2026-10-03 –, STAGE 1 (Section 9) Language: English
Fiscal cash registers are everywhere in Italy, yet they receive surprisingly little attention as embedded systems. They are regulated appliances with tamper-evident seals, periodic inspections, controlled service procedures, and hardware mechanisms intended to make fiscal data difficult to manipulate.
We bought one of the most common models on the second-hand market and started taking it apart. Inside, we found an unusual design: an FPGA driving the user interface, an internal battery supporting a peculiar power lifecycle, a resin-encapsulated memory module, and physical switches hidden on the main board.
The software architecture is much more familiar: the device runs an old Linux-based OS with a writable root filesystem, essentially no privilege separation, extensive debug functionality, and a broad network attack surface.
Whether you prefer hardware or software, we found ways in from both sides. Rather than presenting a vulnerability catalogue, this talk examines the security model of a regulated embedded system and the mismatch between elaborate physical protections and weak software trust boundaries.
What does “tamper resistant” mean when the protected component is connected to a general-purpose computer with weak security assumptions?
By the end of the talk, we’ll have answered that question and one more: does it run Doom?
Jacopo Jannone is a computer engineer specialized in offensive cybersecurity. He has a strong passion for reverse engineering, which as an information security professional he mainly applies to the analysis of mobile, web and native applications. His interests extend to identification systems, radio frequency communications, embedded systems, and electronics. In his daily job he manages the offensive security team at Satispay, while in his free time he performs security research, develops open source projects, plays CTF competitions, and reverse engineers anything he finds interesting.
Jacopo Moioli is an Offensive Security Engineer at Satispay, trying to break things before others do. Before that, he spent two years in consultancy as a penetration tester and red teamer.
This is his first talk at a security conference. Outside cybersecurity, he is interested in space, aviation and other technical rabbit holes.