Diebold Voting Machines Vulnerable to Virus Attack 122
mcgrew writes "PC world is reporting that Diebold's super-popular voting machines are coming under even more scrutiny. A security review has revealed that they are simply 'not secure enough to guarantee a trustworthy election.' This is according to a report from the University of California Berkley, who did a two-month top-to-bottom review of all California e-voting systems. That's a subject we've discussed before, but Diebold's setup is truly unsettling. An attacker with access to a single machine could disrupt or change the outcome of an entire election using viruses. From the article: 'The report warned that a paper trail of votes cast is not sufficient to guarantee the integrity of an election using the machines. "Malicious code might be able to subtly influence close elections, and it could disrupt elections by causing widespread equipment failure on election day," it said. The source-code review went on to warn that commercial antivirus scanners do not offer adequate protection for the voting machines. "They are not designed to detect virally propagating malicious code that targets voting equipment and voting software," it said.' Oddly, my state of Illinois, long known for election fraud, has paper trails (at least in my county) and according to Black Box Voting doesn't use Diebold anywhere."
waht we've all been wondering... (Score:2, Insightful)
Re:waht we've all been wondering... (Score:4, Insightful)
Re: (Score:2)
How would you respond to this article then?
The star of the international e-voting scene is arguably Australia, which is e-voting on machines that are based on Linux, using specs set by independent election officials that were posted on the Internet for one and all to vet -- an open-source approach for which U.S. activists clamor.
"From what I have read, the U.S. systems are primitive compared [with those of] Australia," said Tom Worthington, a visiting fellow at the department of computer science at Australian National University, in Canberra, Australia, and an expert on e-voting technology, in an e-mail exchange with eWEEK.
http://www.eweek.com/article2/0,1895,2164264,00.as p [eweek.com]
Re: (Score:3, Informative)
I'd respond by pointing out that we don't yet have electronic voting in Australia. We use pencil and paper, and the results of an election are normally available several hours after the close of voting.
At this year's federal election there will be a trial of e-voting for vision-impaired voters and overseas defence force personnel - for and overview see the Australian Electoral Commission [aec.gov.au] site.
Re: (Score:3, Interesting)
About 10 years ago in the City of Maroondah I received in the mail about five ballot papers addressed to names like "Jon Q Citizen, Jane C Jones", etc at my address. It looked like test data for training or testing purposes. Perhaps they forgot to delete the sample data before populating the database with a real electoral roll.
Needless to say, I didn't open the envelopes and use them to vote.
Re: (Score:1)
Re: (Score:3, Insightful)
Adding numbers within a layer is a parallelizeable problem. It can certainly be handled in a pyramid such that the height of the pyramid increases no faster than the log2 N increases with size of the count. (I.e., the number of layers needed would be proportional to log2 N, where N =the number of votes.)
I'm dissatisfied with this explanation, but I can't think of how better to say it without drawing pictures. Note tha
Re:waht we've all been wondering... (Score:5, Informative)
Re:waht we've all been wondering... (Score:5, Funny)
god help the future of democracy.
Correction (Score:2, Insightful)
I had to correct this because "Democracy is defined as 51 percent of the populous telling the other 49 percent what to do." - Thomas Jefferson
That is why we have a REPUBLIC.
It should read "god help the future of our republic."
It was once stated that "Democracy is two wolves and a lamb voting on what is for dinner. Liberty is a well armed lamb contesting the vote." - Benjamin Franklin
List of Diebold Vulnerabilities (Score:3, Funny)
Sneezing in their vicinity,
Looking at them cross eyed,
Armpit farts,
Dancing counterclockwise around them,
Voting,
Sarcastic comments,
Pixie dust,
My mother-in-law's meatloaf, and
Bad Bob Dylan cover songs.
Seriously, several years ago three or four different versions of the GEMS software (that's the name of the Diebold voting software) were available for download in a few places on the internet. Accessin
Re: (Score:2)
And people wonder how in the last election the exit polls somehow didn't agree with the final vote counts.
