Critical Security Hole Found in Diebold Machines

ckswift writes "From security expert Bruce Schneier's blog, a major security hole has been found in Diebold voting machines." From the article: "The hole is considered more worrisome than most security problems discovered on modern voting machines, such as weak encryption, easily pickable locks and use of the same, weak password nationwide. Armed with a little basic knowledge of Diebold voting systems and a standard component available at any computer store, someone with a minute or two of access to a Diebold touch screen could load virtually any software into the machine and disable it, redistribute votes or alter its performance in myriad ways."

Black Box Voting & The Details

BBV released a a nice guide [blackboxvoting.org] to how all this works. There appears to be a software access button (bottom of page 11):

The TSx also has an unmarked button hidden in the casing. On the circuit board, this switch is labeled "battery test". The switch is physically similar to many reset buttons, necessitating application of substantial force to press the button, requiring it to be depressed by about 1/5 - 1/6 inch in order to activate the switch. This switch is also software accessible. It is completely accessible for all voters in the standard voting booth configuration. The logic behind the button is unknown, but for an attacker it presents yet another way to interact with the machine, and an exceptionally convenient button switch for an attack designed to be triggered by a voter.

Well, this seems very insecure to me. BBV criticizes the three layer architecture and states that it would be very easy to target it three different ways [bbvforums.org] (at each layer):

- The application can be imagined as written instructions on a paper. If it is possible to replace these instructions, as it indeed seems, then the attacker can do whatever he wishes as long as the instructions are used.

- The operating system is the man reading the instructions. If he can be brainwashed according to the wishes of the attacker, then even correct instructions on the paper solve nothing. The man can decide to selectively do something different than the instructions. New paper instructions come and go, and the attacker can decide which instructions to follow because the operating system itself is under his control.

- The boot loader is the supreme entity that creates the man, the world and everything in it. In addition to creating, the boot loader also defines what is allowed in the world and delegates part of that responsibility to the operating system. If the attacker can replace the boot loader, trying to change the paper instructions or the man reading them does not work. The supreme entity will always have the power to replace the man with his own favorite, or perhaps he just modifies the man's eyes and ears: Every time the man sees yellow, the supreme being makes him think he is seeing brown. The supreme entity can give the man two heads and a secret magic word to trigger switching the heads.

In the world of the Diebold touch-screen voting terminals, all of these attacks look possible.

The instructions (applications and files) can be changed. The man reading the files (Windows CE Operating System and the libraries) can be changed. Or the supreme entity (boot loader) can be changed, giving total control over the operating system and the files even if they are "clean software."

Specific conceptual information is contained in the report, with details and filenames in the high-security version which is being delivered under cryptographic and/or personal signature controls to the EAC, Diebold CEO Tom Swidarski and CERT.

1) Boot loader reflashing
2) Operating system reflashing
3) Selective file replacement

In addition, the casing of the TSx machines lack basic seals and security, and within the casing additional exploitations are found.

The article talks about a "standard tool you can buy at any computer store" and I believe this is referring to a PCMCIA card (what you use in laptops). I guess these are used to boot, upgrade & ready the machines for use. They do not go into detail but I wager that using a PCMCIA card with a USB port on it, you could load your own data from a thumb/pen drive. This would be small and easy to carry in. If you had access to it outside of the voting window, you could potentially use a PCMCIA card that functions as a NIC (probably with RJ45 cable port) to use cross over cable and a laptop for a 'live' attack.

Re:Black Box Voting & The Details

Making these devices large, restricted to the government, bulky & containing GPS units in the case of them being stolen.

Not to sound pessimistic, but the government is precisely the people we need to protect this machine from. I would think that the only way to address this would be to:

• Hold of on installing the final software load approved by both parties (and perhaps a third, 'impartial' entity) until the device is installed on-site (and bolted down)
  
• Install the final software load while overseers from both parties (and the third, 'impartial' entity) verify the installation and the veracity of the software load via checksum.
  
• Secure the access door permanently (rivets, welding, whatever), and have all overseers affix tamper-evident seals.
  
• Overseers remain present throughout voting, and periodically inspect tamper-evident seals.
  

If an irregularity occurs, the entire process must be repeated and the citizens must be allowed to vote again. This will eliminate the posibility of people just tampering for the purpose of getting the precinct thrown out of the count.

