Voting machine fun!

35 views
Skip to first unread message

John Aho

unread,
Sep 13, 2017, 12:50:51 AM9/13/17
to PHX2600

So I have some d13bold voting machines. Accuvote TSX to be precise. 

I haven't had much luck getting into them so far but tonight was neat. 

They have a CPU Jtag and a CPLD jtag header on them which is promising. I've previously struck out on the usb header and debug mode. Also a file system vulnerability on a previous model had been fixed. (I think)  Turns out they have an intel PXA255 processor chip.

Hooked up the olimex jtag unit and after some reading/configuring and a few false turns got the jtag debugger to connect. 

The command I used to get here is: ./openocd  -f ./interface/ftdi/olimex-arm-usb-ocd-h.cfg -f board/pxa255_sst.cfg    
This is fun but I'm at a loss currently. I'm going to do some youtube/reading up on this on how to dump the memory.
Right now I'm out of time for the night, got a day job and all but wanted to share the news. 


Oh, if you want a shiny decommissioned d13bold accuvote TSX touch screen voting machine of your own to play with I'm selling them to the security community for $75 a pop. I've got 17 extra currently. 


~John Aho
Reply all
Reply to author
Forward
0 new messages