DIEBOLD VOTING MACHINE KEY COPIED FROM PHOTO AT COMPANY'S OW

DIEBOLD VOTING MACHINE KEY COPIED FROM PHOTO AT COMPANY'S OWN ONLINE STORE!

Princeton University Computer Scientists Confirm 'Secret' Key For Every Diebold Voting Machine 'Revealed' on Company Website!

[UPDATED THRICE] Shutting the Barn Door After Horse Has Left: Diebold Removes Photo, PLUS: Receives Certification for U.S. Homeland Security Contracts...NOW BAIT & SWITCH: Diebold Puts Digital Key Online Where Mechanical Key Was Previously!

Ed Note: Several important updates now added to the end of the story...

Good lord in heaven. How dumb are these guys at Diebold?! Can you believe the United States has actually entrusted them to build a security system for the original U.S. Constitution, the Declaration of Independence and the Bill of Rights?!

After everything else... now comes this.

It was revealed in the course of last summer's landmark virus hack of a Diebold touch-screen voting system at Princeton University that, incredibly, the company uses the same key to open every machine. It's also an easy key to buy at any office supply store since it's used for filing cabinets and hotel mini-bars! That is, if you're not a poll worker who already has one from the last time you worked on an election (anybody listening down there in San Diego?).

The Princeton Diebold Virus Hack, if you've been living in a cave, found that a single person with 60 seconds of unsupervised access to the system, who either picked the lock (easy in 10 seconds) or had a key, could slip a vote-swapping virus onto a single machine which could then undetectably affect every other machine in the county to steal an entire election.

But the folks at Princeton who discovered the hack (after our own organization, VelvetRevolution.us, gave them the Diebold touch-screen machine on which to perform their tests) had resisted showing exactly what the key looked like in order to hold on to some semblance of security for Diebold's Disposable Touch-Screen Voting Systems.

But guess what? Diebold didn't bother to even have that much common sense.

This idiotic company has had a photograph of the stupid key sitting on their own website's online store! (Screenshot at end of this article.)

Of course, they'll only sell such keys to "Diebold account holders" apparently --- or so they claim --- but that's hardly a problem. J. Alex Halderman, one of the folks who worked on the Princeton Hack and tried to keep the design of the key secret for obvious reasons, revealed Tuesday that a friend of his had found the photo of the key on Diebold's website and discovered that was all he needed to create a working copy!

As Halderman writes...


The shape of a key is like a password — it only provides security if you keep it secret from the bad guys.
...
Could an attacker create a working key from the [Diebold website] photograph? Ross [Kinard of SploitCast] decided to find out. Here’s what he did:

I bought three blank keys from Ace. Then a drill vise and three cabinet locks that used a different type of key from Lowes. I hoped that the spacing and depths on the cabinet locks’ keys would be similar to those on the voting machine key. With some files I had I then made three keys to look like the key in the picture.

Ross sent me his three homemade keys, and, amazingly, two of them can open the locks on the Diebold machine we used in our study!


Kinard's homemade key --- created only from the photo at Diebold's online store --- is seen opening the machine at Princeton in the video on the left. Unbelievable.

As to the "security" expected vis a vis these keys, Halderman points out that the key unlocks the compartment on each voting machine where one would slip a memory card containing a virus such as the one created at Princeton over the summer. Most jurisdictions use some form of "security tape" to deter and/or expose such an incident but, as both Halderman and history point out, that "security" provision is both easily defeated and often ignored by elections officials. Machines that have been breached in the past have been kept in service despite the breach, instead of removing them immediately as they should be. Such a "security mitigation procedure" --- if it were actually followed, of course --- means that one could also launch a "denial of service" attack simply by breaching the "security seals" of each machine and forcing it immediately offline. There would be nothing left to vote on.

As is, given the myriad known security vulnerabilities in all of Diebold's electronic voting systems (and those of all of its "competitors"), one might argue that there is already little left to vote on... if confidence in that vote being counted accurately is important to one's electoral system, in any case.

Diebold is the once-great American security company that helped kick off this entire e-voting debacle after it was discovered they left their "secure" source code for their unsecure voting machines sitting out on the net for anyone to download from a public FTP site in 2003. Later, in 2004, just prior to the Presidential Election, a branch of the U.S. Homeland Security Dept. issued a warning about the exploitable backdoor on the company's central e-vote tabulation system (subsequently ignored by all media except for The BRAD BLOG, natch). And if you couldn't figure out how to hack one of their systems from all of that alone, now they've given you the model to build your own key at home! Have fun, kids!

Anybody seen the U.S. Constitution lately? We know Bush hasn't. But other than that, seriously, maybe someone oughta check the National Archives just to be sure...

UPDATE 1:31pm PT: Closing the barn door after the horse has gone...
Diebold has now removed the photo of the keys from their online store. How they'll be removing it from Google archives and unringing the bell remains to be seen. Our screenshot of the page as it existed until this afternoon is still below.

All of which, of course, makes the following news even more disturbing than it would already be anyway (Hat-tip BRAD BLOG commenter PatGinSD):

Diebold, Incorporated (DBD - news), one of the nation's largest security integrators with expertise in the government, commercial, financial and retail markets, has solidified its homeland security presence. The company recently earned certification from the General Services Administration (GSA) to deliver security integration services that meet the requirements of the Homeland Security Presidential Directive 12 (HSPD-12).
FURTHER UPDATE 7:39pm PT: Diebold pulls a bait and switch...
In a classic Diebold bury-the-evidence move, they've now replaced the entire page in their online store featuring the mechanical, copyable key with a page featuring a "Smart Card, Security Key Card." A digital key card. Same link, different key entirely. Which can only be done, given the database they use for their online store, quite deliberately in order to try to fool folks again. Par for the course. And, of course, shameless.

The original page is still featured below. We screen-captured it originally for good reason: we know how this outfit works.

EVEN FURTHER UPDATE 1/25/07 5:36pm PT: Diebold responds...predictably and pathetically...
As they don't much like calling us back for some odd reason, we'll have to rely on CNet who picked up on the story this morning and received an amusing quote or two from accomplished Diebold spokesliar Mark Radke.

In a telephone interview, Diebold spokesman Mark Radke said the photograph had been removed because of the blogosphere buzz. He acknowledged that a single key can unlock every voting machine within a particular Diebold model but defended the decision.

"Can you imagine, if the wrong keys went to the wrong precincts the morning of the election, what would happen?" he asked.

We can imagine, Mark. People might have as much trouble voting and having their votes counted accurately as they already do with your machines. And as to that "blogosphere buzz" that caused them to remove the photo (not the fact that people could hack their machines because they posted the photo online), Radke says:

"These are people that don't have election experience making some of these comments," he said.
Whatever ya gotta tell yourself, chief. Say it enough and someone --- other than the Elections Officials who are in the same sinking ship with you because they bought your bullshit in the first place --- is bound to buy it.

Enough is enough. America needs a paper BALLOT --- not "trail" or "record" --- for every vote cast. Period. Click here to demand it from Congress!

============

A screenshot of the page from Diebold's online store, featuring a photo of the keys to the kingdom, follows below...

ADDENDUM: If you think the above is ridiculous, be sure to read about Sequoia Voting Systems' "Yellow Button" found on the back of every one of their touch-screen systems! Vote as many times as you like "until physically restrained from doing so!"

http://www.bradblog.com/?p=4066