This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Are Patched Machines Really Fixed?
September/October 2009 (vol. 7 no. 5)
pp. 82-85
ASCII Text
x 
 
Ryan W. Gardner, Matt Bishop, Tadayoshi Kohno, "Are Patched Machines Really Fixed?," IEEE Security & Privacy, vol. 7, no. 5, pp. 82-85, September/October, 2009.
 
 
BibTex
x
 
@article{ 10.1109/MSP.2009.116,
author = {Ryan W. Gardner and Matt Bishop and Tadayoshi Kohno},
title = {Are Patched Machines Really Fixed?},
journal ={IEEE Security & Privacy},
volume = {7},
number = {5},
issn = {1540-7993},
year = {2009},
pages = {82-85},
doi = {http://doi.ieeecomputersociety.org/10.1109/MSP.2009.116},
publisher = {IEEE Computer Society},
address = {Los Alamitos, CA, USA},
}
 
 
RefWorks Procite/RefMan/Endnote
x 
 
TY - MGZN
JO - IEEE Security & Privacy
TI - Are Patched Machines Really Fixed?
IS - 5
SN - 1540-7993
SP82
EP85
EPD - 82-85
A1 - Ryan W. Gardner,
A1 - Matt Bishop,
A1 - Tadayoshi Kohno,
PY - 2009
KW - patching
KW - updates
KW - integrity
KW - electronic voting
KW - security & privacy
VL - 7
JA - IEEE Security & Privacy
ER -
 
Ryan W. Gardner, Johns Hopkins University
Matt Bishop, University of California, Davis
Tadayoshi Kohno, University of Washington
Updating and patching has become a ubiquitous part of software maintenance, with particular importance to security. It's especially crucial when the systems in question perform vital functions and security compromises might yield drastic consequences. Unfortunately, updates intended to remediate security problems are sometimes incomplete, are flawed, or introduce new vulnerability themselves. The authors present several examples of such instances in a widely used electronic voting system, a device for which security is critical. A central lesson of the study is that evaluating a system's security by examining changes between revisions is insufficient; you must evaluate and analyze the system as a whole.

1. CERT Statistics, Computer Emergency Response Team, Software Eng. Inst., Carnegie Mellon Univ., 2009; www.cert.org/stats.
2. A. Arora et al., "An Empirical Analysis of Software Vendors Patch Release Behavior: Impact of Vulnerability Disclosure," Information Systems Research,12 June 2009.
3. R. Gardner et al., Software Review and Security Analysis of the Diebold Voting Machine Software, tech. report, Florida Dept. of State, July 2007; http://election.dos.state.fl.us/voting-systems/pdf/SAITreport.pdf.
4. T. Kohno et al., "Analysis of an Electronic Voting System," Proc. 2004 IEEE Symp. Security and Privacy, IEEE Press, 2004, pp. 27–40.
5. Compuware Corp., Direct Recording Electronic (DRE) Technical Security Assessment Report, tech. report, Ohio Secretary of State, Nov. 2003.
6. RABA Technologies, Trusted Agent Report Diebold AccuVote-TS Voting System, tech. report, Dept. of Legislative Services, Maryland General Assembly, Jan. 2004.
7. A. Halderman, "Diebold Shows How to Make Your Own Voting Machine Key," blog, 23 Jan. 2007; http://freedom-to-tinker.com/blog/jhalderm/diebold-shows-how-make-your-own-voting-machine-key.
8. H. Hursti, "Critical Security Issues with Diebold TSx," Black Box Voting, May 2006; www.blackboxvoting.org/BBVreportIIunredacted.pdf.
9. A.J. Feldman, J.A. Halderman, and E.W. Felten, Security Analysis of the Diebold AccuVote-TS Voting Machine, tech. report, Center for Information Technology Policy, Princeton Univ., Sept. 2006; http://itpolicy.princeton.edu/voting.
10. J.A. Calandrino et al., Source Code Review of the Diebold Voting System, tech. report, California Secretary of State, July 2007.
11. R.W. Gardner, T. Kohno, and A. Yasinsac, Attacking the Diebold Signature Variant—RSA Signatures with Unverified High-Order Padding, tech. report 1007-22, Johns Hopkins Univ., Oct. 2007; http://cs.jhu.edu/~ryan/diebold_rsa_signature/gky_rsa_signature.pdf.
12. D. Gainey, M. Gerke, and A. Yasinsac, Software Review and Security Analysis of the Diebold Voting Machine Software: Supplemental Report, tech. report, Florida Dept. of State, Aug. 2007.
13. H. Hursti, "Critical Security Issues with Diebold Optical Scan Design," Black Box Voting, July 2005; www.blackboxvoting.org/BBVreport.pdf.

Index Terms:
patching, updates, integrity, electronic voting, security & privacy
Citation:
Ryan W. Gardner, Matt Bishop, Tadayoshi Kohno, "Are Patched Machines Really Fixed?," IEEE Security & Privacy, vol. 7, no. 5, pp. 82-85, Sept.-Oct. 2009, doi:10.1109/MSP.2009.116
Usage of this product signifies your acceptance of the Terms of Use.