Voting machine fun!

[John Aho]

So I have some d13bold voting machines. Accuvote TSX to be precise. 

I haven't had much luck getting into them so far but tonight was neat. 

They have a CPU Jtag and a CPLD jtag header on them which is promising. I've previously struck out on the usb header and debug mode. Also a file system vulnerability on a previous model had been fixed. (I think)  Turns out they have an intel PXA255 processor chip.

Hooked up the olimex jtag unit and after some reading/configuring and a few false turns got the jtag debugger to connect. 

The command I used to get here is: ./openocd  -f ./interface/ftdi/olimex-arm-usb-ocd-h.cfg -f board/pxa255_sst.cfg    

This is fun but I'm at a loss currently. I'm going to do some youtube/reading up on this on how to dump the memory.

Right now I'm out of time for the night, got a day job and all but wanted to share the news. 

Oh, if you want a shiny decommissioned d13bold accuvote TSX touch screen voting machine of your own to play with I'm selling them to the security community for $75 a pop. I've got 17 extra currently. 

~John Aho