Major flaws found in Diebold electronic voting kiosks

Well, I've said it before and I'll say it again: I wouldn't trust my vote to a Diebold electronic kiosk. This latest flaw in their self-service technology looks to be the most serious yet, with the potential to compromise every vote cast on the machine after just a few minutes of tinkering. according to this press release from the Open Voting Foundation (which admittedly has had Diebold in their sights for quite some time now):

“This may be the worst security flaw we have seen in touch screen voting machines,” says Open Voting Foundation president, Alan Dechert. Upon examining the inner workings of one of the most popular paperless touch screen voting machines used in public elections in the United States, it has been determined that with the flip of a single switch inside, the machine can behave in a completely different manner compared to the tested and certified version.

The most serious issue is the ability to choose between "EPROM" and "FLASH" boot configurations. Both of these memory sources are present. All of the switches in question (JP2, JP3, JP8, SW2 and SW4) are physically present on the board. It is clear that this system can ship with live boot profiles in two locations, and switching back and forth could change literally everything regarding how the machine works and counts votes. This could be done before or after the so-called "Logic And Accuracy Tests".

A third possible profile could be field-added in minutes and selected in the "external flash" memory location, the interface for which is present on the motherboard.

Now of course, an attacker would have to have physical access to the machines for some period of time, but given the relatively lax security precautions at many municipal voting locations, I don't think we need to stretch our imaginations too far to see that as a possibility.