Designed for "Failure"? Discovery of Diebold's Bugs & Cryptographic Key

[nicknameless]

http://www.latimes.com/business/la-fi-golden23feb23,1,985280.column?ctrack=1&cset=true

Integrity of E-Balloting System Still in Doubt

Michael Hiltzik
Golden State

February 23, 2006

.... But the experts were plainly troubled by flaws in Diebold's systems. The panel, which included David Jefferson of Lawrence Livermore National Laboratory and David Wagner of Berkeley, observed that the removable memory cards used by Diebold were vulnerable to undetectable acts of tampering.

The panel found 16 software bugs that could cede "complete control" of the system to hackers who might then "change vote totals, modify reports, change the names of candidates, change the races being voted on," and even crash the machines, bringing an election to a halt. Hackers wouldn't need to know passwords or cryptographic keys, or have access to any other part of the system, to do their dirty work. Voters, candidates and election monitors wouldn't necessarily know they'd been rooked.

<snip>

The bugs pale next to another discovery by the panel. This is the presence of a cryptographic key written into the source code, or basic software, of every Diebold touch-screen machine in the country. The researchers called this blunder tantamount to "a bank using the same PIN code for every ATM card they issued; if this PIN code ever became known, the exposure could be tremendous."

Here's the punch line: The Diebold key became known in 2003, when it was published by researchers at Johns Hopkins and Rice universities. It can be found today via a Google search. What's worse, the key was first identified in 1997 by a University of Iowa researcher, who promptly warned the manufacturer of the flaw, apparently to no avail.

<snip>

The Berkeley panel says there may be other undetected flaws lurking in the Diebold software, which indicates that electronic voting isn't yet ready for Election Day. "We know we're going to have a loser in the next election, and that loser may not be convinced he or she has lost," says Avi Rubin, a Johns Hopkins professor who co-authored the 2003 paper. "We don't need to give people another reason to doubt an election."

Well no wonder McPherson recertified this crap. :eyes: