We try to have constructive criticism when it comes to security in
general and voting computers in particular. But it is not easy. The
Nedaps simply do not offer any protection and can not ever be secured
if you ask me. When I wrote about the lousy locks that are used to
secure our Dutch Nedap voting computers I felt the need to at least
give them some advice on locks, although I realize it will never
improve the insecure box.

The best place to look for real secure locks is in places where the
lock is the only thing between the thief and money/valuables. In this
case we are looking for a rather small cam lock that can be equipped
with ‘switch function’.

Since they are the onces with most experience in the matter I always
take a very close look when visiting casino’s, payphones and jewelry
stores to see what kind of locks they use.In the Las Vegas
Casino’s we saw Medeco, ASSA Desmo and Miwa (Japanese magnetic lock)
being used. All outstanding locks. Abloy seems to be dominant in the
European payphone market, as well as for displays in jewelry stores.

Of course we also keep our eyes open for secure camlocks when visiting
trade shows like Aloa or the Security Messe in Essen (that starts tomorrow
and I will visit Wednesday).

In my opinion the following camlocks are secure against manipulation
and have a key that is not trivial to duplicate:

Abloy Protec camlock
ASSA Desmo
EVVA MCS camlock
Kaba camlock
Medeco Axial camlock
Miwa magnetic lock

To be honest I don’t know if these locks all standard can be delivered
as electronic switch locks. But since they need at least 10.000 pieces I
guess the manufacturer will gladly be of service to Nedap, Diebold or SDU.

I am running out of time so google for the lock specs yourself. Of
course we are interested what other camlocks you think are any good.
Feel free to post your thoughts.

Even een kleine update voor de nederlandse lezers. Een MP3 met de
volledige persconferentie staat vanaf nu online. Hierin hoor je al
onze bezwaren en bevindingen. Op het net is veel info over de actie te
vinden. Mij viel in het bijzonder het leuk geschreven verslag van
bright.nl op. Die gaan op een luchtige manier in op alle onderdelen
van de persconferentie.

http://toool.nl/persconferentie.mp3 (18 Mb)
http://www.bright.nl/bom-onder-verkiezingen

The sh*t has hit the fan!

 

We came out in the open about research we conducted on a couple of
Nedap ES3B voting computers we got our hand on. Behind the scenes we
have been working hard for the last five weeks to reverse engineer and
hack these devices. It was quite a project, but since of yesterday the
world knows about it. A whitepaper is available online for you to read
our conclusions. And besides that we also decided to trow all Nedap
software, rom dumps and internal documentation online. Just for the
public to see what it is they are voting on….

The juicy part: about the keys …. If you read Dutch law about the
requirements concerning voting they mention several times the
importance of the voting computers key. The head of the ticket office
must carry this key with him at all times, and when the elections
close it has to be stored in a sealed envelope. When Nedap learned we
where after their device they send out an emergency letter to each
municipality to store the keys to these voting computers in a safe.

I was heavily disappointed when I finally got my hands on these keys.

Just a very, very, simple four lever key and no use of anti-manipulation
or anti-copy technology. It was no problem to have the key copied in
the first lock shop I entered. Anyone with five minutes of instruction
(or less) could learn how to pick or bypass this lock.

All three Nedap voting computers we examined came with a sets of
identical keys. So all keys where the same, and one of these keys could
operate all these computers. We can safely assume one key can operate
all 8.000 Nedap voting computers in use in the Netherlands. Other
proof of this claim is that the keys are nickled over, meaning they
were mass-produced with the cuts already made. Something you only do
when you make large batches.

Getting your hands on that key is simple. Order yours online now ….
For just one euro you can order the key from multiple different online
sources. All you have to do is google for ‘C&K’ and key number ‘A126’.
Looking at the datasheet of this key you can learn its part number is
115140126. We ordered 100 and gave each and every journalist a
personal Nedap voting computer key at the press conference we held
this morning. As if you needed keys for locks like this…

 

We all worked real hard on this project and I will post some more of
our findings in greater detail during the days to come. Stay tuned …

… you are interested in fraud with voting computers ….

 

 

 

Tomorrow, Wednesday October 4 at ‘een vandaag’ (Dutch Television, Ned1) an item about
fraud with voting computers, in cooperation with www.wijvertrouwenstemcomputersniet.nl

See the 30 second teaser on YouTube: http://www.youtube.com/watch?v=IzN3jWtsykw

 

 Han Fey did it again. Spending weeks and weeks digging trough cutaway
locks, taking them apart, examining, photographing and … writing about it.

