Diebold Voting Machines Audited by California 159
Panaqqa writes "Diebold must be wondering what else can go wrong. Considering their arrogance in the past, their comeuppance is truly well deserved. The State of California's source code review [PDF] of the Diebold voting system has been released. Additional reports will be made available as the Secretary of State determines that they do not inadvertently disclose security-sensitive information. One wonders what it will take to convince voting machine manufacturers not to do things like hard coding passwords as '12345678.'"
Oblig... (Score:5, Funny)
Re: (Score:2, Funny)
Duuuuuuude! (Score:4, Funny)
We have a psychic bond! I use that exact same password on my luggage and machines!
We're password buddies!
Re: (Score:1)
12345678... AMAZING! That's the same exact password I have on my briefcase!
AMAZING! That's the same exact password I have on my br...
Inconceivable!
Password 12345678 (Score:2)
Back to reality, though, it's amazing how many Unix passwords were "abc123", back when our systems required at least six characters including some non-letters
Re:Oblig... (Score:4, Funny)
Re: (Score:1)
Re: (Score:2)
Re:Oblig... (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
And why I deserved an extra three karma points for that, I will never know.
Amazing.. truly amazing (Score:5, Insightful)
I often wondered how managers and CEO's that don't even have a clue get given companies to control. This level of obvious incompetence makes me wonder even more.
Maybe not so obvious (Score:3, Insightful)
Re:Maybe not so obvious (Score:5, Interesting)
One of the major problems that I see is that the developers rely far too much on security by obscurity, no matter what the project covers, figuring that if the attacker can't see the code, then he can't see vulnerabilities, and they don't read enough about vulnerability research to understand how critically dangerous this is. They do things like requiring SSL for the front-end session, encrypting the back-end FTP transfer, and splitting off the management interface to an internal server, while leaving the access controls for the database identical for both systems, requiring only short passwords, allowing an inordinate number of password retries, using poor seeding techniques for session IDs, and leaving nearly-default configurations of the web server in place.
I tend not to place as much value in accusations of malice as I do in observations of incompetence. When presented with a result like this from any random company, I am far more likely to attribute it to the latter, unless presented with some fairly strong evidence to the contrary.
Re: (Score:2)
No, incompetence is not the answer, or the streets would be flooded with $20s by now, it's intent, not 'opps, I'm so silly'. This company knows how to do security right, they just can't be bothered in this instance.
Three guesses as to why it's not a priority to them, like, say, ATM security is.
Re: (Score:2)
And don't forget that there are still report sections to be released. This may be endemic to the voting machine industry.
Reports like these make me want to bring back the older systems with punch cards. The wholesale move to electronic ballots is a prime example of over-reaction to the discovery of a break in the system (poorly-desig
Re: (Score:2)
This is absurd and dishonest. Did these same people cheat on tests when in school?
Re: (Score:2)
Whatever the case is, neither side gets all that much information prior to the test.
Re:Amazing.. truly amazing (Score:4, Insightful)
It's really pretty simple: Many companies are no longer run by the visionary people that started them, they are run by accountants and "risk managers."
Re: (Score:2)
http://www.crypto.com/blog/ca_voting_report/ [crypto.com]
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Just use paper counting (Score:5, Insightful)
Re: (Score:2, Informative)
Sure it does. (Score:5, Informative)
10 of those bundles are totaled on a different marker sheet and bundled together. (100 ballots)
10 of those bundles are totaled on a different marker sheet and bundled together. (1,000 ballots)
10 of those bundles are totaled on a different marker sheet and bundled together (10,000 ballots)
And so on. The idea being that any individual bundle can be quickly verified or re-counted. And because it's all base 10, it is easy for MOST humans to visually verify the bundles themselves. The ones that can count to ten, that is.
Re: (Score:2)
Re: (Score:2)
So, that's 90% of the US population out then...
Re: (Score:3, Insightful)
sommere wrote:
And you think that the electorate can make intelligent, informed decisions when asked to vote on hundreds of issues? Democracy doesn't scale well up to that level, that's why we're stuck with a Democratic-Republic [1]
Techie geeks have this amazing capability to focus on the wrong problem...
[1] Or we were, before the New
Re: (Score:3, Interesting)
Re: (Score:2)
Interesting. In your system, would I have to hand all of my votes over to a single delegate, or could I sub-divide the issues among multiple delegates?
