the 2 main parties, it oper
Re:Money more important than a fair vote? (Score:4, Interesting)
Re: (Score:3, Interesting)
http://www.kcpw.org/article/1719/ [kcpw.org]
Re: (Score:2)
Re:Money more important than a fair vote? (Score:5, Insightful)
Huh? Diebold is certifying its own machines? To say that this is like the fox guarding the henhouse would be a gross oversimplification...it's more like the fox has control of a large percentage of the henhouses throughout the country, and is working diligently to ensure this does not change.
Re: (Score:3, Interesting)
One of my votes since 1998 has mattered. ONE.
Even then, I was #31.
My district is so gerrymandered.
If I was a republican- my vote doesn't matter.
If I was a democrat- my vote doesn't matter.
And then on top of that- I only get to vote for candidates that were pre-selected for me by the party (aka corporations, lawyers, and politicians (who are beholden to the corporations) ).
Why vote when it is going to be 70/30
Re: (Score:3, Informative)
Also keep in mind that the vast majority of corporations are small businesses (can't find a citation ATM). That's important because small businesses employ 52% of the workers in t
Re: (Score:2)
I did a bunch of research about small businesses a while back.
The failure* rates (less than 500 employees) look something like this:
One Year - 20%~30%
4~5 Years - ~60%
Six Years - ~80%
Those statistics vary depending on age, education level, business experience, startup money, gender, race, acc
The box was not production hardware... (Score:2)
The Diebold machine used for this article came via private hands. There is no independent verification that the software contained in it is the same as the production Diebold machines used in the vote tallies.
On the other hand, the fact that the memory card is contained behind a door which can be easily picked, or completely subverted by removing screws, is practically criminal negligence on the part of Diebold. Frankly, I'm surprised these things aren't as security-hardened as the ATM's that Diebold mak
Re:The box was not production hardware... (Score:4, Interesting)
It does make a difference. With a punch card, or a paper ballot, or even a mechanical voting both anyone can trace when fraud has occured. And in those cases we implement some security, track where the fraud came from (if we can) and redo the election.
With the current generation of electronic voting machines, we can't do that. I don't care who makes a good machine, but Diebold hasn't made one. And they've defended that design as if they think it is a good machine. Geeks don't like people who pretend a bad design is a good design. We'll tear into them. If they routinely defend bad design by saying it is good design and overlooking what we think are obvious flaws we'll notice, and start to expect that. Until they change, a group that decides who they like on the technical ability of a company won't like them. They are lying about their technical quality; at least in our eyes.
Re:The box was not production hardware... (Score:5, Interesting)
it's called 'peer review' and in the science world it's not only expected but mandatory.
my question is this: has diebold's product undergone any sort of peer review? if it's important enough for someone studying the genetic inheretance of grey hair, it's important enough for someone entrusted with running an election for the most powerful person in the world, dontcha think?
Re: (Score:3, Insightful)
Unfortunately, yes. Many crooks and liars have deemed the system to be "just fine".
Re: (Score:3, Interesting)
Re:The box was not production hardware... (Score:4, Insightful)
It does make a difference. With a punch card, or a paper ballot, or even a mechanical voting both anyone can trace when fraud has occured. And in those cases we implement some security, track where the fraud came from (if we can) and redo the election.
Except that they won't. There have been numerous cases recently in which problems were confirmed beyond any doubt. In every case, even when the number of dubious votes would have been enough to potentially change the results of the election, the courts let the election results stand, and no reelections were called.
We don't need to be able to prove that fraud occurred. We need to be able to eradicate it. The only way that is even remotely possible is if the voting process is transparent. This means:
With all due respect... (Score:2, Insightful)
I say this realizing that there will always be people with suspicions, so we have to aim to make that the lowest number possible, which IMO, rules out computerized voting at this time.
Re:With all due respect... (Score:4, Interesting)
What is the obsession with machine voting anyway? The only advantage seems to be counting speed. Since by the time all the ballots are in, counting speed makes ZERO difference to the outcome of a fair election, it's an irrelevancy - what's a few more hours against an elected term that will go on for years?
The absolute requirement for me is that your voting system be comprehensible and auditable by the common man. Because it concerns us all. The system with the widest comprehensibility is pencil and paper.
While pencil and paper isn't flawless, the key difference is that it's a system that a lot of people understand. Irregularities are far easier to recognise by the common man. With a machine system, only someone who understands the machine can spot the system being subverted.
Print ballots. With boxes on. You make a mark in the box, you voted for that person. No chads, no hanging. And anyone who can count can see that the right thing is done.
Sure, introduce machine systems to help make it harder to subvert the voter system. But the basic counting mechanism should be a wet thumb and a box of rubber bands.
Re: (Score:3, Insightful)
Re: (Score:2)
And fraud regularly happens with pen and paper. The only solution I can think of is verified voting. The person must be able to go back after the vote and check how they voted. The votes must match the number of people that voted. I've never seen anyone propose any type of anonymous system that was tamper proof. If votes were tied to the people casting them, then fraud would be eliminated. Oh, and you can have a non-anonymous system
Re: (Score:2)
But that doesn't prevent fraud. All anyone has to do is replace the same number of votes with the fraudulent ones. The only real verification is if the voter can see how his vote was actually counted. Telling the waiter what you want for dinner doesn't mean that's what you get. It's a request. The waiter writes it down, passes it to someone else that intreprets it, a
Re:The box was not production hardware... (Score:5, Interesting)
One customer wants a secure, hardened, auditable, time proven machine with a user verifiable paper trail.
The other doesn't need any of those features.
Therefore two entirely disparate product lines.
One is designed to protect $.
The other is designed to protect democracy.
Re: (Score:2)
Re: (Score:2, Insightful)
From the referenced paper:
Do I have this right? (Score:3, Insightful)
So, you're suggesting that the Princeton Center for whatever might have gotten ahold of a machine that someone had already hacked? Yeah, maybe so. Somehow, that doesn't make me feel better about these things.
Oh ... you're suggesting that the flaws identified by the Princeton team may alread
If this can't finally nail the coffin lid shut (Score:3, Insightful)
Re: (Score:2, Insightful)
Aint gonna happen. The corporate media won't let it. The same people who own your legislators also own the media; there's an article about that in today's Illinois Times [illinoistimes.com] (a small, leftist, independant weekly).
Re: (Score:2, Interesting)
I don't know why so many people act like it's unthinkable to discard a flawed election and start over with a new one. In the case of a presidential election, the term expires, the Speaker of the House takes over, and stays in charge until a president and vice president is elect
Re: (Score:2, Insightful)
I know what can (Score:2)
I know what can:
An election where such a virus is released into the machines and transfers ALL the votes for the candidates in ALL the affected machines to the Nth "third party" candidate in each partisan race, a pseudo-random one in any non-partisan race, and discards all votes on any propositions.
Let's see 'em certify THAT as the correct election result! B-)
Re: (Score:3, Funny)
Clarification please: Who are we? And who is the opposition
Just wondering...
Soo.. (Score:2, Insightful)
Re: (Score:3, Insightful)
Re:Soo.. (Score:5, Informative)
Thank you for stealing an earlier post of mine [slashdot.org] absolutely verbatim.
-the real jdm
Scary (Score:5, Informative)
That's incredibly weird, considering this IS Illinois, where they say "vote early, vote often," where dead people still have a right to vote, and the last two governors who lost elections went to prison (or will, in the case of Ryan).
Uh... (Score:4, Informative)
Ryan didn't lose an election - he won, all the way up until he (plagued with scandal) didn't run again.
Re:Scary (Score:4, Interesting)
When you consider the ease of simply printing a receipt like slip of paper one has to wonder why they refuse to make them all do it. There is more accountability when you go to the supermarket than when you go vote.
B.
