bugtraq - Re: Diebold Global Election Management System (GEMS) Backdoor Account Allows Authenticated Users to Modify Votes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 29 Sep 2004 12:39:10 +0200
From: Casper Dik <casper@...land.sun.com>
To: Matthew Keller <mgkeller@...rs.sourceforge.net>
Cc: Nicholas Knight <nknight@...awaynet.com>,
	bugtraq@...urityfocus.com
Subject: Re: Diebold Global Election Management System (GEMS) Backdoor Account Allows Authenticated Users to Modify Votes

>On Sun, 2004-09-26 at 13:16, Nicholas Knight wrote:
>> Unrealistic? It is a *voting system*! It does exactly *one* *very*
>> *simple* thing! If it cannot do it bug-free, its developers are
>> incompetent and should not be allowed anywhere near a compiler, much 
>> less the key to democracy.
>
>Thank you. This is the most rational post I've seen. 
>
>if(VoteForBush) { bush++; }
>elseif(VoteForKerry) { kerry++; }
>elseif(VoteForNader) { nader++; }
>
>Is not tough. Diebold's refusal to allow the world to see that is highly
>suspicious. I suppose I'll get sued under the DMCA for posting their
>intellectual property now... Or maybe I have to change line 2 to:
>elseif(VoteForKerry) { bush++; } first... There, let the lawsuits rain

You are underestimating the compexity of the system.

Surely a touch screen is involved or some other device and
an operating systems.

Surely it's just a minor matter of programming of either the

	touchscreen
	window system
	OS

to recognize a voting screen and redirect the input
events to different buttons.

A touch screen can do this by sending wrong coordinates
and then fake output.

A window system can do this by sending the even to the
wrong button and doing some I/O substitution.

All a minor matter of programming.

And as other have said; as an ordinary voter you have to
trust people who verified the voting system unless you
get a paper copy of your ballot which you can put in the backup
bin.

Casper