...using the Diebold AccuVote-TS voting machine or others like it
Researchers at Princeton University have released a new "Security Analysis
of the Diebold AccuVote-TS Voting Machine," which finds many possibilities
for election fraud in these particular voting machines. Their report also recognizes
that similar problems likely exist with other direct recording electronic (DRE)
voting machines, saying, "Simply put, many computer scientists doubt that
paperless DREs can be made reliable and secure, and they expect that any failures
of such systems would likely go undetected."
Here is a direct quotation from this report, describing some of the ways by
which the next election could be stolen (most footnotes removed) . . .
2.2 Injecting Attack Code
"To carry out these attacks, the attacker must somehow install his malicious
software on one or more voting machines. If he can get physical access to a
machine for as little as one minute, he can install the software manually. The
attacker can also install a voting machine virus that spreads to other machines,
allowing him to commit widespread fraud even if he only has physical access
to one machine or memory card."
2.2.1 Direct Installation
"An attacker with physical access to a machine would have least three
methods of installing malicious software. The first is to create an EPROM chip
containing a program that will install the attack code into the machine's flash
memory, and then to open the machine, install the chip on its motherboard, and
reboot from the EPROM.
"The second method is to exploit a back door feature in Diebold's code
to manually install the attack files from a memory card. When the machine boots,
it checks whether a file named explorer.glb exists on the removable memory card.
If such a file is present, the machine boots into Windows Explorer rather than
Diebold's BallotStation election software. An attacker could insert a memory
card containing this file, reboot the machine, and then use Explorer to copy
the attack files onto the machine or run them directly from the card.
"The third method exploits a service feature of the machine's bootloader.
On startup, the machine checks the removable memory card for a file named fboot.nb0.
If this file exists, the machine replaces the bootloader code in its onboard
flash memory with the file's contents. An attacker could program a malicious
bootloader, store it on a memory card as fboot.nb0, and reboot the machine with
this card inserted, causing the Diebold bootloader to install the malicious
software. (A similar method would create a malicious operating system image.)
"The first method requires the attacker to remove several screws and lift
off the top of the machine to get access to the motherboard and EPROM. The other
methods only require access to the memory card slot and power button, which
are both behind a locked door on the side of the machine. The lock is easily
picked -- one member of our group, who has modest locksmithing skills, can pick
the lock consistently in less than 10 seconds. Alternatively, this slot can
be reached by removing screws and opening the machine. Some attackers will have
access to keys that can open the lock -- all AccuVote-TS machines in certain
states use identical keys, there are thousands of keys in existence, and these
keys can be copied at a hardware or lock store.
"A poll worker, election official, technician, or other person who had
private access to a machine for as little as one minute could use these methods
without detection. Poll workers often do have such access; for instance, in
a widespread practice called 'sleepovers,' machines are sent home with poll
workers the night before the election."
2.2.2 Voting Machine Viruses
"Rather than injecting code into each machine directly, an attacker could
create a computer virus that would spread from one voting machine to another.
Once installed on a single 'seed' machine, the virus would spread to other machines
by methods described below, allowing an attacker with physical access to one
machine (or card) to infect a potentially large population of machines. The
virus could be programmed to install malicious software, such as a vote-stealing
program or denial-of-service attack, on every machine it infected.
"When the machine is rebooted, it normally emits a musical chime that
might be noticed during a stealth attack; but this sound can be suppressed by
plugging headphones (or just a headphone connector) into the machine's headphone
"To prove that this is possible, we constructed a demonstration virus
that spreads itself automatically from machine to machine, installing our demonstration
vote-stealing software on each infected system. Our demonstration virus, described
in Section 4.3, can infect machines and memory cards. An infected machine will
infect any memory card that is inserted into it. An infected memory card will
infect any machine that is powered up or rebooted with the memory card inserted.
Because cards are transferred between machines during vote counting and administrative
activities, the infected population will grow over time.
"Diebold delivers software upgrades to the machines via memory cards:
a technician inserts a memory card containing the updated code and then reboots
the machine, causing the bootloader to install the new code from the memory
card. This upgrade method relies on the correct functioning of the machine's
bootloader, which is supposed to copy the upgraded code from the memory card
into the machine's flash memory. But if the bootloader were already infected
by a virus, then the virus could make the bootloader behave differently. For
example, the bootloader could pretend to install the updates as expected but
instead secretly propagate the virus onto the memory card. If the technician
later used the same memory card to 'upgrade' other machines, he would in fact
be installing the virus on them. Our demonstration virus illustrates these spreading
"Memory cards are also transferred between machines in the process of
transmitting election definition files to voting machines before an election.
According to Diebold, 'Data is downloaded onto the [memory] cards using a few
[AccuVote] units, and then the stacks of [memory] cards are inserted into the
thousands of [AccuVote] terminals to be sent to the polling places.'
"If one of the few units that download the data is infected, it will transfer
the infection via the 'stacks of [memory] cards' into many voting machines."
You can download a complete copy of this report in PDF format by clicking
You can visit the report's main website at itpolicy.princeton.edu/voting.
Blessings to you. May God help us all.
Rev. Bill McGinnis is an Internet Christian minister,
writer and publisher. He is director of LoveAllPeople.org,
a small private think tank in Alexandria, Virginia, and all of its related websites,
His agenda is to help maximize the happiness and well-being of all people.
Read from Looking Glass News
prof hacks e-vote machine
Paper Trail Left Behind: The Theft of the 2004 Presidential Election
gun" evidence uncovered in Ohio of massive vote fraud in 2004 election
Stolen Election of 2004
Bush Rigged Ohio Election
They Stole Ohio And the GOP 4-step Recipe to "Blackwell" the USA in
the 2004 Election Stolen?
Call Diebold Security Flaw "Worst Ever"
To Steal an Election
in Florida:The Harri Hursti Hack and its Importance to our Nation
DIEBOLD INSIDER SPEAKS! DIEB-THROAT : 'Diebold System One of Greatest Threats
Democracy Has Ever Known'
vulnerabilities in Diebold Optical Scan
do Diebold's Touch-Screen Voting Machines Have Built-In Wireless Infrared Data
INTEGRITY" News Articles