Diebold Voting Machines Vulnerable to Virus Attack

An analysis of Diebold's source code shows that a hacker with access to a single voting machine could use a virus to affect an election.

Sumner Lemon, IDG News Service
Thursday, August 02, 2007 11:00 PM PDT
Source: http://www.pcworld.com/article/id,135461-c,techindustrytrends/article.html

Diebold Election Systems Inc. voting machines are not secure enough to guarantee a trustworthy election, and an attacker with access to a single machine could disrupt or change the outcome of an election using viruses, according to a review of Diebold's source code.

"The software contains serious design flaws that have led directly to specific vulnerabilities that attackers could exploit to affect election outcomes," read the University of California at Berkeley report, commissioned by the California Secretary of State as part of a two-month "top-to-bottom" review of electronic voting systems certified for use in California.
The assessment of Diebold's source code revealed an attacker needs only limited access to compromise an election.

"An attack could plausibly be accomplished by a single skilled individual with temporary access to a single voting machine. The damage could be extensive -- malicious code could spread to every voting machine in polling places and to county election servers," it said.
The report, titled "Source Code Review of the Diebold Voting System," was apparently released Thursday, just one day before California Secretary of State Debra Bowen is to decide which machines are certified for use in California's 2008 presidential primary elections.

The source-code review identified four main weaknesses in Diebold's software, including: vulnerabilities that allow an attacker to install malware on the machines, a failure to guarantee the secrecy of ballots, a lack of controls to prevent election workers from tampering with ballots and results, and susceptibility to viruses that could allow attackers to an influence an election.
"A virus could allow an attacker who only had access to a few machines or memory cards, or possibly to only one, to spread malicious software to most, if not all, of a county's voting machines," the report said. "Thus, large-scale election fraud in the Diebold system does not necessarily require physical access to a large number of voting machines."

The report warned that a paper trail of votes cast is not sufficient to guarantee the integrity of an election using the machines. "Malicious code might be able to subtly influence close elections, and it could disrupt elections by causing widespread equipment failure on election day," it said.
The source-code review went on to warn that commercial antivirus scanners do not offer adequate protection for the voting machines. "They are not designed to detect virally propagating malicious code that targets voting equipment and voting software," it said.

In conclusion, the report said Diebold's voting machines had not been designed with security as a priority. "For this reason, the safest way to repair the Diebold system is to reengineer it so that it is secure by design," it said.

The Diebold source-code review and several other documents, including a review of source code used in other voting systems, had earlier been withheld from release by the Secretary of State, even as other reports related to the review of voting machines were released on July 27.
An explanation posted on the Secretary of State's Web site on July 27 noted the source-code review and other reports had been submitted on time. "Their reports will be posted as soon as the Secretary of State ensures the reports do not inadvertently disclose security-sensitive information," the Web site said.

The delayed release of the source-code review meant that David Wagner, an associate professor of computer science at the University of California at Berkeley and an author of the report, was not able to present his findings at a public hearing held on July 30 to discuss the results of the voting system review.

SMC-RP STUNS AMERICAN DEFENDING CHAMPS IN JONES CUP OPENER

Alapag, Caguioa preside over dizzying finish in day’s biggest surprise
Monday, 02 July 2007
Source: http://www.pba.ph/content/view/1687/59/

CHINESE TAIPEI - IT may be a mere preparation tournament for San Miguel-Pilipinas but the desire to win was very much evident for the Filipinos who sent a clear message to the field by stinging defending champion Athletes in Action of the USA, 72-67 in the opening match of the 29th William Jones Cup Basketball Tournament Monday night at the Sinjhuang Gym here.
Trailing by five, 52-57 going into the last 5:14 of the contest, SMC-RP got the lift it needed from Jimmy Alapag, who keyed a telling 8-0 run by banging in a triple. Mick Pennisi followed suit with another howitzer and Kerby Raymundo scored on a curling layup to push the Filipinos ahead, 60-57.

After Reed Rawling responded for the Americans, Alapag rifled in his fourth triple of the match, and then Mark Caguioa finally got going by scoring the last nine points for San Miguel-Pilipinas, which definitely sent shock waves not only to AIA but to the eight other teams entered in the 9-day meet.

"Jimmy bailed us out big time and Mark finished the job for us," said National coach Chot Reyes.
Alapag finished the contest with 19 points.
San Miguel-Pilipinas put together a 12-0 run ending the second quarter to erect a 39-31 advantage at the halftime break.

But the Filipinos were held to only six points on three free throws and a three-point shot by Dondon Hontiveros in the third peiord as the Ameicans seized the upperhand, 46-45, at the end of the third period.

In the other opening day matches, Korea nipped Qatar, 70-69; Jordan won over Kazakhstan, 63-61; and Lebanon beat Iran, 80-71.

Lebanon and San Miguel-Pilipinas mix it up at 5:30 pm Tuesday, both squads seeking a second straight win and tournament leadership.

While Lebanon does not present an immediate threat as far as the Philippines' dreams of returning to the Olympics is concerned, Reyes says there is a need to scout the Lebanese well and take a good hard look at them.

"There's a good possibility of us meeting the Lebanese in the quarterfinals of the FIBA-Asia Men's Championship in Tokushima, Japan. If we finish second in Group A, I'm sure we'll face Lebanon in the quarterfinals," said Reyes.

"Napakaswerte ng Lebanon kasi ang Group B ang pinakamadaling group. Siguradong sila ang magiging top team ng Group B. Tayo dadaan sa butas ng karayom sa Group A"
The Philippines is bracketed in what some experts describe as "The Group of Death" as Group A has powerhouse China, Iran and Jordan. "Walang panapon sa Group A. Kung mayroon man, baka tayo iyon considering that we only started preparing last March 12."
"We've played Lebanon a couple of times and we've fared well against them. We've in fact beaten them. They will also take part in the Manila Invitationals," said Reyes. “But who knows, baka pati sila nagtatago ng baraha?"

The Lebanese national team is reinforced by Joe Vogel and Brian Feghali, a pair of players who have seen action in American leagues.

What Reyes and San Miguel-Pilipinas are really preparing hard for are the games against Jordan on Friday and Iran on Saturday. Both have sent their respective national teams.
"Hindi naman sana tayo pupunta dito sa Jones Cup if organizers did not assure us that we'll be going up against the national teams of Iran and Jordan. This is a very good opportunity for us to gauge our strength and that of these two countries three weeks before Tokushima.," said Reyes.
Still, Reyes said he is torn between trying to hide his cards in the Jones Cup joust and the public perception.

"While this is just part of our preparation for Tokushima, kailangan din nating manalo dito. Realistically,we're eyeing a top four finish. Pero alam ninyo na kapag natalo tayo dito, marami na namang genius ang lalabas sa Pilipinas at magtatanong kung bakit nagkaganoon ang campaign sa Jones Cup. We have to strike a balance."

The Scores:

SMC-RP 72 - Alapag 19, Caguoa 14, Pennisi 11, Hontiveros 11, Norwood 7, Taulava 5, Raymundo 5, de Ocampo 0, Helterbrand 0, Williams 0, Canaleta 0.

AIA-USA 67 - Hendley 11, Gibson 10, Wilkerson 10, Rawlings 9, Sloan 8, T. Pollitz 6, Nichols 5, Ruoff 5, E.Pollits 2, Hammonds 1, Harris 0, Asbury 0.

Quarters: 21-25; 39-31; 45-46; 72-67.