Diebold Security Foiled Again 201
XenoPhage writes "Yet again, Diebold has shown their security prowess. This time they posted, on their website, a picture of the actual key used to open all of their Diebold voting machines. Ross Kinard of Sploitcast crafted three keys based on this photo. Amazingly enough, two of the three keys successfully opened one of the voting machines. But fear not, Diebold has removed the offending picture, replacing it with a picture of their digital card key. Take that, hackers!"
Still in business (Score:5, Interesting)
Re: (Score:3, Funny)
Because they're called Diebold. Not Diebold.
Duh.
Re: (Score:2)
Re: (Score:2, Funny)
It was funny, right up until you had to explain it.
Re:Still in business (Score:5, Insightful)
Re: (Score:2)
This parent has the answer to the problem (Score:2)
Thank you. I now remember every atm machine I see is a Diebold machine. I remember specifically that fact if only because of the voting machine problems.
Re:Still in business (Score:5, Interesting)
That's because they aren't being viewed with a critical eye by the people buying voting machines.
The people who are making those decisions continue to want to have the voting machines in the face of all of the evidence showing how unsecure/not-tamper-proof these things really are.
Apparently, the government doesn't seem too bothered by a vendor who is selling a product which is completely insecure.
Cheers
Re:Still in business (Score:4, Insightful)
There; fixed it for you.
If you think the politicos making the purchase decisions are ignorant of the documented problems, you're incredibly naive.
Re:Still in business (Score:5, Informative)
I believe the following will explain: "The company came under fire last year for a letter that Diebold CEO Walden O'Dell wrote as a fundraising pitch to Republicans. In the letter, O'Dell said he was "committed to helping Ohio deliver its electoral votes to the president." Diebold is based in North Canton, Ohio." (http://money.cnn.com/2004/08/30/technology/electi on_diebold/index.htm [cnn.com])
Frankly no one in power really seems to want a fair election. If they did, they'd be fighting these e-voting machines all the way - as there is absolutely no need for them.
Re:Still in business (Score:4, Insightful)
Re:Still in business (Score:4, Informative)
I believe they called it a "triumph of the free market". http://en.wikipedia.org/wiki/General_Motors_street car_conspiracy [wikipedia.org]
Re: (Score:2)
Besides, the conflict between cars and trains came on the interstate. Not only did we lose that battle but we also lost the battle of freight on trucks vs. trains. Not that lots of freight doesn't still go by train, but it doesn't go as far.
The place for light rail is in the trash. We should be using the sky loop [skyloop.org] concept. It could be used to move both people and freight and would not interfere with vehicles, yet could be installed in essentially the same space.
Re:Still in business (Score:5, Funny)
Re: (Score:2)
This only makes me more puzzled, really, when I see what kind of impenetrable tanks they use to store money (cash dispensers and ATMs) but they use flimsy pre-teen diary locks on voting machines.
Re: (Score:2)
Re: (Score:3, Insightful)
You can choose to see this as a cons
DieBold Security..... (Score:5, Funny)
Better yet... (Score:5, Funny)
National Election Commision (Score:5, Insightful)
Also why not have a paper trail
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Re:National Election Commision (Score:5, Insightful)
In many ways Diebold et al. are all showing symptoms of not realising that they are trying to add technology to the wrong part of the process. In many ways the punch card system or optical card reader systems are the better systems, since the paper trail exists before the vote is taken into account: WYSIWYG. The proposed solutions provide a paper trail as a result of the process, if at all. The problem with this is that the paper trail may not be a result of what you inputted.
Remember just because technology can be used for a process, it does not necessarily mean that technology is needed for the process. Technology is there to make a complex task simple, not the other way round.
Re: (Score:2)
You are talking about one more area where the federal government intrudes, takes over and replaces a function that is left to the states now. This is not just a little troublesome for some people. The "War Between the States" was essentially over state's rights in one form or another. You should be prepared to believe that many states do not like losing out to the federal government powers that they have held for 200 years and will call out the National Guard (a state militia) to defend their
Re: (Score:2)
As with the Indian example we have a federal election commission in Australia, and it works very well. Votes are cast by pencil on paper, counted by casual workers, and the count is mostly finished in a couple of hours. Manual counting doesn't really cost anything because the same people who do the counting are also needed to man the polling places during the day.
I can't see how any kind of count or survey co
Re: (Score:2)
Re: (Score:2)
That may not be necessary. Strongarm states that don't conform their own laws to national 'standard' election laws by threatening Federal funding sanctions. That's been the common practice for quite a while, as far as I understand it. For instance, when the legal drinking age was rai
Google (Score:5, Informative)
Re: (Score:2, Funny)
You mean- Then sit on your lazy ass and find it! It's the Internet!
Google link (Score:4, Informative)
New Vendor (Score:3, Interesting)
Re: (Score:2)
Security through... (Score:5, Funny)
This is a security company? (Score:5, Insightful)
Re: (Score:2)
How? I've never heard of anyone ever intentionally taking a picture of a key. And if it's a master key it's absolutely not an understandable mistake.