Re:Black Box Voting & The Details

Install the final software load while overseers from both parties (and the third, 'impartial' entity) verify the installation and the veracity of the software load via checksum. Right... 'cause noone's ever written a program that "erases" all the cheat sh

Re:Black Box Voting & The Details

I still puzzles me why americans don't use something simpler [elections.ca]...

hell, if India (with a BIGGER population) is capable of holding elections without soo much trouble, why can't the US do it?

Re:Black Box Voting & The Details

I assume that in India, the manual labor required to count all the paper ballots is cheaper than it would be in the U.S.

India switched to electronic voting machines 12 years back. The last 2 General Elections and about 10 state elections have been with electronic machines.

Only difference: Our voting machines are two part and have an embedded ROM which can store 8000 votes each.

And it costs 1/20 of the cost of a Diebold.

Oh india tried to sell condoleeza the voting machines, but was brusquely turned down.

Why not use bingo markers.

I've questioned why we don't do something like this, and have the reading done by OCR.

To reduce errors you'd have to have a few rules: first, no corrections. If you fuck up, new ballot for you. (I'd prefer if you fuck up, no vote for you, but I'm guessing

It's not pandering

The more local the election boards, the less likely that a wide-spread, concerted, and coordinated effort to perpetrate voter fraud can occur. When the original post states that "government" is whom we should be protecting this from, I'm sure the meaning

Re:Black Box Voting & The Details

More Options:

Use a more secure OS. Win CE is not an OS designed to protect the system from the behavior of its users. Linux / Unix / Solaris would be.

Use a thin client. Why allow the user to touch the hardware system they're interacting with? That's al

Re:Black Box Voting & The Details

Use a thin client.

Bad idea IMHO. This allows another attack vector: Just modify the connection from the thin client to the server.

It's not a bug, it's a feature!

Considering that Walden O'Dell, chief executive of Diebold Inc., was quoted in August of 2003 as saying that he was "committed to helping Ohio deliver its electoral votes to the president next year" [commondreams.org], this shouldn't be too surprising.

O'Dell Resigned for that Reason

I believe that O'Dell resigned [usatoday.com].

As the article you quoted states:

The Aug. 14 letter from Walden O'Dell, chief executive of Diebold Inc. - who has become active in the re-election effort of President Bush - prompted Democrats this week to question the propriety of allowing O'Dell's company to calculate votes in the 2004 presidential election.

O'Dell attended a strategy pow-wow with wealthy Bush benefactors - known as Rangers and Pioneers - at the president's Crawford, Texas, ranch earlier this month. The next week, he penned invitations to a $1,000-a-plate fund-raiser to benefit the Ohio Republican Party's federal campaign fund - partially benefiting Bush - at his mansion in the Columbus suburb of Upper Arlington.

And as USA Today reported:

"The board of directors and Wally mutually agreed that his decision to resign at this time for personal reasons was in the best interest of all parties," said John Lauer, Diebold's non-executive chairman of the board.

The announcement was made after the stock market closed. Diebold stock fell nearly 2%, or 73 cents, to $37 in after-hours trading. The stock has traded between $33.10 and $57.81 in the past year.

What I would like to know..!

Why does Diebold design these machines in such a way that they *CAN* be hacked? I think that involving an Operating System and software in the design of such a machine is a critical error. As a computer engineer, I realize that overcomplicating things can

Re:What I would like to know..!

Why does Diebold design these machines in such a way that they *CAN* be hacked?

Simple. Because that is their intention.

Acccuse me of left-wing moonbattery all you like, but the fact remains that Diebold has shown themselves to be capable of making reasonably secure ATM machines. There's no defense by incompetence available to them. These ridiculous security holes can only be intentional.

Re:What I would like to know..!

These ridiculous security holes can only be intentional.

My greatest fear regarding American elections is that Diebold machines will be used for a national vote to repeal the 22nd amendment, then for the following presidential acclimation--I mean, election.

Americans, please, start a grassroots movement to outlaw the use of any electronic, and therefore hackable, voting machines. Look at Canada's election process. Sure, we have only 10% of your population, but we have substantially less than 10% of your election hassles. In Canada, paper ballots are counted manually by Elections Canada volunteers, witnessed at each vote counting station by representatives from all official parties.

And for the love of Mike, start some new political parties! You may turf out the Republicans in 2008, but your Democrats are no prize either!

Re:What I would like to know..!

