Vulnerabilities in payment terminals demonstrated at Black Hat

Vulnerabilities found in three popular payment terminal models can result in credit card data theft, researchers say

Three widely deployed payment terminals have vulnerabilities that could allow attackers to steal credit card data and PIN numbers, according to a pair of security researchers from penetration testing firm MWR InfoSecurity in the U.K.

The vulnerabilities were demonstrated Wednesday at the Black Hat USA 2012 security conference by MWR's head of research, a German security researcher who only identifies himself as "Nils," and Rafael Dominguez Vega, a Spanish security researcher and MWR security consultant.

Nils and Vega focused their research on three particular models of payment terminals, also known as point-of-sale (PoS) terminals. Two of them are particularly popular in the U.K., but are also used in the U.S., while the third is widely deployed in the U.S., Nils said.

The researchers declined to name the exact device models or the companies that manufacture them because they wanted to give vendors enough time to address the issues. Stickers were used during the live demonstration to cover logos and text printed on the devices that could be used to identify them.

The two devices that are popular in the U.K. have vulnerabilities in their payment applications -- the specialized programs handling the payment process.

These vulnerabilities can give attackers control over various components of these devices, like the display, receipt printer, card reader or PIN inputting pad, and can be exploited by using specially crafted EMV (Chip-and-PIN) cards, Nils said.

These cards have malicious code written on their chips that gets executed when they get inserted into the terminals' smart card readers.

The researchers used this method to install a racing game on one of the three test devices during their demonstration and played it using its PIN pad and display.

For the second device, the researchers used the same method to install a Trojan program designed to record card numbers and PINs. The recorded information was then extracted by inserting a different rogue card into the payment terminal.

Criminals can also leverage these vulnerabilities to trick store clerks into thinking that a transaction was authorized by the bank when in fact it wasn't, allowing them to buy things without actually paying.

A malicious program installed on the device could block the payment attempt made with the attacker's card, but print a valid receipt to mislead the merchant, Nils said.

Even though the live demonstration only showed that card numbers and PINs can be recorded, there are also ways to steal the data stored on a card's magnetic stripe (magstripe), Nils said. Attackers could design a malicious program that blocks EMV transactions and asks the customers to swipe their cards instead in order to complete a payment.

Criminals need the magnetic stripe data in order to actually clone a payment card and perform fraudulent transactions with it.

The third payment terminal, which is popular in the U.S., is more sophisticated than the other two devices. It has a touchscreen to facilitate signature-based payments, a smart card reader, a SIM card to communicate over mobile networks, support for contactless payments, an USB port, an Ethernet port and an administration interface that can be accessed both locally and remotely.

The communication between these terminals and a remote administration server is not encrypted, which means that attackers can interfere with it, Nils said. If attackers gain access to the local network, they can use techniques like ARP or DNS spoofing to force the payment terminals to communicate with a rogue server under their control.

During the demonstration, the researchers were able to turn on the telnet service remotely and log in as root -- the administrative account on Linux systems -- which allowed them to take control of the device.

There is too much trust placed in such devices, Nils said. Merchants trust payment terminals to tell them when a payment is legitimate and payment processors trust them to handle credit card numbers and PINs securely.

Earlier this month a different team of security researchers demonstrated vulnerabilities in a POS device widely deployed in Germany. The vulnerabilities could have allowed attackers to compromise such devices over the local network and use them to steal card magstripe data and PIN numbers.

Nils didn't have any evidence that models from other manufacturers also contain vulnerabilities. However, these are computers systems so they're fairly likely to have some weaknesses, he said.

The quality of the software found on devices tested by MWR researchers was very different, Nils said. There might be some devices that have better software security, but no system is perfect, he said.

All of the affected vendors have been notified about the vulnerabilities and one of them has already developed a patch. However, it will probably take a while for the new version to be certified and then deployed to all customers.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?