] Eight security experts held a Red Team exercise on
] January 19, using a GEMS server and six AccuVote-TS
] terminals, replicating an election scenario with no prior
] knowledge of source code. As suggested by the earlier,
] Hopkins report, the team quickly guessed the hardcoded
] passwords to administrator and voter smart cards. At a
] cost of less than $750, they were able to reset voter
] cards to allow multiple votes with the same card and
] suggested similar abuses with forged supervisor and voter
] cards. All 32,000 statewide terminal locks are identical,
] and the team picked them in less than 10 seconds,
] allowing physical access to the PCMCIA bay, which
] contains cards for the modem and the ballot definitions
] and results. These cards could be tampered with,
] destroyed, or stolen for their valuable data. Attaching a
] keyboard to the terminals allowed resetting of all
] counters in the PCMCIA bay without an administrator card
] needed.
]
] The server was missing over 15 Microsoft security
] updates, and the team was able to use the flaws used by
] the "Blaster" worm. By using insecure USB ports or more
] secure CD drives, the team was able to modify results and
] databases

LawMeme - Voting Machines Compromised in Election Simulation