The problem in Canada is that, despite having a reasonable array of parties, you're still stuck with the archaic First Past the Post voting system which sees the two major parties (the Liberals and the Conservatives), and especially Bloc Quebecois, win far

How long would it take...

Suppose DieBOLD's ATM machines had a backdoor key sequence that would enable me to get the whole stack of 20's. How long would it take them to slam that door shut?

Re:What I would like to know..!

Acccuse me of left-wing moonbattery all you like, but the fact remains that Diebold has shown themselves to be capable of making reasonably secure ATM machines. There's no defense by incompetence available to them. These ridiculous security holes can only

Re:It's not a bug, it's a feature!

1. Do you have any stats to back this up? I am unconvinced by someone saying the word "FUD".
2. Diebold doesn't need to tamper with the election to make using their voting machines a horrible idea. As this article points out, there are extreme security flaws that allow others to tamper, which means Diebold has failed miserably at the goal of creating secure voting machines.
3. Assuming your stats are correct, is it a coincidence that the Diebold machines were installed in heavily Republican areas? Who got to decide on the voting machines/mechanisms used?
4. You say "yet another liberal urban legend" without giving any examples. Do you think there are more liberal urban legends than conservative ones? That would be a very difficult claim to defend. Which is probably why you just put it out there as if it was obvious in hopes that people would just agree. Sadly, this works all too well all too often in the political world. Your post is a couple of undefended partisan claims, and nothing more. If you're actually thinking about anything, please show us what you're thinking. Otherwise you might as well just say "REPUBLICANS RULE! DEMS SUCK! GO BUSH!" and keep contributing to the us and them sports fan mentality that American politics has become. Well that turned into a bit of a rant, didn't it?

Re:It's not a bug, it's a feature!

I would consider myself an authoritative source on the matter since I was involved in the 2004 recount in Ohio. I observed in an official capacity the recount in Clark and Shelby counties and in an unofficial capacity the recount in Greene county. I will

Re:It's not a bug, it's a feature!

Can you back up your claim about the geographic locations of Diebold machines? What about machines made by Triad systems: http://www.truthout.org/docs_04/121604Z.shtml [truthout.org], or http://www.truthout.org/docs_04/121604Z.shtml [truthout.org]

The 2004 election in Ohio is a black ma

Re:It's not a bug, it's a feature!

This is yet another liberal urban legend people like to spread around that Diebold somehow tampered with the election. Please stop spreading this FUD.

Unfortunately not FUD. There are documented cases where Diebold's machines subtracted one out of every 100 votes for a democratic candidate. Its only been caught on minor elections and other irregularites with Diebold's machines. From California:

http://www.verifiedvotingfoundation.org/downloads/ resources/documents/ElectronicsInRecentElections.p df [verifiedvo...dation.org]

"At least one voter was able to vote twice on her "smart card", and 10 votes were inexplicably lost.

John Pilch, a retired insurance agent who worked as a polling place inspector in San Carlos, said that when polls closed at 8 p.m. Tuesday, the number of people who signed the voter log differed from the number of ballots counted by computers.

"We lost 10 votes, and the Diebold technician who was there had no explanation," said Pilch, who registered complaints with elections officials, his county supervisor and several others. "She kept looking at the tapes."

At least 250 polls opened late because poll workers were unable to start up the machines, so hundreds, perhaps thousands, of people were turned away - many of them disenfranchised because they were unable to return to the polls at a later time that day"

As well as been posted here: http://politics.slashdot.org/article.pl?sid=04/11/ 16/1737228 [slashdot.org]

The Shock! The Surprise!

So the closed-source company with apparent links to the incumbent government and a record of blocking any attempts to investigate their code turn out to have security flaws?

Okay - closed-source versus open-source is a non-issue, but I expected something like this from Diebold sooner or later.

I'm seriously worried though. Here in Australia a lot of ATMs have been replaced recently with shiny new Diebold machines. I've no doubt they're harder to hack, but it's not an encouraging sign.

Re:The Shock! The Surprise!

Because Diebold is only interested in stealing elections, not your money. So rest easy.

Why doesn't diebold?

Why doesn't diebold just use the same security system [diebold.com] it uses on its ATMs? After all (quoting):

Sygate defends your ATM with multiple layers of security:

First, the system locks down all electronic points of entry - making them invisible to hackers, viruses, and worms.

