Dissecting the ICX Frog

This talk steps back from individual vulnerabilities to look at how the ImageCast X voting system is engineered. The speakers work on a classic ICX unit that was bought on eBay and is not encumbered by an NDA or protective order, so it can be discussed openly. The classic model runs Android 4.4.4 while the Prime variant runs Android 5.1.1, and the vendor OS appears to be a modified build of the Android Open Source Project.

Using the APK exported from the device, the team decompiled the app to smali and estimated a codebase of roughly 200,000 lines of Java. They found separate code paths for the two hardware types, such as EEPROM-backed counters on one and disk storage on the other. The app shells out to bash for some functions, such as audio alerts, and one tune appears to be a hidden easter egg. The election definition is a zip of about 1,400 files that includes a SQLite database with 22 tables, and one record holds a hex-encoded JSON blob.

The speaker argues that the many configurations and modes, including ballot-marking, DRE with VVPAT, remote-use and full-face ballot modes, create maintenance and deployment problems beyond security. They ask whether single-purpose devices would be a better design. The practical takeaway is that a system's architecture and configuration sprawl deserve scrutiny alongside its certification.