Hacker uses this vulnerability to install additional software on the ImageCast, that fills in additional ovals on the op-scan ballot, after the voter has inserted it for scanning. For extra credit, don’t perfectly fill in the ovals like a BMD normally would; instead, mimic the style that the voter has used with a pen. For double-extra-credit, do this only when the scanner detects that the voter has used a similar color pen to the ink-jet cartridge in the BMD’s printer. For triple-extra-credit, only fill in ovals in races where the voter hasn’t already marked a vote, this avoids overvotes that would draw attention to the paper ballot during an audit or recount

ARCHIVE: https://archive.is/Eet98

its a feature don't ya know

Also it is the Election Assistance Commission that certifies this machines.

https://archive.is/OD5s3 - Archive of news release. (Has been scrubbed from the election commission website.