Next, it monitors, analyzes, and authenticates any external source attempting to connect to the ATM- and blocks anything the software doesn't recognize.

Failing that, they should just use the blue force shields that feature prominently in their Digital Security Video [diebold.com]hahahaha - as long as your attacker is using little yellow balls to stage their attack.

Re:Why doesn't diebold?

"Failing that, they should just use the blue force shields that feature prominently in their Digital Security Video - as long as your attacker is using little yellow balls to stage their attack."

Yes, because I'm fairly certain that somebody somewhere has come up with an insidious plot to rig the elections with a Nerf gun.

Re:Why doesn't diebold?

Yes, because I'm fairly certain that somebody somewhere has come up with an insidious plot to rig the elections with a Nerf gun.

God damnit ... back to the drawing board. It was such a good plan, too.

Funny isn't it?

Diebold can make a box that handles your money with no issues. They make a voting machine that is atrocious and faulty. Goes to show where priorities lie across the board.

Why ...

If my money gets lost, I can sue the bank, Diebold, or whomever I think is responsible for this.

If my vote gets lost, I can get sued under various laws that come into existence because of this (DMCA/PATRIOT-ACT/etc).

Re:Funny isn't it?

They make a voting machine that is atrocious and faulty.

To be fair, even if it were someone else, voting machines that submit the vote in electronic form simply have fundamental problems with accountability. Yes, Diebold has had some atrocious engineering problems, but even if you took the best group of engineers on the planet and asked them to replace the pencil or hole punch machine with a fully electronic form, they'd still have a vastly more exploitable system than the traditional system.

I view Diebold as representative of a lot of companies that get government contracts -- obtaining unneeded pork, doing a fairly half-assed job. However, while some things (like the criminal records of people presiding over the project) were a little disturbing, I'm more willing to say that Diebold probably has nothing more malicious in mind than getting as much money as possible and not caring much as to how useful (or dangerous) their work is.

The real problem is that no voting administrator wants to be in the shoes of the Florida people, where questionable ballots exceeded the margin by which Bush won. An electronic form throws away all data other than a simple vote -- it may not be more accurate, but it covers the asses of voting administrators.

The fact that the whole system is much less accountable and more open to abuse and attacks than a physical system is more an issue that not of the involved people (voting officials and Diebold) just don't care about than one that I expect that they intend to personally exploit.

Re:Funny isn't it?

Diebold can make a box that handles your money with no issues.

Well, not exactly [slashdot.org]. Diebold ATMs have been featured rather prominently on Slashdot before...

"any" software, eh?

Installing "Goatse.cx Screensaver", please wait...

Re:"any" software, eh?

Or...

"Who is this 'Cockmongler', and why should I vote for him?"

Re:"any" software, eh?

But I thought finally we got rid of hanging chads...

The Diebold Chronicles

A Finnish computer expert working with Black Box Voting, a nonprofit organization critical of electronic voting, found the security hole in March after Emery County, Utah, was forced by state officials to accept Diebold touch screens, and a local elections official let the expert examine the machines.

Black Box Voting was to issue two reports today on the security hole, one of limited distribution that explains the vulnerability fully and one for public release that withholds key technical details.

The computer expert, Harri Hursti, quietly sent word of the vulnerability in March to several computer scientists who advise various states on voting systems. At least two of those scientists verified some or all of Hursti's findings. Several notified their states and requested meetings with Diebold to understand the problem.

Oh, those plucky Finns and the trouble they cause...

Does anybody get the idea that Diebold simply threw these machines together, cobbled the code together from stuff lying around the shop, slapped some paint on them, and expected states to use them no questions asked? You would think somewhere along the line, someone would have stood up at a development meeting and said, "we'd better make sure these things are secure."

Diebold will of course now hem, haw, blame others, attack the media and anti-electronic voting groups, and reluctantly fix the problem. Just in time for the next one to crop up. Do they have any competition in this market? I don't hear a lot about other companies creating voting machines -- either there aren't any or they do a lot better job.

Re:The Diebold Chronicles

Honestly, with Dibold's documented contempt for the democratic process and the lack of something as simple as a paper trail, I'm half suspicious they delivered these machines, and then told the government how "a hacker might access these systems" and then

Diabold makes ATMs as well

I have noticed that last time I took some cash from BoA ATM machine.

This is scary.

Sweet!

I'm getting myself elected emporor!

How this bug was found

Anyone else think this is sweet?