In any case, I think if you game it out, what ends up happening is that the delegates need to form voting blocks to get anything past the other delegates, and you end up with extreme levels of compromise going on to the point where your input into t
Re: (Score:2)
I think subdivision would work best, though at that point, you're basically voting on individual issues in the first place, except instead of personally voting on each issue, you're voting on representatives for each issue. It'd also introduce interesting difficulties, for instance, how do you ensure that when you assign your vote on abortion issues to a given representative, that that representative only spends your vote on abortion issues? There'
Re: (Score:2)
I think I see what you're going for, though as I've already outlined I think in actuality you'd find problems with your system that are very similar to what we already have. The EFF delegate would keep explaining to the troops that they just had to compromise on
Re: (Score:2)
You have a point, if the design isn't careful, we just end up trading one Congress for another. I think we can cut down on vote trading by requiring the candidates for delegation to register for some subset of related issues, so the EFF would not vote on issues that the RIAA would deal with except in those cases where their i
Re: (Score:2)
As to your conclusion, I disagree. Voting blocks are the thing I want to eliminate. If my representative starts voting against my interests in order to trade votes with others, then I pick a different representative. The goal is to end up with every vote being cast in the way the citizen would have cast it themselves. Of course that won't happen, but it c
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re:Just use paper counting (Score:4, Insightful)
Re:Just use paper counting (Score:5, Insightful)
Re: (Score:2)
Paper Printout:
-------------
Thank you for voting! Your democratic republic is at work!
Your transaction ID is:
wxC9!2@67Azs
Your vote was counted toward:
Bob
Please keep this receipt and visit www.CheckYourVote.com or call 1-800-CHK-VOTE to confirm that your
Re: (Score:3, Insightful)
Good day, Mr. Smith. Mr. Jones would like to see your voting receipt now. Naturally I am sure that you voted as agreed in our little business arrangement, because if you didn't, Mr. Jones will be very upset...
Re: (Score:3, Informative)
If you put a voter's choice on the walk-away receipt, you commoditize the election completely, since the receipts become a call on a vote. You can print the choices
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Hanging chads is a bullshit argument - I've seen nobody argue that it isn't acceptable to use a voting machine that produces a printed voting card that's guaranteed to b
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
Forging, destroying, or disposing of 100,000 paper ballots can be done but it is rather hard and time consuming.
Forging, destroying, or disposing of 100,000 electronic ballots can be done and with only a few keystrokes.
The thing is, most of the people nay saying the loss of paper ballots aren't Luddites but are
Re: (Score:2)
It would be interesting to know why computerised voting can't count. Counting is one thing that a computer can do well.
Re: (Score:2)
Um, hanging chads are a problem with with ballots designed for machine counting that are resolvable only by hand counting, not a problem with ballots designed to be counted by hand.
Re: (Score:2)
Inefficiency is not intrinsically a flaw, it's simply an attribute. Whether or not it's a flaw depends on the context. If we're talking about a for-profit business venture, then inefficiency is probably a flaw, but we're talking about a vote counting process. Inaccuracy is a flaw, and anything that might lead to inaccuracy such as the vulnerabilities found in all current electronic voting machines, but inefficiency doesn't
Re: (Score:2)
Not hand, mechanical paper counting (Score:4, Insightful)
Agreed.
Counting votes by hand in public view is almost as fast, has much fewer things that could go wrong with them, and is intrinsically open to public scrunity like no machine system can ever be. Plus, it's cheaper.
Wrong on faster and cheaper. As the recount in some Florida counties showed in the 2000 US presidential election.
Voting on paper is fine, but the paper should be mechanically counted. Hand counts should be a last resort when the machines are unable to read a vote or are malfunctioning.
Re: (Score:2)
Re: (Score:3, Insightful)
Let us assume that a person can enter one vote in 20 seconds on a voting machine. Let us assume that voting machines are busy 10 hours on voting day. Each voting machine will "count" 1800 votes in a day. So for $20, you can count more votes than the voting machine.
If each voting machine costs $400, it will take 20 elections to recoup your investment. And while there are multiple elections a year, y
Re: (Score:2)
We're talking about the United States here. I can't speak to every ballot in every jurisdiction, but in mine (Cook County, Illinois, but not Chicago) there were at least 50 and probably closer to 100 things to vote on. Not only that, but the questions were different; there was the standard "select one candidate" lists, there were "select N of the Y below" lists, and there was page after page of "retain or not retain" (mostly for judgeships).
How many people do you know who can keep 50-100 different talli
Re: (Score:2)
You sort the ballots into races, and then sort each race into a stack for each candidate.
Then you count and re-count the stack. Some countries use bank tellers, who, in those countries, get the day off. And they are, of course, very experienced in counting the number of little bits of paper and don't make a ton of money.
The optical scan machines are probably worth it, although I'd resist the temptation to have them be
Re: (Score:2)
I can't see the logic in that example.
The recount in Florida was a recount, not a count. A recount of a close, contested vote has a lot of inherent diffuclties not necessarily found in the first count.
