Heh heh; US-CERT Cyber Security on GEMS :)

[The Straight Story]

Diebold

GEMS Central Tabulator 1.17.7, 1.18
A vulnerability exists due to an undocumented backdoor account, which could (allow? they missed a word here...) a local or remote authenticated malicious user modify votes.
No workaround or patch available at time of publishing.

We are not aware of any exploits for this vulnerability.

GEMS Central Tabulator Vote Database Vote Modification Medium BlackBoxVoting.org, August 31, 2004


http://www.uscert.gov/cas/bulletins/SB04-252.html#diebold

[MazeRat7]

1. DELETED

Details linked in post #6

MZr7

[Eloriel]

2. Wow -- question for you

what is this document? How is it used? How did you happen on it? And so forth. IOW: what am I reading? LOL.

[The Straight Story]

3. How

I do random searches on http://www.google.com/unclesam which can turn up all sorts of interesting things (and try things like keyword filetype:pdf for more fun).

I use these things at work and at home, as the document states: "This bulletin provides a summary of new or updated vulnerabilities, exploits, trends and viruses ".

It is a worthwhile site to bookmark if you are in the computer field.

[MazeRat7]

4. CERT tracks known security vulnerabilities

They are very well known by the players on both sides of the "security" game and are considered the "gold-standard" for tracking such issues.

MZr7

[The Straight Story]

5. Another interesting item as an example

Did a search on diebold harris and found http://www.ss.ca.gov/elections/vsp_min_071904.pdf
which is a meeting of the secretary of state in CA on July 19th on voting procedures. Lots of interesting things out there to read :)

[MazeRat7]

6. I think this explains it a bit better....

"http://www.ejfi.org/Voting/Voting-27.htm"

MZr7

[The Straight Story]

8. Indeed

It does explain it better, but I found it interesting that it showed up where it did :)

[Eloriel]

18. Yes, my interest wasn't an explanation of WHAT was found but

the document in the OP where the fault was listed. Oh well.

[ParanoidPat]

7. YEE HAAAAA!

WOW WOW WOW THIS IS BIG!!! :evilgrin:

I wonder if Bev and Andy know yet? :) :toast:

[MazeRat7]

9. If you mean Bev Harris, see link in post #6 (n/t)

[harmonyguy]

10. I think that Pat was.....

...referring to Bev or Andy knowing that the item made it to the CERT list. No?

Of course, not presuming to speak for Pat ;-)

[MazeRat7]

11. Good point. They may not know it made CERT status.... (n/t)

[ParanoidPat]

12. I know they are aware of the hack.....

......I was at the meeting in Sacramento with them. I have the video tapes to prove that they denied us the right to tape the demo or even take notes. :(

I just wonder if they know that US CERT has issued the advisory. The last line stating that they don't know of any exploits leads me to believe they need to talk to Dr. Hugh Thompson. I bet the threat level gets raised to high if they do. :)

[MazeRat7]

14. I would need to know more....

I have only followed this in a "detached" manner from /. and other sources. Based on what I read about in Bev's article (MS access, the dial-up connection, etc) I can't imagine generating an POC exploit would be all that hard. But again, I really don't have enough information to say for sure.

MZr7

[MazeRat7]

15. One other minor point...

When CERT talks about "known" exploits... they generally mean in the "wild" as in loose on the Internet. That is not to say there can't be POC (proof of concept) code that is locked up somewhere that demonstrated the vulnerability.

MZr7

[ParanoidPat]

16. We demonstrated the POC to members of the California VSP.....

.....(Voting Systems Panel) a couple of weeks ago. That demo lead to the Ca. AG joining the lawsuit in Alameda county against Diebold.

Stay tuned, this is going to get good! :evilgrin:

[ParanoidPat]

13. OOPS.....

......Computers! :shrug: :evilgrin:

[ParanoidPat]

17. We are 6 VBS lines away from a full blown electoral disaster.......

.....if and when those 6 lines of code are published on the Internet, all of this BS about the Diebold system's security will be blown wide open. The GEMS tabulation system will be useless.

Any bets on where and when it happens? :shrug: :evilgrin:

[Andy_Stephenson]

19. Pat don't do it

just say no.

:evilgrin:

[ParanoidPat]

20. Don't worry Andy......

.....My Moma raised an idiot, but she didn't raise no fool! :)