J030-Content-Bad-election-machine-gets-voted-down_SQElections the world over can be sketchy affairs. Claims of corruption and violence are all too common in certain regions of the world, even in supposedly democratic countries.

In the United States the issues are a bit more subtle and laws exist to make sure election rigging is kept at bay. And then there are the voting machines themselves. They have not had fault-free history. In fact, many believe that voting machines were the reason why George W. Bush beat Al Gore in 2000.

But those Florida machines with their suspect ballots have nothing on the machines used in Virginia recently. This machine is so old it still thinks Goldwater is running for the US presidency. Well, not that bad, but it was some 13-14 years old, still using Windows XP and hadn’t been patched in ages.

The AVS WinVote was the very definition of vulnerable, according to a blog post by Jeremy Epstein: ‘If an election was held using the AVS WinVote, and it wasn’t hacked, it was only because no one tried.”

He explained that the vulnerabilities were so severe and so easy to exploit that anyone with a bit of training could hack into the system. This could all have been done remotely from a safe few hundred meters away.  Epstein said that the system didn’t even have any logs or a simple procedure of record keeping that would show that the election was hacked. Epstein continued by saying that if in the past an election had been hacked we would be none the wiser since no records exist.

The machine really was the Swiss cheese of voting devices since it had so many obvious holes, and what’s worrying is that it might still be in use if it didn’t crash so much.

It gets worse. The wireless key was as simple as they get (it was ‘abcde’). The administrator password on the unit was, you guessed it (and so could a hacker) ‘admin’. The machine itself had gone over 10 years without a patch, and the USB ports could have been easily accessed and used to launch an attack.

Epstein explained how an attack could happen.

Take a seat in the parking lot outside the polling station. Capture data traffic using a free sniffer and find the WEP password. When you have that, connect to the machine over wi-fi. Once connected and if asked for a password, type in ‘admin’.

Then the scary part begins:

The next step is to download the Microsoft Access database using Windows Explorer. With a free tool extract the hardwired key. Then open Microsoft Access to add, delete, or change any of the votes in the database. The next step is to upload the modified copy of the Microsoft Access database back to the voting machine.

When all set and done, you just have to wait for the election results.

This is the crazy thing about security. Every day we learn that less important devices – like an iPod filled with 80’s junk – are locked up so tightly even a semi-experienced hacker would have trouble getting into them. Yet systems that should be bullet proof like voting machines and servers holding sensitive medical data and financial records, are too often weakly protected leaving them exposed.