Vulnerabilities in payment terminals demonstrated at Black Hat

Vulnerabilities found in three popular payment terminal models can result in credit card data theft, researchers say

Three widely deployed payment terminals have vulnerabilities that could allow attackers to steal credit card data and PIN numbers, according to a pair of security researchers from penetration testing firm MWR InfoSecurity in the U.K.

The vulnerabilities were demonstrated Wednesday at the Black Hat USA 2012 security conference by MWR's head of research, a German security researcher who only identifies himself as "Nils," and Rafael Dominguez Vega, a Spanish security researcher and MWR security consultant.

Nils and Vega focused their research on three particular models of payment terminals, also known as point-of-sale (PoS) terminals. Two of them are particularly popular in the U.K., but are also used in the U.S., while the third is widely deployed in the U.S., Nils said.

The researchers declined to name the exact device models or the companies that manufacture them because they wanted to give vendors enough time to address the issues. Stickers were used during the live demonstration to cover logos and text printed on the devices that could be used to identify them.

The two devices that are popular in the U.K. have vulnerabilities in their payment applications -- the specialized programs handling the payment process.

These vulnerabilities can give attackers control over various components of these devices, like the display, receipt printer, card reader or PIN inputting pad, and can be exploited by using specially crafted EMV (Chip-and-PIN) cards, Nils said.

These cards have malicious code written on their chips that gets executed when they get inserted into the terminals' smart card readers.

The researchers used this method to install a racing game on one of the three test devices during their demonstration and played it using its PIN pad and display.

For the second device, the researchers used the same method to install a Trojan program designed to record card numbers and PINs. The recorded information was then extracted by inserting a different rogue card into the payment terminal.

Criminals can also leverage these vulnerabilities to trick store clerks into thinking that a transaction was authorized by the bank when in fact it wasn't, allowing them to buy things without actually paying.

A malicious program installed on the device could block the payment attempt made with the attacker's card, but print a valid receipt to mislead the merchant, Nils said.

Even though the live demonstration only showed that card numbers and PINs can be recorded, there are also ways to steal the data stored on a card's magnetic stripe (magstripe), Nils said. Attackers could design a malicious program that blocks EMV transactions and asks the customers to swipe their cards instead in order to complete a payment.

Criminals need the magnetic stripe data in order to actually clone a payment card and perform fraudulent transactions with it.

The third payment terminal, which is popular in the U.S., is more sophisticated than the other two devices. It has a touchscreen to facilitate signature-based payments, a smart card reader, a SIM card to communicate over mobile networks, support for contactless payments, an USB port, an Ethernet port and an administration interface that can be accessed both locally and remotely.

The communication between these terminals and a remote administration server is not encrypted, which means that attackers can interfere with it, Nils said. If attackers gain access to the local network, they can use techniques like ARP or DNS spoofing to force the payment terminals to communicate with a rogue server under their control.

During the demonstration, the researchers were able to turn on the telnet service remotely and log in as root -- the administrative account on Linux systems -- which allowed them to take control of the device.

There is too much trust placed in such devices, Nils said. Merchants trust payment terminals to tell them when a payment is legitimate and payment processors trust them to handle credit card numbers and PINs securely.

Earlier this month a different team of security researchers demonstrated vulnerabilities in a POS device widely deployed in Germany. The vulnerabilities could have allowed attackers to compromise such devices over the local network and use them to steal card magstripe data and PIN numbers.

Nils didn't have any evidence that models from other manufacturers also contain vulnerabilities. However, these are computers systems so they're fairly likely to have some weaknesses, he said.

The quality of the software found on devices tested by MWR researchers was very different, Nils said. There might be some devices that have better software security, but no system is perfect, he said.

All of the affected vendors have been notified about the vulnerabilities and one of them has already developed a patch. However, it will probably take a while for the new version to be certified and then deployed to all customers.

Recommended

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?