BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.romhack.io//romhack-camp-2026//speaker//NSY8LL
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-romhack-camp-2026-PTNMVU@cfp.romhack.io
DTSTART;TZID=CET:20261003T160000
DTEND;TZID=CET:20261003T164000
DESCRIPTION:Fiscal cash registers are everywhere in Italy\, yet they receiv
 e surprisingly little attention as embedded systems. They are regulated ap
 pliances with tamper-evident seals\, periodic inspections\, controlled ser
 vice procedures\, and hardware mechanisms intended to make fiscal data dif
 ficult to manipulate.\nWe bought one of the most common models on the seco
 nd-hand market and started taking it apart. Inside\, we found an unusual d
 esign: an FPGA driving the user interface\, an internal battery supporting
  a peculiar power lifecycle\, a resin-encapsulated memory module\, and phy
 sical switches hidden on the main board.\n\nThe software architecture is m
 uch more familiar: the device runs an old Linux-based OS with a writable r
 oot filesystem\, essentially no privilege separation\, extensive debug fun
 ctionality\, and a broad network attack surface.\n\nWhether you prefer har
 dware or software\, we found ways in from both sides. Rather than presenti
 ng a vulnerability catalogue\, this talk examines the security model of a 
 regulated embedded system and the mismatch between elaborate physical prot
 ections and weak software trust boundaries.\nWhat does “tamper resistant
 ” mean when the protected component is connected to a general-purpose co
 mputer with weak security assumptions?\n\nBy the end of the talk\, we’ll
  have answered that question and one more: does it run Doom?
DTSTAMP:20260921T191249Z
LOCATION:STAGE 1 (Section 9)
SUMMARY:Cash\, Card or Root? Security Archaeology of a Fiscal Cash Register
  - Jacopo Jannone\, Jacopo Moioli
URL:https://cfp.romhack.io/romhack-camp-2026/talk/PTNMVU/
END:VEVENT
END:VCALENDAR