It's not a democracy when the people don't actually get a say in the outcome of an election.
Re: (Score:2, Informative)
Holey shiiiittt! (Score:2)
Why bother even going.
So they tally way more votes that voters... Hwo gives a fuck?
It would take a revolution to make a noise in the media and you know Fox news would never run the story unless we were offering to give them video of Britney's bald head going down on the choef electoral officer.
Re: (Score:1)
Re: (Score:2)
Which means that it's just a prototype - not the real deal. VB & Access is only good for prototyping...
Troll mode off:And anyway - if Diebold is running insecure voting machines - what about their ATM:s? Why not launch an awareness program that checks them too and let people decide if they are willing to take the risk of using their machines?
Re: (Score:3, Interesting)
Programming Visual Basic over Access is first year Windows programming. I took this class, and I just wanted a networking education - worked out however since my current employer is married to SQL Server with Access front-ends for its OLTP (and their costly proprietary vendor is married to this idea too; $400 to edit some Visual Basic code, 10 lines max). Not very open, but we are managing to hack it daily. I'
Re: (Score:2)
Trumps? I find this comment basically unintelligible. Are you talking about pre-requisites for being hired? If so, then it makes sense. Are you talking about designing a secure system? If so, then you're crazy. Are you talking about something else? (I really can't tell.) Then you need to explicate.
Re: (Score:2)
If one makes the foolish initial decision to use an inherently untrustable device like a computer in the first place, then it comes down to one's choice of an operating system. Diebold chose Windows CE. [zazzle.com]
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:3, Insightful)
MisUnderestimate (Score:5, Insightful)
This is not the typical play stupid situation that sells so well in the USA. This is clear-cut intentional negligence and I shouldn't need to go into the many possible motives for anybody to pull such scams. This isn't even that other large voting machine company who elected their own OWNER!
The difficulty is NOT making a computer COUNT or securing the totals, they distract you with the irrelevant technical details. Its in WHO YOU TRUST to implement, maintain, and secure the system that is the unsolvable difficulty (I for one, will welcome our evolved computer overlords when they take over...)
The ultimate purpose for Rube Goldberg designs is POWER (job security and customer lock in being most common motives.) When you place the power in the hands of a few you always run into trouble. IRONICALLY, the purpose for democratic voting is totally being forgotten in this pseudo debate about how the publicly inaccessible voting system operates!
Canada figured it out; however, I'd like to see a weighted voting system well implemented. Also, I would like to see a new kind of elector system so my friends can just give me their votes; its hard enough to get them to the polls on a WORK DAY... (yes, the pro-"democracy" USA never respected democracy enough to make election day on par with memorial day. Irony has become redundant.) While I'm at it, I'd like senators to go back to state appointment because the intent was to prevent an all powerful federal government.
Re: (Score:2, Interesting)
Re: (Score:3, Insightful)
Pretty f*cking hard, I expect. The problem is roughly equivalent to making a secure DRM system, which everyone on Slashdot claims is near-impossible. In both cases, you need to give someone physical access to the machine and its contents, and yet somehow prevent them from secretly modifying the machine's behavior to suit their liking.
Re: (Score:1)
It is not about making it secure (Score:1, Troll)
Re:waht we've all been wondering... (Score:4, Funny)
Bonus points if you can write it in INTERCAL [catb.org].
Re: (Score:1)
(Sorry, too many Centrum commercials)
Re: (Score:2)
How hard is it to make a secure voting machine? Exactly as hard as it is to make a secure OS and application, along with support files, data and libraries, that will be installed on a machine where it will be located in a public location where anyone ca
Re:what we've all been wondering... (Score:4, Insightful)
I cannot see WHY they feel they have to network them to accumulate the results. Best way to propagate a virus: wire them all together (or, worse, through the internet - however "secure" the connection).
