Diebold Doesn't Get It
The latest flaw in the Diebold voting machines allows someone with malicious intenet to pwn a voting machine when left alone with it for a very short period of time. This "feature" is allegedly there to allow election officials to update the voting machines easily and potentialy an evil elections person could compromise a voting machine. A Diebold representative David Bear claims that "I don't believe these evil elections people exist."
WHAT?
Evil people exist everywhere, including elections officials I'm sure.
Oh yeah, and threat model? Remember it only takes a few moments to exploit a voting machien when left alone with it. Elections officials are the only ones left alone with the machines - remember those folks that go behind a little curtain alone for a few minutes with the voting machine? Yeah, they are called voters, and there are MILLIONS of them. Surely none of those millions of individuals have any evil intent, or would want to compromise an election.
Talk about missing the frigging boat on who the threats are. Hey Diebold, get your collective heads out of your asses and take the advice of the security people auditing your systems.
- L
This quote sums up nicely why Diebold should not be trusted to secure election machines:
David Bear, a spokesman for Diebold Election Systems, said the potential risk existed because the company's technicians had intentionally built the machines in such a way that election officials would be able to update their systems in years ahead."For there to be a problem here, you're basically assuming a premise where you have some evil and nefarious election officials who would sneak in and introduce a piece of software," he said. "I don't believe these evil elections people exist."
If you can't get the threat model right, you can't hope to secure the system.