Also, it was a visual recount of punch cards, and punch cards are designed for machine counting, not human reading. Hanging chads would not have been a problem in a paper ballot. I know ambigui
Re: (Score:2)
Re: (Score:2)
--
Solar power with no installation cost: http://mdsolar.blogspot.com/2007/01/slashdot-user s -selling-solar.html [blogspot.com]
Re: (Score:2)
With a machine that calculates election results no one can really claim to be part of the verification process.
Re: (Score:3, Insightful)
That doesn't mean that electronic voting is the solution, of course.
Brett
Re: (Score:2)
Eeeeeeek (Score:5, Insightful)
They'd never sell a single one. No bank would accept an ATM that couldn't accurately track the thousand or so transactions that they see each day, or that anyone could gain control of by typing in a few keys followed by "12345678".
And yet somehow (through much campaign cash, etc.) they managed to convince politicians that all that stuff would be too hard and unnecessary in voting machines, despite the technology already being available from the same company. That it's not hard to count accurately millions, even billions, of dollars in transactions each day, but that it's too hard to simply increase by one the count in the proper register to greater than a few percent accuracy. And despite numerous security incidents, they are still fighting tooth and nail these simple things.
I'm not convinced electronic voting is necessary...but I'm wary of any politician that keeps trying to tell me there's no need to increase the security of such systems. Unless they say they're OK with their own banks using that kind of security, voting shouldn't use it either.
Re: (Score:2, Informative)
There's also the substantial issue of the requirement to handle processing all voters on the same day within a certain number of hours. That requi
Re:Eeeeeeek (Score:5, Interesting)
Of course, DieBold shouldn't be allowed to touch this kind of thing, and someone will find a way to abuse it, but probably not any worse than we've got right now. I hope.
Re: (Score:2)
I can't be the first guy to think of this, can I?
Re: (Score:2)
Ebay effect would take over -- people would watch how the early people were voting and then mob the machines in the last hour.
Also, the effect of having a polling place in a public area under constant supervision has its benefits, as it can (can) positively prevent electioneering and vote tampering, as the entire process is mediated by responsible individual persons. If the process is compu
Secure Cellophane Bank Vaults (Score:4, Insightful)
This is like building a nylon tent to hold your valuables, then performing an audit to evaluate the strength of its zipper. The entire concept is idiotic from the start.
There's a simple solution to voting machine security: use paper ballots. The machines can help you fill them out, but the result should always be a paper ballot which is the authoritative record of your vote. Simple, easy, secure. Why isn't this being done? Who knows, but it's clear the concerns of the people in charge are something other than correct vote counts.
Re: (Score:2)
Though to be fair, in the two counties I've ever lived in in two different states, they've both used paper ballots marked with indelible marker for the elections I've voted in
Re: (Score:2)
fortify? (Score:1)
We also used the Fortify static analysis tool to identify potential problem areas that warranted further manual investigation.
If I'm not mistaken, Fortify analysis showed more problems in the Linux kernel than in the Windows NT kernel, but most of the linux problems were later shown to be shortcomings with the automated analysis, not a design/programing flaw in Linux.
Diebold may have problems, but the use of Fortify (or similar) doesn't convince me.
Re: (Score:3, Insightful)
Some code howlers from TFA (Score:4, Informative)
void GlibPutPixel(UINT xx, UINT yy, Pixel_t Color)
{
if(FrameBuffer != FALSE || (xx < USER_X) || (yy < USER_Y))
{
FrameBuffer[FB_OFFSET(xx,yy)] = Color;
}
}
TCHAR name;
_stprintf(&name, _T("\\Storage Card\\%s"), findData.cFileName);
Install(&name, hInstance);
First uses logical OR instead of logical AND to check boundaries, second writes a string where there is only storage for one character!
Re: (Score:2)
Re: (Score:2)
I have heard this claim before, but I have never seen any evidence that it's true. Every major compiler and every compiler I've used has had NULL=0, and using if(ptr) to mean if(ptr!=NULL) is a very common C and C++ idiom. Any platfor
"Plausible Deniability", Anyone? (Score:5, Insightful)
I can almost imagine that being a deliberate ploy. "
I'm sorry your honour, but one of our programmers (no longer under our employ) hard coded a weak password in complete disregard of coding standards. Regretably, the weakness of the password has enabled certain parties to guess what it is, and thereby subvert the electoral process. But it's not our fault."
Hanlon's Razor be dammned. In cases like this we should start assuming malice unless they can prove stupidity beyond any reasonable doubt.
Re: (Score:2)
1, 2, 3, 4, 5... (Score:2, Funny)
California decertified all machines last night (Score:2, Interesting)
Re: (Score:2)
Or if Paris Hilton crashed into a voting machine while DUI.
Or if...yea...
Re: (Score:3, Informative)
That's misleading. They decertified them, then recertified them with some additional security requirements.
See here: Elections chief gives OK to vote machines [sfgate.com]
Look how others do it? (Score:2)
What it would take is for them to be punished in the marketplace, as in not buying the damned things.
I think we ought to go to other countries with a reputation of a good voting process and see how they do it, and with which, if any, machines they use. Because we obviously forgot how, and in some parts of the country they never had a fair voting process. No need to roll our own
Their conclusions are (Score:2)
"Our study of the Diebold source code found that the system does not meet the requirements for a security-critical system. It is built upon an inherently fragile design and suffers from implementation flaws that can expose the entire voting system to attacks. These vulnerabilities, if exploited, could jeopardize voter privacy and the integrity of elections. An attack could plausibly be accomplished by a single skilled individual with temporary access to a single voting mach
Re: (Score:2)
My favourite issue (Score:3, Informative)
Issue 5.2.24: AV-TSX startup code contains blatant errors.
287 TCHAR name;
288 _stprintf(&name, _T(''\\Storage Card\\%s''), findData.cFileName);
289 Install(&name, hInstance);
Here, name is not a character array but a single character in memory. The stprintf function
expects its first parameter to be a character array, so the programmer had to use the&operator
to get the address of name, rather than its value. The result is an obvious buffer overflow. A
string that includes the filename, which could be under an attacker's control, gets copied over
whatever data resides in the memory region following name.
That this code works at all seems purely accidental. Memory corruption occurs even when
legitimate
containing particular characters might be able to crash the program or, possibly, execute
malicious code.
This bug sheds light on the vendor's software engineering practices, because it is a very
unusual error for an experienced C++ programmer to make. Characters and character arrays
are very different constructs in C++. Students using the language for the first time might
confuse the two, but experienced programmers who understand basic concepts like pointers
would be unlikely to confuse them. The probability that an experienced C++ programmer
would make such a mistake or overlook it during even a cursory review of the code is
exceptionally low. This suggests to us that after this code was written it was not reviewed
by any other engineers at Diebold.
That's gold Jerry! Gold!
Limitations on upgrading an important issue (Score:2)
I find this one of the most interesting issues, because I don't see an easy ans
Link to the official 'Top-to-Bottom' Review site (Score:2, Informative)
http://www.sos.ca.gov/elections/elections_vsr.htm [ca.gov]
Also the public hearing where a university computer science professor describes the results of the red team testing. The audio starts very poor but improves after 25 minutes, but I've ONLY been able to watch it *streaming* (which is a drag). The hearing is 6 hours long and if anyone can provide a download link, I'd be grateful.
http://www.calchannel.com/search.php?date=073007&s ource=All&type=All&title=&Search=Submit [calchannel.com]
At
conundrum (Score:2)
hand count? (Score:2)
Re: (Score:2)
The problem here is precisely that the computer is capable of making of making mistakes far more quickly and effectively than people if directed to do so.
What else could go wrong for Diebold? (Score:2)
Here's something that might go wrong for Diebold: The media could stop completely ignoring the reports and inform the millions of people with their heads still in the sand.
But I'm not holding my breath.
right (Score:2)
IMHO, the problems in this software are either due to totally incompetent engineering AND inadequate code review (and how the fuck did BOTH of those happen, if thats the case?), or they were intentionally put in place for some particular motive.
My guess is the latter - but what could the motive be?
Re: (Score:2)
Re: (Score:3, Insightful)
Look it up. Ballot readers are compromised as easily as the original machines.
An ideal arrangement is to have a printed ballot as the official ballot, and a supervised hand-counted count which is the OFFICIAL count. Then, the original voting machines can also perform an electronic tally themselves, and this electronic tally can serve as a check for the hand count. If the two differ significantly, somethin
Re: (Score:2)
Yes, but you have the ballots. All-electronic systems with no separate ballots don't allow random-precinct hand-count confirmation, or even full-election hand recounts if there is cause.
Systems that generate a ballot, which the voter than confirms and turns in and is then counted by a separate machine do allow that, so even if the ballot reader is just as easily compromised as a voting machine in an all-electronic system would be,
Re: (Score:2)
Now, now. If you check Thomas Ricks, "Fiasco", or Seymour Hersh's "Chain of Command", you'll find that most of the cataclysmic mistakes in the reconstruction of Iraq were not made by the military or by private companies. They were made by u
Re: (Score:2)
That is what other countries do and what the USA does itself when helping to supervise elections in other countries.
Re: (Score:2)
Indeed. And one of the few things the Bush administration has attempted that was non-trivial and wasn't hoplessly botched was the supervision of reasonably free and fair elections in Iraq and Afghanistan. I don't think the used voting machines in either country.
There's a thought. How about we round up all the voting machines in the US, and ship them off to someone we don't like --