When security researchers report on the ghastly defects in voting machines, the officials who bought these machines say dismiss their concerns by saying that the tamper-evident seals they put around the machines prevent bad guys from gaining access to their internals.
But University of Michigan grad student Matt Bernhard has demonstrated that he can bypass the tamper-evident seals in seconds, using a shim made from a slice of a soda can. The bypass is undetectable and doesn’t damage the seal, which can be resecured after an attacker gains access to the system.
Fred Woodhams from the Michigan Secretary of State’s office dismissed Bernhard’s warning: “the seal that is shown in the video was not affixed to anything, and the video does not represent a real-world scenario of how seals are used and affixed.”
“The seal that is shown in the video was not affixed to anything, and the video does not represent a real-world scenario of how seals are used and affixed,” spokesman Fred Woodhams said in an email to Motherboard. “The video also provides no context about the sum total of security measures for tabulators and sealed ballot containers, which are stored in locked area within a clerk’s office, among other security measures that help prevent election tampering. I would note that the sealed ballot containers store ballots that already have been counted.”
Bernhard, however, said that although voting machines may be locked when they are stored in the county clerk’s building, they are left unattended for days at polling places—high school gyms, churches, and community centers—prior to elections. Often times they’re left out in the open or in rooms that don’t have locks. Even when they are stored in rooms that have locks, those locks can be defeated as easily as the seals. And although some of these facilities may also be monitored by surveillance cameras, cameras can be defeated as well he notes.
“Seals [and ties] make machines a little bit more secure because attackers have to do a little more work [to get to the machines],” he said, but not much. Even more advanced tags made from steel can be defeated, though it might take a little longer to do so. “It takes 5 minutes vs, 20 seconds [for the plastic ones],” he said.
Security Seals Used to Protect Voting Machines Can Be Easily Opened With Shim Crafted from a Soda Can [Kim Zetter/Motherboard]