[Date Prev][Date Next] [Chronological] [Thread] [Top]

Multiple uploads don't verify checksums



  When uploading multiple memory cards during the same
connection, the Accu-Vote does not verify on successive
memory cards that the checksums match the data.  This is
both a blessing and a curse.  Steve Knecht discovered this
in dealing with memory card corruptions and was able to
upload memory cards that were coming up as "PLEASE
RE-INSERT...".  However the checksums SHOULD be verified
first and therefore this is a bug.

  In fact, all that is checked is that the memory card is
not write-protected and that its status is not blank and not
audited (i.e. the election finished).  Thus you could upload
corrupted counters and if the precinct data isn't reading
properly (connection problems???) then the AV could crash or
upload meaningless data.  And if there is a connection
problem, the AV could write the upload audit log entry to
the wrong location and corrupt a previously okay memory
card.  In short, not checking means taking unknown risks
with the data.

  This is my fault (I wrote the code) and I'll "fix" it for
the next release (1.94y?) but until then be warned, if you
have a memory card that is failing the checks, bypassing the
checks using this method is dangerous.

  And of course we'd all prefer that these memory card
corruptions just went away.  Those and computer crashes.
And crime.  And lousy weather.  And...  :-)

              Guy