Slashdot Mirror
Diebold Security Foiled Again
XenoPhage writes "Yet again, Diebold has shown their security prowess. This time they posted, on their website, a picture of the actual key used to open all of their Diebold voting machines. Ross Kinard of Sploitcast crafted three keys based on this photo. Amazingly enough, two of the three keys successfully opened one of the voting machines. But fear not, Diebold has removed the offending picture, replacing it with a picture of their digital card key. Take that, hackers!"
Yet again, Diebold has shown their security prowess.
The only thing Diebold is good at securing is victory for the GOP.
The theory of relativity doesn't work right in Arkansas.
How can these guys still be in business? It seems like every couple weeks for the past 3 or 4 years I have been hearing about them screwing shit up, over and over and over and over again. Any other company would have been history long ago. What's with Diebold? Why don't they die?
To Boldy die where no security has died before!
The way to get rid of election controversies is to have a national election commission like in India. India has a lot more voters than the US and a much lower level of education but it manages to pull off general elections a lot more cleanly and fairly just because the standards are same for all elections and all precincts. The decentralized form of elections might have made sense for the age of horse coaches but in the age of internet it is not too tough to have thge same standards everywhere in the US
.With a paper backup all fraud can be caught given enough time for recounts (again if elections are not controlled by local partisan officials they cant arbitrarily decide not to have recounts).
Also why not have a paper trail
**Life is too short to be serious**
I don't reply to Anonymous posts; if you have something to say to me, identify yourself or I won't reply.
It's time to look at some other vendor for voting machines and whatever else they make. Our future is too important to leave to stumbling bumblers like that. Anything can be defeated but shouldn't be as easy as this.
Most of the stuff on
Yeah because in the last elec......um......the election before the last one, there were voting irregularities!!
Hey, at least we know they're not relying on security through obscurity!
Returned Peace Corps IT Volunteer
Do they even have any security-minded people working at this company? Publishing a picture of a real key is an understandable mistake, but why does the same key open every single voting machine?
http://outcampaign.org/
As long as it's a normal lock, like 90+% of the locks out there (likely including your own front door), then Lock bumping is going to allow just about any person, regardless of skill, to defeat the lock using extremely simple tools, in a matter of seconds, likely with no signs of intrusion at all.
Ryan Fenton
Our hero copied the smartcard from their photo on the website and keyed in the password 12345, the master password that unlocks all diebold machines.
... is the fact that Diebold also manufacturs ATMs. Makes me wonder if my bank account is safe...
Isn't this the same key that will open mini-bars?
I think the hotel owners should be able to sue over this release.
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
Did anyone else notice that the key used to open the machine in the video is significantly different than the keys in the photo?
Thank you. I now remember every atm machine I see is a Diebold machine. I remember specifically that fact if only because of the voting machine problems.
Ooo man the floppy drive is broken. No wait. The computer is just upside down.
..... So will they not rest until our security is completely compromised?
This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
Diebold voting machines are safe.
Even whey they publish openly all but explicit instructions on how to break into them. This may be a good thing, however, since it may compel them to actually put good locks on their machines. Probably not, though. As per the usual closed-source mentality, they'll just take the pic down and somehow believe that will somehow make the problem go away. Security through obscurity never works.
In effect, a closed source Diebold has been put through the ringer.
Perhaps, but not the PHBs.
"We are all geniuses when we dream"
- E.M. Cioran
Using this picture as a base, I have crafted three digital card keys...
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
Anyone else in the Slashdot community up to making a real voting machine, an ATM machine if we get bored. I'm pretty sure we won't make that many slip ups. After all they set the bar low for us.
Hmm I wonder if this be modded Troll, or Insightful, or mabey have replies "Sad, but true".
these guys cannot accidentally conjure up this many screwups in a row. it has to be by design. the interesting question is, what are they pulling while we're laughing ourselves onto the floor over this butch?
hillary vs cheney, perhaps, in 2008?
if this is supposed to be a new economy, how come they still want my old fashioned money?
Must be a typo- here's the fix:
"Diebold foils security again"
There, that's more accurate.
Your welcome!
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
How many total F-ups this company can make, how many times their claim they fix their security and it's proven still broken, or worse, how strangely it seems that all the states using Diebold machines have developed a strange skew towards a high Republican vote count, ...and still the government will use their equipment.
It could have been this Diebold key that provided access
= &q=GS-567331-1000_d.jpg&btnG=Search
:)
http://images.google.com/images?svnum=10&hl=en&lr
At least with the key under discussion, one had to do some metal work to duplicate it from a photo.
