See your link here
One key to rule them all!
7 comments- IT TOPICS:Government & Regulation, Security
Yesterday fellow CW blogger, Angela Gunn, pointed out the stupidity of Diebold for putting a picture of the key to their DRE voting machines online. But I think she missed out on the true depth of their ignorance of basic security concepts: they're using one key to open every e-voting machine they manufacture. That's right, if you have a key from a voting system in your local district then you can easily open Accuvote machines anywhere. It makes it much easier if you happen to lose your key, but it also makes it much easier if you want to get access to those oh-so-important memory cards in the machines. You know, the memory cards that hold every vote the system records.
Publishing the picture of the key is a relatively minor faux pas compared to using a single key for all systems. Especially considering the same key that opens minibars and jukeboxes opens Diebold machines. Apparently the security of our votes is no more important to Diebold than a cold drink at Holiday Inn or the CD library at the local pizza joint (Side question: do these machines still use CD's or are they using MP3's now?). Of course, even if the keys were different, it only takes a couple of seconds to pick the lock anyways, so why even bother having a lock?
Diebold has taken down the picture. Which is sooo effective, given that there are videos of the hacked keys and copies of the original photograph all over the Internet. And let's not forget little things like the Wayback Machine, which probably has a copy of the picture if you're willing to dig for it. So taking down the original photo is worse than useless now. It's not like Ross Kincaid at Sploitcast didn't give them weeks of notice before the story broke.
If Diebold actually had a clue, each device would have a unique key that was tied to the serial number of the system. Or a combination, again tied to the serial number, so that it would be easier to look up if the key was lost. Even making the districts buy small padlocks themselves would have been better. But by using a single key on all machines, they've once again demonstrated a utter lack of understanding of the basics of security. The folks at the local storage locker company have a better grasp on physical security than Diebold does. And these are the people we're trusting to safeguard our democracy? You may trust them, but I think they're idiots. Rumor has it that Diebold is thinking about getting out of the e-voting business; I'm hoping the rumors are true.
Print
Email this
Digg this
