OK, so the monkey has to actually get to the vote tabulating machine, but inside the article has somewhat more disturbing news about the GEMS program that handles the tabulation of votes:
GEMS requires users to enter a password to access the vote totals, but Harris showed that the totals can also be opened -- and altered -- with Access, without ever running GEMS.
If you are familiar with Access and how it is used and misused, then you know that the developer of this system did not even use the incredibly hackable Access security on this application. While there are password crackers aplenty for Access user security (a Google search for "Jet Security Crack" shows about 83,000 results), Diebold did not even use that! They rely on the application security only, ignoring even the most basic of security offered by the database system they are using.
A Maryland Election official is also quoted:
But Maryland election officials agreed with Bear that no hacking can happen unless the hacker is physically at the computer.
This sort of thinking makes my head explode! Of course you need to have access to the machine. And no one in the Board of Elections has any possible interest in the outcome of an election, right? And all Board of Election workers are aware of the need to watch these machines, right? Yea, right. Anyone besides me want to pick up a copy of the .NET Developer's Guide to Security by Keith Brown and mail it to the software development group at Diebold? I am reading it now, and there is an execellent section on Defense in Depth, as well as Countermeasures that would hopefully bring the developers to their senses. Is there any Diebold software developer out there that can defend deploying an election database without at least using all the security tools provided by the database system? How about defending use of Access rather than MSDE or some other more secure database?
I have long opposed licensing for Software Developers, however, I think that situations like this, where the scary bad programmers we often have living in the next cubicle are actually the ones controlling the election, perhaps the time has come, at least for elections, clinical applications and other government threatening or life threatening systems.
Previous Topic
