How to steal the next election using the Diebold AccuVote-TS voting machine or others like it
By Rev. Bill McGinnis
Online Journal Contributing Writer
Sep 15, 2006, 00:42
Researchers at Princeton University have released a new "Security
Analysis of the Diebold AccuVote-TS Voting Machine," which finds many
possibilities for election fraud in these particular voting machines. Their
report also recognizes that similar problems likely exist with other direct
recording electronic (DRE) voting machines, saying, "Simply put, many
computer scientists doubt that paperless DREs can be made reliable and secure,
and they expect that any failures of such systems would likely go
Here is a direct quotation from this report, describing some of the ways
by which the next election could be stolen (most footnotes removed) . . .
2.2 Injecting Attack Code
"To carry out these attacks, the attacker must somehow install his
malicious software on one or more voting machines. If he can get physical
access to a machine for as little as one minute, he can install the software
manually. The attacker can also install a voting machine virus that spreads to
other machines, allowing him to commit widespread fraud even if he only has
physical access to one machine or memory card."
2.2.1 Direct Installation
"An attacker with physical access to a machine would have least
three methods of installing malicious software. The first is to create an EPROM
chip containing a program that will install the attack code into the machine's
flash memory, and then to open the machine, install the chip on its
motherboard, and reboot from the EPROM.
"The second method is to exploit a back door feature in Diebold's
code to manually install the attack files from a memory card. When the machine
boots, it checks whether a file named explorer.glb exists on the removable
memory card. If such a file is present, the machine boots into Windows Explorer
rather than Diebold's BallotStation election software. An attacker could insert
a memory card containing this file, reboot the machine, and then use Explorer
to copy the attack files onto the machine or run them directly from the card.
"The third method exploits a service feature of the machine's
bootloader. On startup, the machine checks the removable memory card for a file
named fboot.nb0. If this file exists, the machine replaces the bootloader code
in its onboard flash memory with the file's contents. An attacker could program
a malicious bootloader, store it on a memory card as fboot.nb0, and reboot the
machine with this card inserted, causing the Diebold bootloader to install the
malicious software. (A similar method would create a malicious operating system
"The first method requires the attacker to remove several screws
and lift off the top of the machine to get access to the motherboard and EPROM.
The other methods only require access to the memory card slot and power button,
which are both behind a locked door on the side of the machine. The lock is
easily picked -- one member of our group, who has modest locksmithing skills,
can pick the lock consistently in less than 10 seconds. Alternatively, this
slot can be reached by removing screws and opening the machine. Some attackers
will have access to keys that can open the lock -- all AccuVote-TS machines in
certain states use identical keys, there are thousands of keys in existence,
and these keys can be copied at a hardware or lock store.
"A poll worker, election official, technician, or other person who
had private access to a machine for as little as one minute could use these
methods without detection. Poll workers often do have such access; for
instance, in a widespread practice called 'sleepovers,' machines are sent home
with poll workers the night before the election."
2.2.2 Voting Machine Viruses
"Rather than injecting code into each machine directly, an attacker
could create a computer virus that would spread from one voting machine to
another. Once installed on a single 'seed' machine, the virus would spread to
other machines by methods described below, allowing an attacker with physical
access to one machine (or card) to infect a potentially large population of
machines. The virus could be programmed to install malicious software, such as
a vote-stealing program or denial-of-service attack, on every machine it
"When the machine is rebooted, it normally emits a musical chime
that might be noticed during a stealth attack; but this sound can be suppressed
by plugging headphones (or just a headphone connector) into the machine's
"To prove that this is possible, we constructed a demonstration
virus that spreads itself automatically from machine to machine, installing our
demonstration vote-stealing software on each infected system. Our demonstration
virus, described in Section 4.3, can infect machines and memory cards. An
infected machine will infect any memory card that is inserted into it. An
infected memory card will infect any machine that is powered up or rebooted
with the memory card inserted. Because cards are transferred between machines
during vote counting and administrative activities, the infected population
will grow over time.
"Diebold delivers software upgrades to the machines via memory
cards: a technician inserts a memory card containing the updated code and then
reboots the machine, causing the bootloader to install the new code from the
memory card. This upgrade method relies on the correct functioning of the
machine's bootloader, which is supposed to copy the upgraded code from the memory
card into the machine's flash memory. But if the bootloader were already
infected by a virus, then the virus could make the bootloader behave
differently. For example, the bootloader could pretend to install the updates
as expected but instead secretly propagate the virus onto the memory card. If
the technician later used the same memory card to 'upgrade' other machines, he
would in fact be installing the virus on them. Our demonstration virus
illustrates these spreading techniques.
"Memory cards are also transferred between machines in the process
of transmitting election definition files to voting machines before an
election. According to Diebold, 'Data is downloaded onto the [memory] cards
using a few [AccuVote] units, and then the stacks of [memory] cards are
inserted into the thousands of [AccuVote] terminals to be sent to the polling
"If one of the few units that download the data is infected, it
will transfer the infection via the 'stacks of [memory] cards' into many voting
You can download a
complete copy of this report in PDF format by clicking here.
You can visit the
report's main website at itpolicy.princeton.edu/voting.
Blessings to you.
May God help us all.
Bill McGinnis is an Internet Christian minister, writer and publisher. He is
director of LoveAllPeople.org,
a small private think tank in Alexandria, Virginia, and all of its related
websites, including InternetChurchOfChrist.org, CommitteeForTheGoldenRule.org,
His agenda is to help maximize the happiness and well-being of all people.
Copyright © 1998-2006 Online Journal
Email Online Journal Editor