Jacopo Moioli
Jacopo Moioli is an Offensive Security Engineer at Satispay, trying to break things before others do. Before that, he spent two years in consultancy as a penetration tester and red teamer.
This is his first talk at a security conference. Outside cybersecurity, he is interested in space, aviation and other technical rabbit holes.
Session
Fiscal cash registers are everywhere in Italy, yet they receive surprisingly little attention as embedded systems. They are regulated appliances with tamper-evident seals, periodic inspections, controlled service procedures, and hardware mechanisms intended to make fiscal data difficult to manipulate.
We bought one of the most common models on the second-hand market and started taking it apart. Inside, we found an unusual design: an FPGA driving the user interface, an internal battery supporting a peculiar power lifecycle, a resin-encapsulated memory module, and physical switches hidden on the main board.
The software architecture is much more familiar: the device runs an old Linux-based OS with a writable root filesystem, essentially no privilege separation, extensive debug functionality, and a broad network attack surface.
Whether you prefer hardware or software, we found ways in from both sides. Rather than presenting a vulnerability catalogue, this talk examines the security model of a regulated embedded system and the mismatch between elaborate physical protections and weak software trust boundaries.
What does “tamper resistant” mean when the protected component is connected to a general-purpose computer with weak security assumptions?
By the end of the talk, we’ll have answered that question and one more: does it run Doom?