Major Vulnerability Found in Diebold Election Machines.
This is a big deal:
Elections officials in several states are scrambling to understand and limit the risk from a “dangerous” security hole found in Diebold Election Systems Inc.'s ATM-like touch-screen voting machines.
The hole is considered more worrisome than most security problems discovered on modern voting machines, such as weak encryption, easily pickable locks and use of the same, weak password nationwide.
Armed with a little basic knowledge of Diebold voting systems and a standard component available at any computer store, someone with a minute or two of access to a Diebold touch screen could load virtually any software into the machine and disable it, redistribute votes or alter its performance in myriad ways.
“This one is worse than any of the others I've seen. It's more fundamental,” said Douglas Jones, a University of Iowa computer scientist and veteran voting-system examiner for the state of Iowa.
“In the other ones, we've been arguing about the security of the locks on the front door,” Jones said. “Now we find that there's no back door. This is the kind of thing where if the states don't get out in front of the hackers, there's a real threat.”
This newspaper is withholding some details of the vulnerability at the request of several elections officials and scientists, partly because exploiting it is so simple and the tools for doing so are widely available.
[…]
Scientists said Diebold appeared to have opened the hole by making it as easy as possible to upgrade the software inside its machines. The result, said Iowa's Jones, is a violation of federal voting system rules.
“All of us who have heard the technical details of this are really shocked. It defies reason that anyone who works with security would tolerate this design,” he said.
The immediate solution to this problem isn't a patch. What that article refers to is election officials ensuring that they are running the “trusted” build of the software done at the federal labs and stored at the NSRL, just in case someone installed something bad in the meantime.
This article compares the security of electronic voting machines with the security of electronic slot machines. (My essay on the security of elections and voting machines.)
EDITED TO ADD (5/11): The redacted report is available. [Schneier on Security]