Re: (Score:2)
Ignoring the potential for screwups in distribution (machine ships with no key, machine ships with wrong key), you have the wonderful situation of a large county (like Cook County, IL) with 10,000 machines and 10,000 unique keys.
Of course, you cannot access the machine to do anything without the single, unique, correct key.
I am sure that unique keys would be much, much worse than one key fits all.
Re: (Score:2)
Re: (Score:2)
Re:This is a security company? (Score:5, Funny)
Jeez. I'd have thought that was obvious...
Re: (Score:2)
I am pretty sure that the same flat head screwdriver would open each of those locks as well.
Re: (Score:2)
Re: (Score:2)
It's a pin-based lock? (Score:5, Informative)
Ryan Fenton
Re: (Score:3, Informative)
Re: (Score:2)
All I need is one cut key and an upright mill and I can make as many blanks as you want. How many do you need? You can score a nice BIG bridgeport upright mill on ebay, typically with some tooling, for around $1500 plus an obscene charge for shipping something that heavy. And you'll need three phase power
Re: (Score:2)
Last I checked, bridgeport operating was a specialized skill that actually pays pretty well in my area (Metro Detroit) because it requires some training and experience to actually know what you're doing.
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Last I checked, it was called "milling", not "bridgeport operating". And you can go to a community college and gather the requisite skills in a three unit, one-semester class. Frankly milling is not very hard, it's not even slightly hard. The hardest part is remembering which way the table will move when yo
Re: (Score:2)
Re: (Score:2)
that's pretty hilarious. I guess they figure that people willing to work churning out parts may or may not even know that it's called a "vertical mill", but that a significant (maybe dramatic is a better word) percentage of vertical mills are made by bridgeport.
After all, an actual "machinist", someone who can make things by hand on horizontal mill, or vertical mill,
Re: (Score:3, Insightful)
So? How much time do you think you have between elections anyway?
Find a tool and die maker (Score:2)
Re: (Score:2)
Undaunted (Score:5, Funny)
Re: (Score:3, Funny)
1 2 3 4 5? That's amazing! I've got the same combination on my luggage!
Re: (Score:2)
Re: (Score:2)
What concerns me even more (Score:5, Informative)
Re: (Score:3, Funny)
Re: (Score:2, Insightful)
But think about it, how often is it that anything errs in your favor? Bank magically gives you an extra $20? Phone company charges you at half rate?
Remember that story about the ATM that was pumping out
Re: (Score:3, Insightful)
Re: (Score:2)
I would *think* if someone managed to open an ATM, I think the money would be the first thing to grab. I don't know how much cash your average cash machine holds but
http://www6.diebold.com/gssssps/pdfs/DBD_ATM_Cash_ Mgt_PC.pdf [diebold.com]
Diebold machines do employ cash maangement, making sure to keep track of how much is needed.
Besides, and pointed out in other slashdot articals, phishing schemes seem to be most effective.
Re: (Score:2)
and many are loaded with less cash than that.
Isn't this... (Score:2)
I think the hotel owners should be able to sue over this release.
Re:Isn't this... (Score:4, Interesting)
Yes. From the article:
" ... and beyond that, it could be opened with the same keys typically used with hotel minibars and jukeboxes."
Re: (Score:2)
For the non-refridgerated mini-bars, you don't actually need the key. Grasp the handle firmly and push/rotate it outward (hard to describe but trivial to do - Basically you want to put torque on it so the bolt of the lock on the inside rotates away from the door jamb).
As an aside, this works on a lot of simpler locks on thin-metal cases - The weakness comes from the fact that the door and
Winner (Score:5, Funny)
Re:Winner (Score:5, Funny)
Re:Winner (Score:4, Funny)
Re:Winner (Score:4, Funny)
Diebold's slogan is "We Won't Rest" (Score:2)
Fear not, indeed (Score:5, Funny)
Using this picture as a base, I have crafted three digital card keys...
diebold: dumber than you can measure (Score:2)
hillary vs cheney, perhaps, in 2008?
Could be worse (Score:2)
http://images.google.com/images?svnum=10&hl=en&lr= &q=GS-567331-1000_d.jpg&btnG=Search [google.com]
At least with the key under discussion, one had to do some metal work to duplicate it from a photo.
For the key in that image, I suspect that the same trick using a bic pen [wired.com] to open that kind of lock would work.
Hmm.... I wonder what that GS-567331 was supposed to open..... The page isn't working right now
Florida House 13 (Score:5, Interesting)
Why are people ignoring what is going on in Florida House District 13?
The Rebublicans are claiming a 369 vote victory. However the EVMs in Sarasota county, reported an undervote of 18,000. or 1 in 6 of the total votes, which is much higher than the undervote in both the other counties and on average. Sarasota County also happened to be where the Democrat challenger won the vote by 6 percentage points (of the votes cast in that county).
