Diebold Voting Machines Audited by California

Panaqqa writes "Diebold must be wondering what else can go wrong. Considering their arrogance in the past, their comeuppance is truly well deserved. The State of California's source code review [PDF] of the Diebold voting system has been released. Additional reports will be made available as the Secretary of State determines that they do not inadvertently disclose security-sensitive information. One wonders what it will take to convince voting machine manufacturers not to do things like hard coding passwords as '12345678.'"

Comments

Some code howlers from TFA

[noidentity]

From AV-TSX bootloader code:

void GlibPutPixel(UINT xx, UINT yy, Pixel_t Color)
{
// Check for library not initialized or (x,y) out of range
        if(FrameBuffer != FALSE || (xx < USER_X) || (yy < USER_Y))
        {
// Compute the frame buffer offset and write the pixel
                FrameBuffer[FB_OFFSET(xx,yy)] = Color;
        }
}

TCHAR name;
_stprintf(&name, _T("\\Storage Card\\%s"), findData.cFileName);
Install(&name, hInstance);

First uses logical OR instead of logical AND to check boundaries, second writes a string where there is only storage for one character!

Sure it does.

[khasim]

The votes on 10 ballots are totaled and this total is recorded on a marker sheet placed on top. Then the bundle is tied up. (10 ballots)

10 of those bundles are totaled on a different marker sheet and bundled together. (100 ballots)

10 of those bundles are totaled on a different marker sheet and bundled together. (1,000 ballots)

10 of those bundles are totaled on a different marker sheet and bundled together (10,000 ballots)

And so on. The idea being that any individual bundle can be quickly verified or re-counted. And because it's all base 10, it is easy for MOST humans to visually verify the bundles themselves. The ones that can count to ten, that is.

Re:Oblig...

[Martin Blank]

It's a paraphrase from Spaceballs, when the king of Druidia hands over the code to the air shield.