Voting Device Manufacturer Encourages Users To Use (And Re-Use) Easily-Guessed Passwords

from the thanks-for-the-tips,-sparky dept

As Election Day 2K18 rolls on, the good news continues to roll in, he said in his most Professor Farnsworth voice. It’s never good news, not if we’re talking voting machine security. Kim Zetter, writing for Motherboard, has obtained a manual for devices made by Unisyn Voting Solutions, which provides horrendous security advice for users of its products.

There are federal guidelines for voting systems. The Elections Assistance Committee makes the following recommendations for passwords:

[E]lection officials are encouraged to change passwords after every election. Passwords should also have the following characteristics: they should be at least six characters, preferably eight, and include at least one uppercase letter, a lowercase letter, at least one number and a symbol. It also says, though, that passwords should be easy to remember so that employees won’t need to write them down, “yet sufficiently vague that they cannot be easily guessed.”

Unisyn has apparently decided minimal security efforts are badly in need of disruption. To begin with, the device manual suggests users should simply use variations of the default password the devices ship with. That password is the company’s name with a “1” appended to the end of it. This easily-guessed admin password should then be immediately replaced with… an easily-guessed password.

Once logged into the system the credentials needed to access the tabulation monitor or the system for creating reports of ballots and vote tallies are different. The username is again a simple word to log in. The password is the same word with “1” appended to it. Users are told that to change the password when prompted, they should simply change the number sequentially to 2, 3, 4, etc.

The Unisyn manual takes the EAC guidelines and throws them out. It then makes a minimal nod towards compliance before throwing everything out a second time. Remember the part about not writing down passwords? The sort of thing no one should do because it defeats the purpose of password security? Here’s Unisyn’s scorching hot take on EAC compliance:

“You will be periodically asked to change your password per EAC regulations,” [the manual] notes. But instead of providing customers with sound instructions for changing passwords—such as creating completely new passwords and not re-using them—the manual instructs them to simply alternate between a system administrator and a root password each time they are prompted to change the password. Space is provided below this instruction for election workers to write down which password they are using at any given time.

If there’s good news, it’s that these machines aren’t in use everywhere. Just 3,500+ jurisdictions in ten states. They’re also fairly insulated from online attacks, since they’re not supposed to be connected to the internet. This means attackers will most likely need physical access to the devices. Good thing these only get touched by non-election personnel every couple of years or so!

Filed Under: , , ,
Companies: unisyn voting solutions

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Voting Device Manufacturer Encourages Users To Use (And Re-Use) Easily-Guessed Passwords”

Subscribe: RSS Leave a comment
Bamboo Harvester (profile) says:


…It’s what most people do anyway. Something on the order of 85% of routers that do not still have the factory default Admin password use … Password1

Verizon uses that for new DSL accounts on installation. Most people never change it.

I remember when you could get su access on most mainframes with the password “god” or “sex” as well.

We’re creatures of habit.

ShadowNinja (profile) says:

Re: Well....

Well it’s also been beaten into our heads for 2 decades to follow bad password policies.

Many of the official recommendations Tim posted encourage bad password hygiene that will make you more vulnerable to getting hacked.

  • Forcing a mix of upper/lower case letters, a number, and a symbol? Check.
  • Telling people 8 characters is good enough (even worse, they say 6 is allowed!)
  • Frequent password changes (yes if someone leaves who was working it this can be necessary, but otherwise no it’s not)
  • No mention of avoiding commonly used passwords.

This XKCD comic explains a lot of why these those recommendations are bad

Bamboo Harvester (profile) says:

Re: Re: Well....

Agreed on all points.

Especially the number and symbol usage. Not things most people can type “normally”, forcing hand movements easily visible to everyone else in an office.

And usually hunt & pecked, so anyone behind you now knows your password.

The ONE thing that would help generate long, difficult to crack passwords is forbidden in most cases – using SPACES.

Passphrases are much more difficult to crack.

Thad (profile) says:

I used to work as a temp on GoDaddy’s web design team.

Our first day, we had to go through a “security” tutorial that, among other things, advised that we satisfy the “mixed-case and at least one symbol” requirement by using an initial capital letter and putting an exclamation point at the end.

I e-mailed the security team to explain to them why this is bad advice (“a six-character password that begins with a capital letter and ends with an exclamation point is exactly as secure as a five-character all-lowercase password”). Unsurprisingly, I never heard back.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...