How to Steal an Election by Hacking the Vote - repo.zenk-securit...

More documents

Recommendations

Info

http://arstechnica.com/articles/culture/evoting.ars the accumulator and every other machine on the network, tainting all of the results for that precinct. And if those machines are networked wirelessly(!!), then a fraudster with a laptop and a wireless card in a car outside the precinct building could conceivably have his way with all of the votes in the building. Cracking the central tabulation (GEMS) server The GEMs server deserves special attention as a weak point in the design of the overall system. This server is a typical PC with a typical PC software stack. In fact, I could conceivably reuse my depiction of the AccuVote TS software stack in Figure 6 by replacing "Windows CE" with "Windows XP," "System Software" with "GEMS," and "BDF" with "GEMS database." The GEMS database stores all of the votes collected from precinct accumulators, and it's used to do the vote tabulation for a county. Because it's so sensitive, you might think it would be tightly secured. But you'd be wrong. The GEMS database is a vanilla, unencrypted Access database that anyone with a copy of Microsoft Access can edit. So if you have physical access to the GEMS server's filesystem (either locally or remotely), then it's not too hard to just go in and have your way with the vote totals. If Access isn't installed, just install it from a CD-ROM, or connect remotely from a laptop and edit the database that way. Or, if you want to filch the database, upload vote-stealing software, or do something else evil, you could always carry along a USB drive in your pocket. Many GEMS servers are connected to a modem bank, so that the accumulators can dial in over the phone lines and upload votes. One team of security consultants hired by the state of Maryland found the GEMS bank by wardialing, discovered that it was running an unpatched version of Windows, cracked the server, and stole the mock election. This great Daily Show segment, in which one of the team members describes the attack, states that they did this in under five minutes. If the GEMS server is somehow connected to the Internet, and some of them are (in spite of Diebold's strong recommendation that they not be), then any one of a billion script kiddies who can crack a Windows box can have a field day with the election... I could go on here with the hypotheticals, but let's take a look at how this is alleged to have played out in the real world, this past August in Shelby County, Tennessee: Evidence from election official declarations and discovery documents obtained in litigation over a recent election using Diebold machines reveals that: • Illegal and uncertified Lexar Jump Drive software was loaded onto the Diebold GEMS central tabulator, enabling secretive data transfer on small USB "key chain" memory devices. This blocked election transparency and raises questions as to whether hidden vote manipulation may have taken place. • Other uncertified software of various kinds was loaded onto the system and, according to the event logs examined, was used. This opened the door for hand- Copyright © 1998-2006 Ars Technica, LLC 16
http://arstechnica.com/articles/culture/evoting.ars editing of both vote totals and the reporting of election results. • Evidence of actual attempts to manipulate election reporting results exists. The evidence available wouldn't record successful manipulation, only attempted manipulation, due to software failure. The logs show repeated failed attempts to use an HTML editor. • According to Shelby County elections officials, they opened the central vote totals repository to widespread network connections. The dispersed nature of access to the central tabulator would prevent finding the perpetrators, even if documentation of manipulation could be achieved -- a difficult feat, since the type of hacking enabled by the GEMS program tends to erase evidence. In an on-site inspection of the network connections conducted by Jim March, elections department lead computer operator Dennis Boyce pointed to a location on a network interconnection plug panel where the Dieboldsupplied GEMS central tabulator is plugged in. No extra security such as a router or firewall was present at the interconnection. This appears to open up access by anybody in county government to the central tabulator. • At the same on-site inspection, the Diebold-supplied GEMS backup central tabulator had more uncertified software than could be quickly documented Ð but observers did spot Symantec's PC Anywhere utility. This program would allow opening the machine to outside remote control - the PC Anywhere program allows a remote computer across a dial-up or networked connection to see the screen of the "zombied" computer and operate it's keyboard and mouse. To call this a security breach is an understatement. • At the primary GEMS central tabulator station, all of MS- Office 2000 Professional was loaded and working. According to Windows, MS-Access was a frequently used program, the only component of the overall MS-Office suite that was so identified. Note that I haven't done any journalistic due diligence on this particular report, so I'm obliged not to vouch for its absolute veracity. But my point in reproducing it is that every one of these items is 100 percent plausible, so this incident report paints an extremely realistic portrait of how the GEMS server could be compromised to steal an election. Finally, before I leave this topic, I want to raise the possibility that a DRE manufacturer could include an undocumented back door in the GEMS server that would leave the machine open to manipulation and fraud. Of course, it may be more than just a possibility. Such a back door has allegedly already been found, as referenced in this CERT bulletin. However, the details here are sketchy, and one researcher that I've talked to says the credibility of this report is suspect. Also, I'm going to give Diebold the benefit of the doubt and assume that this back door (if it exists) was put there for maintennance and/or testing reasons, and that it was never intended to be enabled on a production build of the software. Copyright © 1998-2006 Ars Technica, LLC 17
Page 1 and 2: http://arstechnica.com/articles/cul
Page 11 and 12: 3 http://arstechnica.com/articles/c
Page 15: 1 2 3 http://arstechnica.com/articl
Page 19 and 20: Voters Votes http://arstechnica.com
Page 23 and 24: Postscript http://arstechnica.com/a
Page 27: Inside the Machine An Illustrated I

How to Steal an Election by Hacking the Vote - repo.zenk-securit...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?