The first person to do this is going to be stupid (Score:4, Interesting)
Re:The first person to do this is going to be stup (Score:5, Interesting)
Re: (Score:2)
Exit polls are generally inaccurate. [washingtonpost.com]
Re: (Score:2, Interesting)
I intentionally lie to exit pollers. I do so because I want to make the mainstream media look like idiots when they make the wrong projections based on incorrect data. And I know that I'm one of many, among a relatively small sample size.
Like all telephone polls and Internet polls, exit polls are self-selecting. The only people that participate are those that WANT to do so. That effectively invalidates the results of the poll: if it is anywhere close to the
Re: (Score:3, Insightful)
I, for one, have a better explanation. People are dumb. That's the way Bush got elected last time. I will be honest enough to say I voted for Bush in 2000. But I am, at least, smart enough to admit my mistakes. People got their little payouts in the mail. Bush shored up his base. The folks ignored the two trillion of debt he has piled on us, and the
Re: (Score:2)
I think you are right.
What we need to do is outsource the programming to China.
If you can't have China write the software and trust it... then something is wrong with your process. Because, who writes it should not matter one bit.
Maybe this would get the point across that the software needs a line by line peer review...
More Secure Lock (Score:3, Interesting)
There are certain locks that are extremely difficult to pick... that's the solution.
Re: (Score:2)
Now that we know it is virus-susceptable... (Score:4, Interesting)
Now that we know the machine itself is virus-susceptable, the next steps are:
1) See if the smartcard reader code has a vulnerability. (Any bets on a buffer overflow bug?)
2) If so, design a virus that can do the initial infection via the smartcard slot.
Succeed at 2) and you can carry a bogus smartcard in, insert it while you "vote", and infect a voting machine. Since the machines are apparently capable of passing the infection during the post-election vote collection process, you can take over the precinct (either all the remaining machines or the one doing the totals) by infecting one voting machine.
Design the virus to self-destruct after doing its dirty work and you don't even leave tracks.
Unfortunately, "so what?" may be the response (Score:4, Interesting)
I hope that I underestimate the American people on this (including me), because the next tack that will be taken by Diebold will be, "Well, who in their right mind would want to tamper with an election? Calm down, citizens, this is just scaremongering by the right/left/pedestrians..." Once this is followed up with a suggestion that such might be "fomenting a panic designed to cause a breach of the peace," vague threats of arrest for those involved, and nothing changing.
Well, if nothing else, this voter's going to try his hand at absentee balloting this time around. Just in case...
Who would want to tamper? Terrorists (Score:4, Insightful)
Re:Who would want to tamper? Terrorists (Score:5, Funny)
"While exit polls conducted by our station and others showed Sen. Hillary Clinton and Sen. John McCain neck-in-neck at nearly 50% in this highly contested state of Ohio, initial results from available precincts shows the winner of the state, and thus the country, as Osama bin Laden, with 107% of the vote. A tape allegedly featuring Mr. bin Laden was broadcast by the al Jazeera network just minutes ago, in which the terrorist mastermind said he was pleased by the clear mandate the capitalist pig masses had given him, and that he hoped his transition from a cave somewhere in Pakistan to the Oval Office would go smoothly. Back to you, Tom."
I don't know, think that would wake people up?
Re: (Score:3, Informative)
Re: (Score:2)
First of all, for this attack to succeed you would actually have to take the machine apart, then switch memory cards,
Re: (Score:2)
Re: (Score:2)
They've already said the equivalent:
"For there to be a problem here, you're basically assuming a premise where you have some evil and nefarious election officials who would sneak in and introduce a piece of software," [Diebold spokesman David Bear] said. "I don't believe these evil elections people exi [nytimes.com]
as we all know (Score:4, Funny)
It's not who votes that counts, it's who counts the votes.
What are /.ers complaining? (Score:2)
C'mon, guys, don't you see a little bit of opportunity here?
Hmmm... I thought I had it...
Re: (Score:2)
Another Hack (Score:2)
From everything I have read and everyone I've spoken to about these machines it wouldn't be a hack at all.