A Finnish computer expert working with Black Box Voting, a nonprofit organization critical of electronic voting, found the security hole in March after Emery County, Utah, was forced by state officials to accept Diebold touch screens, and a local elections official let the expert examine the machines.

That's right. We've seen this before [slashdot.org].

Turns out Diebold has a strong interest in keeping their security systems proprietary.

rig machine vs. bribe electoral college?

Why go to the trouble to rig a machine when you can just bribe the electoral college? Wouldn't that be a much more effective way to swing an election, since they are the ones that actually do the voting?

Re:rig machine vs. bribe electoral college?

Why bribe everyone in the electoral college when you can just the two candidates instead?

Re:rig machine vs. bribe electoral college?

Good point, I suppose it hardly matters who gets elected if you can just support their post-election political bids to get your special interests catered to.

why do we need electronic voting?

What's so bad about the optical scanners and the ballots where you fill in a circle? I remember a study that showed they were the most secure, you have a paper trail, and any idiot can figure it out after 13 years of standardized testing. Electronic voting, on the other hand, smacks of boodoggle, fraud & overall shoddiness.

Re:why do we need electronic voting?

I think you've answered your own question.

Yes, but...

... surely only an EVIL TERR'IST would do such a thing, right?

Will the US wake up one day ?

How come no political party makes this a central campaign argument ?

No worries here

Jeez...what's everyone so paranoid about? How could a hacker possibly get access to a voting machine for a minute or two with enough privacy to load malicious software? He'd need to find one that for some reason or another had a curtain around it and hope no one thinks it's suspicious that he'd be in there alone with the machine.

It'll never work...

It's pointless talking about securing something that's inherently a terrible idea. You can't have voting performed by something that is, for most people, magical.

A good way to be certain these machines are sending the correct votes is to have a paper trai

Vote Stealing Song

---sung to the tune of Woody Guthrie's Hard Travelling
D
Diebold's stealing elections, I thought you knowed.

Diebold's stealing elections
A7
on machines with closed source code.
D
We dont need no double dealing,
G
electronic vote stealing.
A7
Diebold's stealing elections,
D
Lord.

Diebold's stealing our votes, the right that makes us free.
Diebold's stealing our votes, oh cant you see.
How can they say I'm free if their machines can vote for me?
Diebold's stealing our votes, Lord.

Diebold's stealing our votes, I thoought you knowed.
They've been shredding the paper trail at the end of the road.
It doesn't matter who you choose, when you're sure you're gonna lose.
Diebold's stealing our votes, Lord.

I'm gonna vote with pen and paper I thought you knowed.
I'm gonna see it counted at the end of the road.
I'm gonna vote with pen and paper so I know that there's a record.
And I'm gonna go vote my conscience Lord.

A quick couple of notes (so to speak)...
The chords are right as far as I know. The words are mine, though they dont fit quite right in all the places. Either apply Tom Leherer's rule that "it doesnt even matter if you fit a few extra syllables into a line" or use the folk process to make it fit so you can sing it.

Also, I've got one line with no verse to put around it...

"Voting wont be so scary if the countings not binary"

The main thrust of this song is to educate and protest on the issue of electronic voting. I am a New York State resident and for those who dont know we are being sued by the feds to upgrade our nice mechanical voting machines to electronic voting. If we do not they are going to withhold federal money for the upkeep of our voting system. This is blackmail, the same kind of blackmail that was used to put the 55 mph speed limit in place.

Our voting machines have worked for a century with the same design. We trust them to do the job and know where the flaws and weak spots in the security are. We, as a group, when polled, do not show a desire to change the system at this point and our state voting commission and legeslative review boards have rejected electronic voting as an unsecure and immature technology. The peculiarities of how a state does it's voting is a state's right to decide, which is why different states have different rules about every aspect of the electoral process. Some states are proportional, some are by district. Some states use machines and others use punchcards. Election laws are made at the local level.

The lawsuit by the federal government smacks of blackmail and manipulation. Why is the federal gov trying to control the electoral process at the local level? What do they hope to gain?

Re:Armed with a little basic knowledge

No, but the thought that someone without even a little knowledge could hire someone with just a little knowledge to affect the election... That's truly scary.

Re:Cue rimshot

Come on. Tell us something we didn't know.

OK. OLN has hired a man named Stanley Cup [philly.com] to promote the NHL playoffs this year.