Diebold thrown out of Florida by hacker

The Inquirer (A UK Tech Journal) ^ | December 20, 2005 | Nick Farrell

[ConservativeMind]

A FINNISH security expert has proved to the supervisor of elections in Leon County Florida that it is a doddle to hack Diebold voting machines.

Harri Hursti took part in a fake election in Leon County using what Diebold calls unhackable technology.

At the beginning of the test election the memory card programmed by Harri Hursti was inserted into an Optical Scan Diebold voting machine. Hursti had pre-loaded the memory card with plus and minus votes.

The eight ballots were run through the optical scan machine. Correct results should have been: Yes:2 ; No:6 However, just as Hursti had planned, the results tape read: Yes:7 ; No:1

To be fair to Diebold, the Hursti Hack requires a moderate level of inside access, however it does not require a password and it is the same level of access given thousands of poll workers across the USA.

More here.

[toddlintown]

Bush won.

[SierraWasp]

"Your question answers itself."

Then that makes it a good rhetorical question, right?

[calex59]

I agree, this is not hacking. How easy would it be for someone to break into a machine and then replace the card with a preprogrammed card. It wouldn't be easy and would require more than one person involved in the illegal act. These machines can be locked physically so only one person has access, and that person should be the repair personel. This is just another attempt by the dems to cast doubt on the Ohio elections.

If there is a doubt I say we go to the system we use in this county in CA. We mark a line to the person we want to vote for and it is scanned electronically. This is almost impossible to cheat on if you verify with voter ID and can easily be counted by hand also. If we are to continue with all paper ballots however, each state needs to pass laws that disallow votes "discovered" after the main count. Also, strong voter ID laws need to be passed.

[calex59]

This is the same system we use in some counties in CA, almost impossible to cheat on especially if followed up with voter ID checks. Simplicity is sometimes best!

[B4Ranch]

The way a cash register rolls off a numbered receipt for the buyer, the voting machine should duplicate it for the voter.

Keep the original with the voting officials and give the duplicate to the voter.

If there is any questions publish the original on the web and in a newspaper. The voter could locate their number and compare them.

If there is any differences, notarize the voters copy and surrender it to the officials for investigation.

[Prime Choice]

To be fair to Diebold, the Hursti Hack requires a moderate level of inside access...

Here's where we need to clearly define what "moderate" and "inside access" means. And once that's done, then we should identify who precisely has "a moderate level of inside access."

Until such time that this is done, this is all just so much FUD-mongering that the Leftists will use to bolster their idiotic claim of "we wuz robbed in 2004!"

[longtermmemmory]

I hate to say this but we need a national registered voter registry. We also need to have every death reported to this national registry.

The reason we need a national registry is that there are now many absentee voters who vote in more than one state. For example FL has found many NY/FL dual voters.

[ConservativeMind]

Beckwith, I hate to say this, but it doesn't matter if the ROM is an EPROM or not.

This Diebold computer has RAM, which was modified through the TELEPHONE CONNECTOR to let make it resolve a vote different from what was cast by the people.

There was no replacing of an internal BIOS or some other code on a chip. There was also apparently no access given to the Diebold program code, either. This was simply manipulated via a program on a device stuck into the phone port.

So get over your baseless debate. You are the one who brought in the concept of ROM/EPROM and it has nothing to do with that.

Yes, you are right that ROM cannot be changed without changing out that chip. But that has nothing to do with this exploit.

[pepperhead]

The reason we need a national registry is that there are now many absentee voters who vote in more than one state. For example FL has found many NY/FL dual voters.

Just imagine how many dual voters there is going to be from New Orleans.

[Feiny]

Exactly. Paper ballot elections got fixed as well with multiple voters & "stuffing the ballot box". Nothing is foolproof except maybe the townhall meeting style where everyone has a voice vote.

[Feiny]

But, that may lead to voter intimidation for those who speak up for the wrong candidate.

[maryz]

Then go back to paper ballots . . . ooops, Democrats don't like that either. Their voters have to actually think to vote.

I've read that Tip O'Neill stole his first election on paper ballots -- the people doing most of the counting were for him, and counted with bits of graphite under their fingernails to "correct" as many ballots as they could. ;-)

[ConservativeMind]

Okay, so I've gone into the report to find out the telephone port aspect of the exploit:

Page 5:

"Before each election, the Diebold central tabulator program, called “GEMS,” defines the races in the election. The optical scan machine is then connected to the GEMS server via an RS-232 serial port connection.

The removable storage (memory card) is placed into the optical scan machine, and GEMS writes information onto the memory card through the optical scan unit.

According to the Diebold optical scan user’s manual, the programming of the memory card can also be done remotely by modem connection over a public telephone network.(7) After the cards have been programmed, they are interchangeable among voting machines with the same or similar firmware version. Therefore a single machine can be used to program all cards needed."