I still can't see anything wrong with using the machines to accumulate the votes and then polling each machine, by hand, to copy the tallies - having enough witnesses from all parties will keep the results accurate and they can still be communicated to the appropriate location as they've always been.
I thought the main purpose of new machines over the older mechanical ones was the reduction of complexity of the machines (hence increasing their reliability), accessibility by the handicapped, and ease of recounting (just run the forms through another scanner and see if they total identically) - at least that's the line parroted by our idiot secretary of state (bysiewicz, Connecticut).
It's obvious that machines wired to each other can be more completely tampered-with than individual machines, SO WHY DO IT?
Re: (Score:3, Insightful)
Not very hard. But such a system would not be based on Windows or any normal version of Linux, or any other such operating system. The underlying code should be programmed as firmware which means it is stored in EEPROM or flash memory that cannot be changed by the machine itself. It should be electrically/hardware impossible for the code being run to be changed by the platform running it.
A microcontroller (take your pick... 8052, ARM, even lowl
Re: (Score:1)
how hard is it to secure your laptop from yourself (Score:1)
The real risk is insiders: the programmers, the maintenance people, the random IT person, the technicians.
Bev Harris - founder, Black Box Voting
Re: (Score:2)
Re: (Score:1, Funny)
Is it just me (Score:2)
Re: (Score:3, Interesting)
I would assume that these viral vulnerabilities are the contents of...
Additional reports [which] will be made available as the Secretary of State determines that they do not inadvertently disclose security-sensitive information.
--
Toro
Re: (Score:2)
Yup, especially when the eds (hello Zonk...) don't read (see
Of course you're right that, as news comes in, new information germane to the discussion should be added - but why not put in the 'original'
Re: (Score:2)
Re:Is it just me (Score:4, Insightful)
However, I think self-redacting/auto-revising article text is a bad idea. Have you ever lurked on (for example) the Associated Press feed and watch an article headline slowly morph from "Bush puts off decision" to "Bush faces tough decision" and finally end up as "Bush makes decision" while the text, in which he clearly puts off the decision, stays static? I have. Or worse yet, both the headline and the body texts change according to an agenda.
There is pressure being brought on news agencies to make those changes, which are becoming commonplace. This is the danger of Internet publication in the information age. It becomes unreliable. It's too easy to change it.
So I prefer a news feed to retain previous revisions so I can get a good idea of the reliability of the news source. If there's an update, I expect it to be published as a separate note, not superseding the article text in place. I expect the act of publication to have permanent consequences, not be an act that you can wash away with something more responsible at a later date.
My expectation, of course, is not realistic. It is borne of growing up with a print media. The only logical expectation is that Internet publication will be abused, and that "print media" is now less reliable, because it is no longer in print. I only ask that you understand the consequences of your demand that Slashdot "clean up" their articles. Your desire for "clean" can rapidly turn into an engine for censorship and yellow journalism.
I can assure you of one thing: that CowboyNeal's article will fall off the bottom of the page soon enough, and you can then feel at ease.
--
Toro
Re: (Score:2)
Re: (Score:2)
(x) paranoid
(x) delusional
(x) impossible to confirm
( ) impossible to refute
Specifically, your theory fails to account for
( ) Stupidity of the general population
(x) Lack of a centrally controlling authority for conspiracies
(x) Failure to mention the Illuminati
(x) Facts can be explained without need for a real conspiracy
( ) Stupidity of the politicians
(x) Asshats
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come
Diebold dupe? (Score:2)
http://it.slashdot.org/article.pl?sid=07/08/04/14
Even worse (Score:5, Informative)
it gets worse (Score:2)
Awesome! (Score:2)
Re: (Score:1)
I wonder if UC Berkley would recommend *BSD? (Score:2, Insightful)
(Any number of non-windows OSes would fit, but the *BSD family just fits so well here.)
Note: it spells Berkeley (Score:1)
Re: (Score:1)
Edison was still wrong (Score:3, Insightful)
If you ask me, it's just pointless. Why can't the state government(s) just get rid of the machines and reinstate the good ol' paper votes like they used to? Do they REALLY want to keep on using Diebold machines and/or voting machines in general?
Re: (Score:3, Funny)
Re: (Score:2)
idea for an absolutely secure voting machine. (Score:5, Interesting)
Voting consists of dropping the Uranium into one of several lead boxes which contain giant magnets to keep someone from trying to alter votes by moving tokens from one box to another. At the end of the day, you read the results digitally with a geiger counter. Every party can be there with representatives, disagreements can be sorted out on the spot with a manual count in front of a multiparty committee. 100% foolproof.
Basically, I got the idea from Bruce Schnier, who observed that it's not such a bad idea for people to keep their passwords written down on a piece of paper in their wallet. After all, people already know how to keep their wallets secure.
The US Military already knows how to keep weapons-grade plutonium secure. Basically, my idea is to just piggy-back on that, to keep voting secure.
A lot of people like to stick with old, low-tech stuff, don't have the will to try anything new. "What about the radiation poisoning" they would no doubt whine. Well I say progress consists in throwing out what's old and "safe" and being bold. [diebold.com]
Here's mine (Score:3, Interesting)
Machine prints ballot and shows it to the voter. Voter approves or discards it.
Ballot is fed into an optical scanner, which scans it. Scanner is implemented as absolutely simply as possible, by for example measuring levels of ref
Re: (Score:2)
That's not bad, but overly complex (Score:2)
Multiple choice fill in the dots just like I used in highschool. (Are they called "Scantron" sheets?) The difference is, instead of filling in the dots with pencil, you use bingo markers. Indelible. And you sign your ballot after you fill it in. Then the polling official signs the back of the sheet as they accept it (folded in half appox. along a pre-marked line). And each ballot is stamped twice with a number identifying the polling place and the sequence of issue. (One of them is on the
Re: (Score:2)
Filling by a human means that there's a potential for an unclear choice. Given a tight race, somebody WILL start to argue what exactly constitutes a ballot with a clear vote, and how much deviation from a precise choice is acceptable.
Requiring your signature is bad. Many people sign with their own name. Not good for anonymity. Given the sequence number and handwriting the voter can be identified.
Official's signature is unneeded. What does it add, other than making participating in
Re: (Score:2)
As Stalin might say (Score:2)
Also how will you stop someone from slipping in a beryllium ballot? It won't trip the Geiger counters on the way in and in the presence of alpha radiation it fissions releasing a neutron which could disenfranchise other voters.
And the mushroom cloud goes (Score:2)
Where are you planning to have a CRITICAL MASS of voters?
I think I would give your voting booth a wide berth.
I can just imagine the reporters covering the explosion. (Well some of them will be doing it from afar and claiming a victory for Al Queda.)
The military to safe democracy?? (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Super-popular?! (Score:2)
Why the hell use a "real" computer? (Score:3, Interesting)
Re: (Score:1)
Re: (Score:2)
Insecure (Score:2, Interesting)
And if so, should this not call into question the legitimacy of the reigning monar^H^H^H^H democratically elected Shrub on Pennsylvania Ave?
Re: (Score:2)
I believe that your unstated question should be answered "The vote in 2004 was fraudulent on a massive scale.", but belief isn't proof.
FWIW, there is proof of voting fraud on a minor scale by BOTH parties. (Check into the recent evidence scandal in Ohio, tho
No matter what (Score:1)
Re: (Score:2)
Re: (Score:1)
USA geeks please take action (Score:3, Insightful)
Please, if you are a USA geek and care about the integrity of your democracy, force the public to take notice. You think they are going to care if people say that something is theoretically possible? No, they think it's a conspiracy theorist, or, at best, "The government would never let that happen, would they? I'm sure somebody is taking care of it." The only way to fix this is to make the public realise that this directly affects them. Otherwise they are too apathetic and myopic to do anything about it.