For the key in that image, I suspect that the same trick using a bic pen to open that kind of lock would work.
Hmm.... I wonder what that GS-567331 was supposed to open..... The page isn't working right now
-- 3 events that reshaped the world in the 20th century: WW1, WW2, and WWW
Safe? Safe?
Safe how? Like, a parked car oppose to a one possessed and gunning its engine to encourage you to run so it can run you down in a more sporting fashion?
While troll you obviously are, let's just cover the problems with e-voting...
1) Making a ton of ballots disappear takes longer to do, requires more people to do it, and will leave evidence SOMEWHERE compared to changing some data on a flashcard.
Actually, that's all the reason I need to want paper ballots. Oh, there's probably other reasons but isn't that one a big enough problem to kinda think, "Whoa, that makes it way too easy!"
Why are people ignoring what is going on in Florida House District 13?
The Rebublicans are claiming a 369 vote victory. However the EVMs in Sarasota county, reported an undervote of 18,000. or 1 in 6 of the total votes, which is much higher than the undervote in both the other counties and on average. Sarasota County also happened to be where the Democrat challenger won the vote by 6 percentage points (of the votes cast in that county).
There are some obviously severe issues with Electronic Voting, Particularly when there is no paper trail (as in the case for this district). Sure, there are ways to change the vote on a paper verification ballot, however large scale fraud becomes problematic to implement.
Links Below:n ?CATEGORY=NEWS0521&template=ovr2 e ssional_district h p?id=6423 i nterview_chris_1.html
http://www.heraldtribune.com/apps/pbcs.dll/sectio
http://en.wikipedia.org/wiki/Florida's_13th_congr
http://www.verifiedvotingfoundation.org/article.p
http://www.cqpolitics.com/2006/12/the_cqpolitics_
"The bass, the rock, the mic, the treble. I like my coffee black, just like my metal" - Mindless Self Indulgence
Perhaps you can explain why Maryland's previous Republican governor Robert Ehrlich fought against the Diebold machines tooth and nail, even asking for millions of dollars instead to support a traditional election process, only to have them rammed down his throat by the (Democratic) MD legislature and state board of elections? Our state elections administrator, Democrat Linda H. Lamone is still fighting their removal and even against adding a paper trail! Hell, she doesn't even want printers because she says adding printers to the existing equipment "would disrupt the voting system."
If you think the Republicans are the only ones who want to use Diebold machines to manipulate votes, you're an idiot.
Yeah, it's the anarchists! And the commies! And the terrorists! And Kin Jong Il! And Mahmoud Ahmadieboldsucksdonkeyballsinejad! They all want to hax0|2 Diebold, and elect the democrats!
There are plenty of tool and die makers around. I could order a few blanks ^W, - I mean custom metal parts, for a hell of a lot less than $3,000.
You can't complain about someone not knowing facts if you don't show them where to learn them.
Having read enough about black box to know that it would extremely simple to rig any election in any district at any given time is just so frustrating. It completely nullifies our "democratic" system if anyone can tamper with these machines, and worse, rig an election whether local or presidential. Honestly, is there anything we can do?
The government regulates which companies get to "approve" the legitimacy or the votes themselves as well as the security of these machines, and recently banned a research company from giving their approval on the machines at all.
What kind of methods could we put in order to ensure that our government functions less corrupt. I mean, having these machines with such vulnerabilities and flaws in a political environment is like asking your child not to eat their Halloween candy, no?
Relocating to San Francisco / Palo Alto... Hire me?
Determining
:)
Inaugural
election
Ballot
Outcome (on)
Lousy
Data
DIEBOLD
What's there to explain? Who they say they are doesn't matter when they try pulling this kind of shit. I'm a registered Democrat but I don't want to be affilliated with Lamone just the same as I don't want to be affilliated with whatshisname Jefferson (Demo rep, IIRC, from Lousianna) caught with thousands of dollars in his freezer. I want these people the fuck out of my party and the fuck out of congress. They are not doing this country any favors.
Voting machines should not be relying on physical security in the first place, because it is not practical to physically protect them 24/365. Their trustworthiness should be the result of double-handshake cryptographic authentications between the touchscreens, consoles, memory cards, and the central tabulator. Being able to open the cabinet should not be a vulnerability, because poll workers are invariably going to need to do so.
So, if Diebold machines implement proper authentication, then the cabinet key is not an interesting exposure. But if they don't (and we already know that they don't), then the cabinet key doesn't make them significantly more vulnerable than they already are.
FATMOUSE + YOU = FATMOUSE
I hear Diebold is looking into different security measures and is interested in this new-fangled "Public/Private" key stuff. Perhaps this was their Public key...