Page 6:

"For removable storage, the AV OS (Diebold Accu-Vote Precinct-Based Optical Scan) that was tested by the author uses standard Epson RBC 40 -pin battery refreshed memory cards. Epson discontinued the product line in late 1998 or early 1999, but compatible cards are still available from third party suppliers. Diebold (then called Global Election Systems) also was forced to change their supplier.(8)

These memory cards can be read and written with any Epson RBC compatible device, like the Cropscan Model 92 DLC, which is commercially available from a Minnesota company, CROPSCAN, Inc.(9) The Cropscan unit was used by the author for this study."

There are other notes listed with the document, available here:

http://www.blackboxvoting.org/BBVreport.pdf

The systems can be remotely exploited via the phone port, essentially providing a remote flash BIOS upgrade, if you will. However, this exploit was apparently done with a compatible memory card, the Epson battery-backed up RAM/EPROM card (apparently similar to the lithium battery backup on our motherboards to keep the system BIOS and clock running the whole time the computers are off).

So I stand partially corrected and partially vindicated. The study, BearWash, was specific to the direct card exploit (although the phone ports exploit comes early in the report). It is not a device used on the telephone port, either, but this could be made.

However, it is literally not a EPROM alone, it is RAM (a minor justification).

In addition, the fact that these machines are programmed in any way like this prior to a vote is scary. There should only be the opportunity to feed it a data-only file for the races and no opportunity to write any votes or overwrite a program in the process.

Optical readers leave a paper trail that can be tabulated. These Diebold machines do not, as evidenced by the report and numerous news articles.

I hope this clarifies things. Beckwith, I apologize for the relevant parts of my comment. I needed to pour over the report BearWash pulled his information from to know the details.

[Beckwith]

Since you sign yourself ConservativeMind, I know we have much in common. But you evidently didn't carefully read the article (link) before posting the folowing:

This Diebold computer has RAM, which was modified through the TELEPHONE CONNECTOR to let make it resolve a vote different from what was cast by the people.

There was no replacing of an internal BIOS or some other code on a chip.

Acording to the article on BlackBoxVoting.org, an organization that does not post a mission statement but is opposed to electronic voting, the memory card was, in fact, physically changed by Hursti. The following is from BackBoxVoting.org

"At the beginning of the test election the memory card programmed by Harri Hursti was inserted into an Optical Scan Diebold voting machine."

In the original article there is no reference to a "TELEPHONE CONNECTOR." However, there is the statement, "Hursti has found evidence that the memory card can be reprogrammed without disturbing the seal by using a telephone modem port on the back of the machine."

It does not say that he did the hack via this route. It says he "found evidence" it could be done. The article doesn't describe this "evidence" or how it could be done. It does clearly say that he changed chips. The liberals running this site are playing with words.

Now, my point had lttle to do with the technology. My point was the fact that the demonstration itself was bogus and conducted by the fools who have been trying to prove they were jobbed in 2000. These guys have an agenda and are right up there with Mary Mapes and Dan Rather.

Now, I don't know if the Diebold voting machine has a ROM, PROM or EPROM chip as its CPU. I am led to believe, in the interest of security, the CPU in the Diebold is read-only. If it's programmable, I'll stand down. But if it is read only, this entire demonstration is a bag job, conducted by democrats in the most democratic county in Florida.

Black Box Voting

By the way, if the machines do have read-only CPUs, the results can't be manipulated and the democrats hate that. They would prefer the paper ballots, like the military absentee ballots that were conveniently misplaced in the 47 Florida recounts.

Cheers!

[dvwjr]

no, No, NO!

The voter must NEVER be allowed to leave the polling location with any physical proof of how they just voted. That takes us back to the days when political party 'block captains' would ensure that you voted the 'correct' way to gain the favors of those who were (and wished to remain) in political power.

"Hey there, Bob. Let's just get a quick copy of your ballot receipt, just in case there are any election problems, this will help our party prove its case in court... Glad to see you support our party candidates across the board, this is democracy in action. By the way I've heard from the Representatives staff that that your zoning variance will be granted next week..."

It also makes it easy to make election a 'joke' as in any close election just tell everyone to bring their 'notarized' copy in to confirm the winner of the very close election. So I guess that if someone misplaces their copy of their vote(s) then they are just out of luck?

Optical scan, or electronic voting with self-contained paper backup is just fine. Pure DRE with no paper backup is an invitation to future fraud...


dvwjr

[B4Ranch]

The answer is, "You've already got a copy. As a matter of fact, you've got the original."

[wildbill]

I agree that there probably wasn't any election fraud. This is just liberal whining because they think they should win every election. If they don't, they wuz robbed.

What's funny is that the Liberals were the ones who raised all the hell about bringing new technology into the process after the 2000 election to prevent the Evil Bushies from stealing the next election.

[steve86]

I have to admit it has always seemed odd that PROM or EPROM or EEPROM has the acronym ROM in it.

[B-Chan]

Paper ballots + purple fingers = no more election-day controversy.

[B-Chan]

We use an identical system here in Texas.