E-voting systems hacker sees ‘particularly bad’ security issues

[swag]

via an informative post on Metafilter with other links

http://www.computerworld.com/securitytopics/security/hacking/story/0,10801,107881,00.html

Can you tell us about some of your e-voting machine hacking activities?

On Tuesday, Dec. 13, we conducted a hack of the Diebold AccuVote optical scan device. I wrote a five-line script in Visual Basic that would allow you to go into the central tabulator and change any vote total you wanted, leaving no logs. It requires physical access to a machine, which in many counties isn’t very difficult to get -- you have elections offices full of volunteers. In Leon County, they have good policies and procedures in place. But in many counties, where such awareness doesn’t exist, that brings up some serious concerns about someone being able to tamper with the results.

Harri Hursti changed the contents of a memory card used in the optical scan device and preloaded it. During the procedure, it will tell you there are no votes on the card, but there is executable content on it. If you can get access to the memory card, you can change its logic and have it do whatever you want -- even print a smiley face. That hack was like prestuffing a ballot box to handicap one candidate by giving them negative votes and giving another positive ones.

[tofubo]

1. to hell with e-voting, if your state allows, vote absentee n/t