It must have been something you assimilated. . . .
You are being MICROattacked, from various angles, in a SOFT manner.
In the real world there are Election Judges. People who watch whats going on. This unlocking and tampering isnt going to happen in front of them. This is a proof of concept idea, and like a lot of them it takes some things for granted. Like "you will be able to do this and no one is looking, or will stop you". But in the real world that isnt the case. Try this in a real polling place and go to jail, go directly to jail, do not pass go , do not collect 200 dollars.
I trust Microsoft as far as I could comfortably spit a dead rat
A picture is worth a thousand votes.
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
There are always a lot of complaints about the security of any Diebold voting machines. Then there's the constant complaint of a paper trail (my county now has paper-trail making diebold machines).
What people should be pushing for is a voting system on commodity hardware. There's no sense in putting a million dollars forward for a small amount of "proprietary" machines that are all crap anyways. The only reason for wrapping a software solution in proprietary hardware like this is security through obscurity.
Instead of complaining all the time about Diebold et all, what we should be doing is putting together a GPL voting solution. Once it is mature and stable, push our representatives to make the move.
Prior to the 2004 election, Walter O'Dell, CEO of Diebold said that he would "deliver Ohio." He did.
The race isn't always to the swift... but that's the way to bet!
I'm dead serious.
I don't mean actually change the vote so these assclowns don't keep getting elected. I mean, bring your cracking kit (including a key and a printout of the screenshot of their website), and if you find one of these machines in your booth, walk out and complain to election officials. Don't just demand that you, yourself, be allowed to vote with something else -- demand that the machine be removed, and tell them that you are prepared to demonstrate just how insecure it is.
Then, if they don't listen to you, but still don't arrest you or steal your kit, go back into the booth and rig it so that 100% of the votes will go to whoever you want -- or 200%, if you can do that. The point, again, is not to make your guy win, but to force them to let everyone vote again, without the machines. (Of course, they could force everyone to re-vote on the same machines, but you just do the same trick again, and give the media an anonymous tip that you've rigged the election.)
We're at the point now of "I can't fucking believe this isn't front page news every goddamn day." In other words, this particular corruption is at the point where it's blindingly obvious enough that we should be able to bring it to the news, and eventually to "we the people" -- so that, eventually, no one in their right mind will allow their vote to be counted by a Diebold machine. Hopefully, this mistrust will extend to their ATM machines (which actually aren't nearly as bad), so that eventually, Diebold will have to die -- it's not that they can't do a good job, it's just that the company is so obviously run by corrupt fuckers -- or morons, but ultimately, there's not enough of a difference to matter here.
Don't thank God, thank a doctor!
Based on Diebold's actions in this area I think they must be an extreme case of an equal opportunity employer! Most employers do not disciminate on the basis of Race, Creed and Color. Diebold has obviously taken this to the next level in that they don't disciminate on the basis of Ability, either. We shouldn't be slamming them! We should be applauding them for taking bigotry down another notch! If it weren't for Diebold all those guys would be out on the street or having to work in the exfoliating scrubber factory or something! Hooray, Diebold!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Prediction: Tomorrow's story will read:
Ross Kinard of Sploitcast arrested on terrorism charges, faces 55 years in maximum security prison.
If you think the Republicans are the only ones who want to use Diebold machines to manipulate votes, you're an idiot.
Not just Republicans. I'm sure Al-Qaeda is looking to use it to inflict some real terror on the American people.
Comment removed based on user account deletion
The key is clearly visible 4 seconds into the video and the features appear to match the diebold photo almost exactly. http://www.youtube.com/watch?v=UfGvSJA20-Y
In the election before the last one, voting irregularities were discovered. In the last election, Diebold fixed that.
http://outcampaign.org/
Reminds me of an old joke:
What's the difference between an honest politician and a lightbulb?
Lightbulbs exist.
Cool! Amazing Toys.
The government doesn't WANT hack-proof machines.
I mean, imagine not being able to hack the machines. Unthinkable.
No sig today...
I know it's nearly impossible to sue the government, but what about a class action lawsuit against Diebold? Since security issues don't stop our government from supporting Diebold, perhaps putting them out of business would protect us. I would think you might get a few US citizens to join the class action.
The worst part of this security lapse is that it isn't even novel. There was a widely-circulated story recently about a man who had swallowed the key to a truck. An X-Ray was taken, and a duplicate key was made from the X-Ray.
http://alslockandsafe.com/alslockandsafe_010.htm
Whomever was selecting pictures for the website needs to realize that a clear photo is even easier to work from than an X-Ray.