We've heard it before but... (Score:5, Interesting)
Re: (Score:3, Insightful)
Re: (Score:2)
Apparently upper management has seen no corporate advantage to ordering the ATM team to do a redesign. (If nothing else, it would compromise their claims that the machines are just fine as is.)
They have had their problems with ATMs too (Score:4, Interesting)
Diebold ATM turned into jukebox [thetartan.org]
Diebold ATM infected with Welchia [windowsfordevices.com]
Re:We've heard it before but... (Score:4, Funny)
Re:We've heard it before but... (Score:5, Funny)
The video is excellent (Score:5, Insightful)
It isn't enough for computer software professionals to discover problems like this; we need to be able to communicate our results effectively to the non-technical public. Too often we find something disturbing and decend into technical jargon and lose our audience. The Princeton team has done an excellent job avoiding that pitfall and communicating this threat.
Now, if only we could find a reasonably motivated and alert politician to actually act on this.
FINALLY! (Score:3, Funny)
Now all we have to do is prove that it actually happened.
Re: (Score:2)
When I am president, I promise, you will have your proof.
--MarkusQ (future winner of the 2008 presidential election, courtesy of Diebold)
Oooh! Oooh! Pick me! (Score:2)
Pretty please!
Sure thing. (Score:2)
Sure thing. All I'll you need to do is help me find a few dozen people to vote for us.
And make sure they understand we aren't talking any of that weak kneed "one man one vote" stuff. These are some super charged Diebold votes we want to have them cast for us.
But don't go overboard. Two or three per state should do it.
--MarkusQ
What about the seals? (Score:2, Insightful)
Do you need someone to actually SAY it ? (Score:2, Troll)
Does it take someone to say for you to realize it ?
My experience with Diebold (Score:4, Funny)
Welcome to democratic government, brought to you by Diebold(R)!
Please choose a candidate:
(1) The incumbent guy who's against the terrorists.
(2) The weasly other guy who likes terrorists and wants your child to
be gay.
[press 2]
You have chosen option (2), for gay marriage. Are you sure?
[press no]
Please choose a candidate.
[press 2]
Let's not be too hasty. We don't want the terrorists to feel good.
Do you want the terrorists to feel good?
[press no]
You have chosen option (1), for the incumbent. Are you sure?
[press cancel]
This may forfeit your vote! Are you sure you wish to cancel not
voting for option (1)?
[press yes]
Thank you for your participation in the democratic process! Printing
receipt
Sorry! Out of paper.
Army of One (Score:5, Informative)
Now he's the guy proving Diebold voting systems are insecure.
Isn't anyone else in our giant, brilliant "computer science" industry doing anything? Or are they all working for the bad guys?
Re: (Score:3, Insightful)
~X~
Re: (Score:2)
And they usually have enough money to live on, too.
Diebold just needs an incentive .... (Score:4, Insightful)
The white hat community needs to start undermining vulnerable e-voting technologies whenever and wherever possible. Just put a few Democrats into office in the bible belt.
The CEO of Diebold is on record as a dyed in the wool Republican: "Our job is to deliver the election to George W Bush". Problematic for a vendor with so much trust. But once their machines start swinging votes for the other side, they'll soon start adding security.
There is one way to fix this... (Score:2)
My mother always said I could be president one day (Score:2)
hack? (Score:4, Funny)
Shouldn't these just be considered mods?
Name an item you CAN'T hack (Score:2)
Arnold! Arnold! (Score:2)
Re:Could be modded as flamebait... (Score:5, Informative)
Re: (Score:2)
The complaints about paper ballots can be pretty reliably traced back to Florida in 2000, when we were told that the butterfly ballots "were confusing", and then we had the whole fun of chads... I personally still find it hard to believe that the ballots were confusing... I've seen the images of them... they were basically %name% with an arrow to the hole to punch...
Personally... my requirements for a voting system would be fairly simple: Anonymous, Personally verifiable, Auditable, Tamper resistant enou
Re: (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
Haven't you heard? [dailykos.com]