bugtraq - RE: Diebold Global Election Management System (GEMS) Backdoor Account Allows Authenticated Users to Modify Votes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 22 Sep 2004 13:14:33 -0400
From: "Polazzo Justin" <Justin.Polazzo@...ilities.gatech.edu>
To: "Gene Cronk" <gcronk@...g.net>
Cc: <pressinfo@...bold.com>, <bugtraq@...urityfocus.com>
Subject: RE: Diebold Global Election Management System (GEMS) Backdoor    Account    Allows Authenticated Users to Modify Votes

If we don't have any data, then we are making decisions based on
propaganda, no matter what side you listen to.

Of course California suing then does raise questions :) Any state that
implements voting technology that has not been verified by independent
means needs rethink their approach. Any state could use the resources at
their disposal to evaluate these systems independently at a very low
cost, if any at all. (preferably by some local Tech school :)

Either way, without POC, how can we discuss this on bugtraq?

-JP

P.s.: 

Even though MS sux out of box, you can turn off the netlogon process on
any windows client, voiding any authentication to the local workstation.
The only authentication that can take place is server based, which can
then be further be restricted through policies and reghacks to kerberos
only. If you then delete the domain accounts as the card is used fears
of locally compromising the systems would be a non issue.

While I am pretty sure this has not been done, it illustrates why we
need to evaluate the code.