So rig the next election. And I don't mean for Mickey Mouse, that can easily be caught and covered up on the day. It has to be a landslide for a believable candidate. Write an encrypted letter to your local newspapers beforehand that explains what you are going to do and how you are going to do it. Leave a marker on the system to prove that you were there, and mention it in the letter. After the election, send them the key that decrypts the letter, proving that the recent landslide was totally rigged. For bonus points, own up to it instead of doing it anonymously, but only do this if you have an impeccable public persona. Rosa Parks wouldn't have had quite the impact she did if she dealt weed on the side.
If you don't do this, somebody less honest than you will. They may already have done it. The only people who can solve this are honest American geeks.
Re: (Score:2)
This area is massively Democrat, and we have Diebold voting machines. (Well, we did the last election. P
DUPLICATE (Score:2, Informative)
Please post a story about the Secretary of State's decision [ca.gov] restricting the use of these machines.
Sandbox (Score:1)
Re: (Score:1)
WHY? (Score:1)
Re: (Score:2)
Three systems were reviewed. (Score:3, Informative)
Shhhh, God damn it. There does my bid to get (Score:2)
Do you realize how many favors he would have owed me?
I would have been able to sleep with ALL of his sisters AND his mother AT THE SAME TIME.
Aw squat...
Re: (Score:2)
Illinois (Score:1)
There's a reason the state is KNOWN for election fraud. With paper trails the fraud gets detected.
I fear that in Diebold heavy states the fraud won't always be so apparent. It'll just be a lot of rumor and suspicion and often dismissed as paranoia.
Dubya's little brother made sure FL has diebold. (Score:2, Informative)
in 2000, Volusia County, FL had one precinct count up (er down) -16,000 votes for Al Gore. That's Negative Sixteen Thousand.
It was allowed to pass in the final tally.
information from the blackbox voting documentary.
New slogan (Score:2)
On the other hand, with a screwup like this, maybe Ron Paul will get the majority of votes on election day. Or maybe a write-in candidate like Mickey Mouse will get all the votes.
Re: (Score:1)
How much money is involved (Score:1)
Just how much money is involved in evaluating, buying, deploying and now investigating these machines ?
The main reason cited for moving to electronic voting is that manual counting methods are too slow or inacurate.
My own hunch would be that if we took even half the ammount of money that has been wasted on these machines and spent it on researching ways to improve the speed and accuracy of the existing manual counting methods, we would have a better system that would be both secure and clear for ever
So? (Score:2)
Yet I can't help but wonder. If I gave my truck to a bunch of high school students, locked them in the gargage with it for a week, could they possibly break into it?
Get real, folks. My only question is to when DES gets out of that market. It is only like 2% of their business...
Again, the focus is misplaced... (Score:1)
Clean the rolls, and I bet 99% of all "election fraud"
secure voting possible, but not wanted (Score:1)
OK Diebold sucks but so do all the rest (Score:1)
The only system in which the public should have any confidence at all would
have to open source. Until such time as that occurs paper ballots could
carry the load.
And there'd be less whining from Dhimmicreeps since they are old hands at
perverting that system.
Re: (Score:3, Insightful)
The catch is, the fraud that you would be committing (registering as a non-citizen) would only affect the election by at most 1 vote, and that single vote is quite unlikely to change the election.
The danger in using insecure voting machines is that a single fraudster can swing an election by many votes, making it much more likely that their intervention affected the final outcome.
Re: (Score:2)
And yet this is just want the GP-post wants — a centralized system, where a single breach could affect not a couple of thousands, but millions of votes in one deal.
Maybe, that's why he is posting as an AC...
Re: (Score:2)
Re: (Score:2)
No, I thought of it when I stole an election last year. I only do a Diebold job if the client promises to quash any investigation into election fraud in the district once he gets elected. Anyone who can't figure out that much won't get far in the vote stealing business. Stealing elections is tricky- you can't just rely
Re: (Score:2)