Slashdot Mirror
Diebold Voting Machines Audited by California
Panaqqa writes "Diebold must be wondering what else can go wrong. Considering their arrogance in the past, their comeuppance is truly well deserved. The State of California's source code review [PDF] of the Diebold voting system has been released. Additional reports will be made available as the Secretary of State determines that they do not inadvertently disclose security-sensitive information. One wonders what it will take to convince voting machine manufacturers not to do things like hard coding passwords as '12345678.'"
12345678... That sounds like the password some idiot puts on their briefcase.
09F911029D74E35BD84156C5635688C0
+2 Troll is Slashdot's way of saying groupthink is confused
how after all the many serious screw-ups and warnings that Diebold has had in the past couple of years, this report shows they still didn't do anything at all to improve the situation.
I often wondered how managers and CEO's that don't even have a clue get given companies to control. This level of obvious incompetence makes me wonder even more.
Voting machines are a technical non-solution to a non-existing problem. Counting votes by hand in public view is almost as fast, has much fewer things that could go wrong with them, and is intrinsically open to public scrunity like no machine system can ever be. Plus, it's cheaper. It works in Denmark, it should scale perfectly well to the US.
We have a psychic bond! I use that exact same password on my luggage and machines!
We're password buddies!
I prefer Flambe as apposed flamebait.
They'd never sell a single one. No bank would accept an ATM that couldn't accurately track the thousand or so transactions that they see each day, or that anyone could gain control of by typing in a few keys followed by "12345678".
And yet somehow (through much campaign cash, etc.) they managed to convince politicians that all that stuff would be too hard and unnecessary in voting machines, despite the technology already being available from the same company. That it's not hard to count accurately millions, even billions, of dollars in transactions each day, but that it's too hard to simply increase by one the count in the proper register to greater than a few percent accuracy. And despite numerous security incidents, they are still fighting tooth and nail these simple things.
I'm not convinced electronic voting is necessary...but I'm wary of any politician that keeps trying to tell me there's no need to increase the security of such systems. Unless they say they're OK with their own banks using that kind of security, voting shouldn't use it either.
It's a step in the right direction, but really, is an audit even needed?
This is like building a nylon tent to hold your valuables, then performing an audit to evaluate the strength of its zipper. The entire concept is idiotic from the start.
There's a simple solution to voting machine security: use paper ballots. The machines can help you fill them out, but the result should always be a paper ballot which is the authoritative record of your vote. Simple, easy, secure. Why isn't this being done? Who knows, but it's clear the concerns of the people in charge are something other than correct vote counts.
We also used the Fortify static analysis tool to identify potential problem areas that warranted further manual investigation.
If I'm not mistaken, Fortify analysis showed more problems in the Linux kernel than in the Windows NT kernel, but most of the linux problems were later shown to be shortcomings with the automated analysis, not a design/programing flaw in Linux.
Diebold may have problems, but the use of Fortify (or similar) doesn't convince me.
Do you even lift?
These aren't the 'roids you're looking for.
Just because Jeb Bush fought so hard against paper trails is no excuse for conspiracy nuts to go wild. Please remember I said that when the time comes to round up the disloyal.
This program was made possible by a grant from the Ultra-Humanite, and viewers like you.
From AV-TSX bootloader code:
// Check for library not initialized or (x,y) out of range
// Compute the frame buffer offset and write the pixel
void GlibPutPixel(UINT xx, UINT yy, Pixel_t Color)
{
if(FrameBuffer != FALSE || (xx < USER_X) || (yy < USER_Y))
{
FrameBuffer[FB_OFFSET(xx,yy)] = Color;
}
}
TCHAR name;
_stprintf(&name, _T("\\Storage Card\\%s"), findData.cFileName);
Install(&name, hInstance);
First uses logical OR instead of logical AND to check boundaries, second writes a string where there is only storage for one character!
I can almost imagine that being a deliberate ploy. "
I'm sorry your honour, but one of our programmers (no longer under our employ) hard coded a weak password in complete disregard of coding standards. Regretably, the weakness of the password has enabled certain parties to guess what it is, and thereby subvert the electoral process. But it's not our fault."
Hanlon's Razor be dammned. In cases like this we should start assuming malice unless they can prove stupidity beyond any reasonable doubt.
Don't let THEM immanentize the Eschaton!
If you believe this is nothing more than pure incompetence, then you too have been fooled. This level of incompetence is usually indicative of strong intent that Hanlon's razor will be used by others to essentially protect the perpetrators from punishment for their immoral and/or illegal activities. This is just another way to game the system.
The votes on 10 ballots are totaled and this total is recorded on a marker sheet placed on top. Then the bundle is tied up. (10 ballots)
10 of those bundles are totaled on a different marker sheet and bundled together. (100 ballots)
10 of those bundles are totaled on a different marker sheet and bundled together. (1,000 ballots)
10 of those bundles are totaled on a different marker sheet and bundled together (10,000 ballots)
And so on. The idea being that any individual bundle can be quickly verified or re-counted. And because it's all base 10, it is easy for MOST humans to visually verify the bundles themselves. The ones that can count to ten, that is.
That's the same code that's on my luggage!
