At Defcon 16, Sandy Clark presented the results of academic research examining electronic voting machines in Ohio. Part of the problem is that there are multiple laws to adhere to both at the federal level and at the state level.
The voting equipment is not controlled at the state level but actually at the county level. There are over 3,000 counties within the US. HAVA, Help America Vote Act, was one of the few federal mandates ever funded and provided time limited monies for counties to purchase electronic voting machines. Most of these are touch-screen based and highly insecure.
Election Software Systems (ES & S) and Premier/Diebold have about 40% of market share each for a total market share of 80%. They are owned by two brothers. As Sandy noted, this gives new meaning to family values. The researchers went through 1.4 million lines of code. However, because of time limitations they only took random samples of code for analysis. Similar to the ability to hit the broad side of a barn they couldn't possibly miss multiple problems, weaknesses, and huge security holes.
Sandy ran out of time listing all of the ways in which the machines and the system as a whole are insecure and quite broken. Sandy knows seventh graders who can write better code. Beginning with the physical security to open the ballot box or the voting machine is the same cheap key that opens your home mini-bar. The scary thing is that the key is the same for the same manufacturer across the country.
That means one key opens 80% of the machines in use. However, if you don't have a home mini-bar a simple paper clip with a bit of jiggling will open the lock for you. The electronic equipment is assembled and protected by tamper evident seals. If these seals were to be broken then all of the votes on that machine will not be counted. Alternatively to gain access to the computer itself you could buy tamper evident seals online with any barcodes you wish so you could remove and replace. Or you could use a hairdryer or your fingernail to remove and replace. If any port or plug in the system is pulled apart then it disables the audit trail and gives access to the board.
Another attack vector is through the touchscreen on ES&S machines. They are all infrared controlled and so the hardware authentication tokens can be bought anywhere and have very little crypo and so are easily replicated. The necessary key for the Premier/Diebold machines can be made with a palm pilot and a magnet. The machines are insecure in other ways too.
The Diebold machines' default password is diebold and as we all know defaults are rarely changed. Other vendors use a password that is derived from the serial code on the side of the machine. But really, it is even easier than that. There is a backdoor to the system that requires no password and provides root access. In test mode you can print out lots of ballots and run them through the machine to test the accuracy of the counting and recording. In voting mode the machine will reject these test ballots and will not count them.
However, you can turn off the 'voting mode' on the machine and it will count the test ballots as if they were valid. And then there is the social problem. The average age of poll workers is 75. These patriotic citizens are often not trained nor prepared for the multitude of issues involved in an electronic machine and the needed security. This means that very often the collection of votes is centralized at Deibold for a price. They will either come to you site to set up your machines and the vote count and tabulation. If you want to you send your electronic media to Deibold where they tabulate it.
This provides an opportunity for viral propagation of malicious code. Why? The servers that Diebold uses are Windows XP or Server 2000 and the vunerabilities in these systems are well know. This would provide an opportunity to control a large number of votes with no audit trail. In the process of this research Sandy presented the team's results to the vendors and there responses were that this is all academic.
Unfortunately their final recommendations is that the current electronic voting systems need to be scrapped as they are so insecure and so broken there is nothing to do to actually fix it. There is one person with a potential solution. In 460 lines of python code he's provided a pretty secure voting system, but that's just in his PhD thesis. End note: Ohio is suing Deibold because they found that when they uploaded the data to the central server they lost votes. Diebold says that that is a result of the regular anti-virus software running on the server. X |