The result is yet another masterpiece from his hand: Pfaffenhain Cutaway locks.

This document describes in detail the many different systems in use by
the German company Pfaffenhain. And the special features (like the odd
V-shaped keys) they incorporate in their beautiful high security locks.

 
 

A few months ago we visited their factory in Germany and where
impressed by what we saw. We also tested their locks to see if their current
solution against bumping works. They use specially shaped pins that do
not require any modification of the house or the core. Read all about
it at this URL:

http://toool.nl/Pfaffenhain_Cutaway_cylinders.pdf (2 Mb)

 

Our Dutch campaign against voting computers is up to speed. There is
loads of media attention and the Dutch public is starting to realize
there is something wrong with the way we use these voting computers.

As I am the person with the most experience with video (editing) in
our little campaign group it was my task to make all aired tv items
available on youtube.

This is of interest of people who speak Dutch only. We are to busy to
translate the video clips. Any volunteers to help with this?

The videos can be found on: http://www.youtube.com/profile?user=stemcomputerssuck 

Yesterday Han and myself visited an Abloy service center. This is a
highly restricted area where no strangers are allowed in. But when Han
is in the house all doors open. Especially when he reveals tricks to
them they never heard of before. His knowledge on Abloy is truly
overwhelming and keeps amazing them, over and over and over again.

Yesterday he wanted to know if an asymmetric key pair could be
designed for the Abloy Protec. With asymmetric I mean there is one key
that can only open the lock (only turn counter clockwise), and the
other key can only close the lock (only turn clockwise). A master key
can be cut that will open the lock in both directions.

View the exclusive “behind enemy lines” blackbag video to learn how
individual abloy protec and diskclock keys are cut, and how asymmetric
key cutting for Abloy locks is done.
http://blackbag.toool.nl/video/abloy-keycut.wmv (80 Mb)

You could also use the video to explain people the theory behind
public key cryptography with this video. But you better leave out the
blue key that can both open and close the lock.

Somehow we lost our old stack of stopwatches. Meaning that we did not
score many good times at the ‘continues competition’ last Wednesday at
the Toool club evening in Amsterdam. We only had two or three
stopwatches left. Having said that, it was a very good day for Marnix
and Paul Boven. They both opened the Medeco Axial lock (number 14) for
the first time. Paul even improved my time on the lock. grumble …

 

 

Back to the stopwatches. We lost ours and I was looking for new ones.
Jos pointed out some local e-bay add, and yesterday at 22:00 I bought
95 pieces of high quality stopwatches. It is a good thing I could buy
so many at the same time … after all, the Dutch Open lockpick
championships are going to happen real soon now. Within a few days you
can read all about the schedule of the Dutch Open 2006 on the Toool page.

 *Small update: Walter (Toool Eindhoven) recovered the stopwatches…

A small update on some of the articles on this site.
There is one in English, one in German and one in Dutch.

 

 The first update is on the website of our campaign against voting computers.
We now have an English page on our website. And the newsletters are translated
into English too. The last one came out today.
http://www.wijvertrouwenstemcomputersniet.nl/Newsletter_4_-_23_September_2006

The second update is on the German car test in the Auto Bild magazine.
A scan is now available thanks to a loyal reader of this blog.
http://blackbag.toool.nl/images/auto-bild.pdf (PDF 1Mb)

The third update is a scan from the Dutch article in ‘De ingenieur’ about
bumpkeys. http://toool.nl/INGR10_11_p64_73_Sloten.pdf (PDF 1Mb)

I hope you enjoy the material…

Ebay has the policy not to sell burglary tools. And therefore nobody
can sell our beloved lockpick sport sets on Ebay. Bummer, but we will
have to live with that. Having said that, they do not seem to have a
problem selling bumpkeys. As long as you specifically mention it is
_not_ a bumpkey but a ‘depth key’ they do not mind. The nice thing for
the seller of these *cough* depth keys is that people who enter ‘bump
key’ in the search screen on ebay will find these keys for sure … sigh …

 

 

 

And talking about Ebay … Han Fey is offering his Drumm shield and Abloy
protec lock on there. It is the original lock used for his Drumm article.
I think he will autograph it free of charge if you win the bid.

 Click on the images to be redirected to the ebay bids….