There are some obviously severe issues with Electronic Voting, Particularly when there is no paper trail (as in the case for this district). Sure, there are ways to change the vote on a paper verification ballot, however large scale fraud becomes problematic to implement.
Links Below:n ?CATEGORY=NEWS0521&template=ovr2 [heraldtribune.com] e ssional_district [wikipedia.org] h p?id=6423 [verifiedvo...dation.org] i nterview_chris_1.html [cqpolitics.com]
http://www.heraldtribune.com/apps/pbcs.dll/sectio
http://en.wikipedia.org/wiki/Florida's_13th_congr
http://www.verifiedvotingfoundation.org/article.p
http://www.cqpolitics.com/2006/12/the_cqpolitics_
Living up to the name (Score:3, Funny)
Inaugural
election
Ballot
Outcome (on)
Lousy
Data
DIEBOLD
You're barking up the wrong tree (Score:4, Interesting)
Voting machines should not be relying on physical security in the first place, because it is not practical to physically protect them 24/365. Their trustworthiness should be the result of double-handshake cryptographic authentications between the touchscreens, consoles, memory cards, and the central tabulator. Being able to open the cabinet should not be a vulnerability, because poll workers are invariably going to need to do so.
So, if Diebold machines implement proper authentication, then the cabinet key is not an interesting exposure. But if they don't (and we already know that they don't), then the cabinet key doesn't make them significantly more vulnerable than they already are.
Public Key? (Score:3, Funny)
I hear Diebold is looking into different security measures and is interested in this new-fangled "Public/Private" key stuff. Perhaps this was their Public key...
The real world (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Great. So bank vault locks don't need to work properly either, since in the real world there will usually be people around. Antivirus programs aren't necessary, since the firewall ought to block everything. Restricted user accounts aren't necessary, since bad guys should be stopped from entering the system in the first place.
The point of multilayer security is that they provide essential fallbacks when other layers fail. If an inner layer fails, despite the fact that it is mitigated by the existence
Security... Paper Trail... (Score:3, Interesting)
What people should be pushing for is a voting system on commodity hardware. There's no sense in putting a million dollars forward for a small amount of "proprietary" machines that are all crap anyways. The only reason for wrapping a software solution in proprietary hardware like this is security through obscurity.
Instead of complaining all the time about Diebold et all, what we should be doing is putting together a GPL voting solution. Once it is mature and stable, push our representatives to make the move.
Re: (Score:2)
It's not just about having a paper trail. It's about how that trail is created, and whether the procedures are sufficient to make it effective. From what I've seen, the paper trails in many places are unreliable, and practically useless for getting an accurate recount and preventing vote tampering.
I Think It's Great! (Score:4, Funny)
Re:the only thing.. (Score:5, Funny)
Re: (Score:2)
Re:the only thing.. (Score:4, Insightful)
Re: (Score:2)
Anyone with even a bit of intellegence would want independent oversite of elections. But the media whoring, FUD mongering, jackasses on both sides I can do without. In recent years, with the House, Senate, and
Re: (Score:2)
Re: (Score:2)
http://www.google.com/search?hl=en&lr=&client=saf
Re:the only thing.. (Score:4, Interesting)
Having both sides being extremely skeptical of the computer returned election counts is the only thing keeping anyone honest.
Re: (Score:3, Insightful)
It's troubling that so many people are such linear thinkers. It makes it really easy to pull off Machiavellian subterfuge.
Re: (Score:2)
Re:Its from the please-think-then-vote dept. (Score:5, Informative)
Perhaps you can explain why Maryland's previous Republican governor Robert Ehrlich fought against the Diebold machines tooth and nail, even asking for millions of dollars instead to support a traditional election process, only to have them rammed down his throat by the (Democratic) MD legislature and state board of elections? Our state elections administrator, Democrat Linda H. Lamone is still fighting their removal and even against adding a paper trail! [gazette.net] Hell, she doesn't even want printers because she says adding printers to the existing equipment "would disrupt the voting system."
If you think the Republicans are the only ones who want to use Diebold machines to manipulate votes, you're an idiot.
Re: (Score:2)
Even whey they publish openly all but explicit instructions on how to break into them. This may be a good thing, however, since it may compel them to actually put good locks on their machines. Probably not, though. As per the usual closed-source mentality, they'll just take the pic down and somehow believe that will somehow make the problem go away. Security through obscurity never works.
In effect, a closed source Diebold has been put through the ringer.
Perhaps,
Re: (Score:2)
Re: (Score:2)
Break them. (Score:2)
I don't mean actually change the vote so these assclowns don't keep getting elected. I mean, bring your cracking kit (including a key and a printout of the screenshot of their website), and if you find one of these machines in your booth, walk out and complain to election officials. Don't just demand that you, yourself, be allowed to vote with something else -- demand that the machine be removed, and tell them that you are prepared to demonstrate just how insecure it is.
Then, if they don't
Re: (Score:2)