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
Voting machines are a technical non-solution to a non-existing problem.
Agreed.
Counting votes by hand in public view is almost as fast, has much fewer things that could go wrong with them, and is intrinsically open to public scrunity like no machine system can ever be. Plus, it's cheaper.
Wrong on faster and cheaper. As the recount in some Florida counties showed in the 2000 US presidential election.
Voting on paper is fine, but the paper should be mechanically counted. Hand counts should be a last resort when the machines are unable to read a vote or are malfunctioning.
Last night California decertified all of the electronic voting machines on the market. I thought that would be a bigger story today, but haven't seen it anywhere except for blackboxvoting.org
...the Republican-owned and -operated companies that make these things are doing their damnedest to convince states it shouldn't be done, using "security" and the urge to computerize everything under the sun as excuses.
Their true goals, of course, are (a) to increase their business, and (b) to help their favorite crooks get in office and stay there--where they can then send even more business their way. Lather, rinse, repeat.
Thats the number on MY briefcase, you insensitive clod!
or
Hello, I have a patent on 12345678 as a "source to unlock, lock, relock any device which may contain anything"
captcha: respite
I think we ought to go to other countries with a reputation of a good voting process and see how they do it, and with which, if any, machines they use. Because we obviously forgot how, and in some parts of the country they never had a fair voting process. No need to roll our own solution if one exists. Maybe Switzerland has something.
I'm beginning to believe that the average DIYer could build a better voting machine than Diebold.
I bet most high school graduates can't even count that high. And if someone is smart enough to guess such super-extra-difficult passwords such as those, perhaps they are smart enough to pick our next president. Hillary Obama, YEAH!
Why, yet again, is the responsibility for something this important (like the rebuilding of Iraq for example) being entrusted to a private company? Corporations by their very nature don't give a damn about anything that doesn't affect their ability to make money.
Maybe they should be hacked and have the admin password changed to 31337
The game.
Taken from the experts' review:
"Our study of the Diebold source code found that the system does not meet the requirements for a security-critical system. It is built upon an inherently fragile design and suffers from implementation flaws that can expose the entire voting system to attacks. These vulnerabilities, if exploited, could jeopardize voter privacy and the integrity of elections. An attack could plausibly be accomplished by a single skilled individual with temporary access to a single voting machine. The damage could be extensive--malicious code could spread to every voting machine in polling places and to county election servers. Even with a paper trail, malicious code might be able to subtly influence close elections, and it could disrupt elections by causing widespread equipment failure on election day.
We conclude that these problems arose because of a failure to design and build the system with security as a central focus, which led to the inconsistent application of accepted security engineering practices. For this reason, the safest way to repair the Diebold system is to reengineer it so that it is secure by design.
We discussed a number of limited solutions and procedural changes that may improve the security of the system, but we warn that implementing any particular set of technical or procedural safeguards may still be insufficient. Similarly, fixing individual flaws in the system--even all of the issues identified in this report--may not yield a secure voting system because of the possibility that unidentified problems will be exploited. We are also concerned that future updates to the system may introduce new, unknown vulnerabilities or fail to adequately correct known ones. We urge the state to conduct further studies to determine whether any new or updated voting systems are secure."
From page 51:
.ins files are used. An attacker who included a file with a long name or a name
Issue 5.2.24: AV-TSX startup code contains blatant errors.
287 TCHAR name;
288 _stprintf(&name, _T(''\\Storage Card\\%s''), findData.cFileName);
289 Install(&name, hInstance);
Here, name is not a character array but a single character in memory. The stprintf function
expects its first parameter to be a character array, so the programmer had to use the&operator
to get the address of name, rather than its value. The result is an obvious buffer overflow. A
string that includes the filename, which could be under an attacker's control, gets copied over
whatever data resides in the memory region following name.
That this code works at all seems purely accidental. Memory corruption occurs even when
legitimate
containing particular characters might be able to crash the program or, possibly, execute
malicious code.
This bug sheds light on the vendor's software engineering practices, because it is a very
unusual error for an experienced C++ programmer to make. Characters and character arrays
are very different constructs in C++. Students using the language for the first time might
confuse the two, but experienced programmers who understand basic concepts like pointers
would be unlikely to confuse them. The probability that an experienced C++ programmer
would make such a mistake or overlook it during even a cursory review of the code is
exceptionally low. This suggests to us that after this code was written it was not reviewed
by any other engineers at Diebold.
That's gold Jerry! Gold!
There is another kind of evil which we must fear most, and that is the indifference of good men. -- Boondock Saints
The human troll was here.
"This program was made possible by a grant from the Ultra-Humanite, and viewers like you."
- Anyone who's literate can see how they voted.
- Humans can recount, if necessary.
If a ballot-reader counts the votes, fine. We can have fast results without giving up accountability.I find this one of the most interesting issues, because I don't see an easy answer for it. I have a disdain for Windows matching any of the most avid Linux fanboys, but this is one issue that doesn't seem to be Windows-specific. Leaving a machine unpatched and un-upgraded can leave it open to vulnerabilities. Upgrading it can invalidate the certification. Is there any way out of that situation? I think it would be an issue no matter what operating system they used.
Top to bottom review docs:
s ource=All&type=All&title=&Search=Submit
http://www.sos.ca.gov/elections/elections_vsr.htm
Also the public hearing where a university computer science professor describes the results of the red team testing. The audio starts very poor but improves after 25 minutes, but I've ONLY been able to watch it *streaming* (which is a drag). The hearing is 6 hours long and if anyone can provide a download link, I'd be grateful.
http://www.calchannel.com/search.php?date=073007&
At 5 hrs, 26 min. Jim Soper presents a very good technical rebuttal to the manufacturers official positions, and receives some good applause from the crowd.
You can't be ahead of the curve, if you're stuck in a loop.
Their lack of regulatory oversight just amazes me.
I work in the casino equipment business, and in many jurisdictions, we must submit the source-code for the embedded software in our devices. Some jurisdictions rebuild the source-code to make sure that it matches our eproms.
Our eproms are checksummed, and gaming regulators can (and do), at any time, pull an eprom to checksum it in the field. Same for cdrom-based systems.
I would expect nothing less of voting machines.
Why is it that the scrutiny of the Diebold machines takes place after they've been used?
:
One would assume that in a matter as important as casting a vote, the integrity of the apparatus should be ensured, or at least surveyed, before use.
Any assesment of the quality of the system that originates from Diebold is naturally irrelevant. Any responsible public officer in charge should have set up an independent review before the machines were used.
People no longer consider the source when they digest information
Tobacco is safe - says the tobacco companies
There's no global warming - says the automakers and oil companies
Our voting machine is safe - says the vendor
Back to reality, though, it's amazing how many Unix passwords were "abc123", back when our systems required at least six characters including some non-letters
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Bad default passwords or even defaults themselves show faulty design, faulty thinking, and ignorance.
But, passwords are only one part of the problem.
I would prefer to have no computers when I vote. Just a pen and a paper. Now, if that paper could be scanned for cast votes AND manually counted, I'd be pleased. There should be no hidden steps where democracy is concerned. Voting over the internet will never be secure enough because I don't have trust in the transmission, the counting or the reporting process. It cannot be audited with absolute certainty that every vote cast is counted as cast.
Our countries rush to electronic voting was a mistake. A dumb mistake. As long as companies can sell products to solve non-problems they will. It was only after the Bush-Gore results were evident did we learn how awful the IBM card system was. It was in use for 20 or so years. How many election results from it were incorrect over the decades?
My employer makes security systems and long before the election by hanging chads took place, one of our engineers suggested we enter the voting machine market. Management ignored him and invested in different products. Shame, because we don't do things like we've seen in these reports and I think we would have a made a secure product. Still, I'd rather use pen and paper.
Our evaluation of Fortify was also poor. Too many false positives to be of any value. A government agency came to same conclusion in using it to evaluate product source code from vendors like my employer.
I'm not sure if this has been mentioned by someone else in a previous discussion but... Why not have electronic voting machines with an option to print out a receipt containing a unique number linked to your vote. This would allow the votes to be counted efficiently while giving the voters the ability to verify that their voted was counted properly. If you happen to be paranoid about privacy simply don't take the number or destroy it.
/. will prove me wrong.
It's simple, it's verifiable, and I don't see how it encroaches on anyones privacy but I'm sure someone on
It seems to me that ballot secrecy is a contrary goal to the goal of fraud resistance. How is it possible to guarantee anonymous ballots and yet be sure that each ballot was generated by a real person?
I don't get how so many people have some rosy picture of hand-counting votes, as if hand counting were somehow impervious to counting errors and impossible to manipulate. Humans make mistakes. They make them a hell of a lot more often than computers.
Here's something that might go wrong for Diebold: The media could stop completely ignoring the reports and inform the millions of people with their heads still in the sand.
But I'm not holding my breath.
I've sliced up the audio of the public hearing and posted it at http://usablesecurity.com/ttbr/. Enjoy, and feel free to pass it on.
It also exhibits a pet peeve of mine, neglecting to check the return value, probably learned by using MS defective by design sample code. Checking the return code of "_stprintf" would show the buffer overflow coding errorc e3zzk1k(VS.80).aspx
"Return Value
The number of characters written, or -1 if an error occurred. If buffer or format is a null pointer, sprintf_s and swprintf_s return -1 and set errno to EINVAL."http://msdn2.microsoft.com/en-us/library/
Of course this only lets you know something screwed up after the stack has been corrupted. Properly coded it should probably be using some variant of snprintf where the size of the target buffer is passed and the overrun avoided. I haven't written or audited a lick of code in more than five years, but the unsuitability of this code for production is pretty obvious. This should have never been allowed to be checked in, although if this is the quality of code produced one has to wonder if any kind of source code control is in place either.
There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
IMHO, the problems in this software are either due to totally incompetent engineering AND inadequate code review (and how the fuck did BOTH of those happen, if thats the case?), or they were intentionally put in place for some particular motive.
My guess is the latter - but what could the motive be?
Which is it?
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
{prediction of tomorrow's headline}
A mild mannered software auditor is mysteriously arrested for 20 federal offenses and whisked away during the night.