India's largest platform and marketplace for AI & Analytics leaders & professionals

Sign in

India's largest platform and marketplace for AI & Analytics leaders & professionals

3AI Digital Library

PoS Terminals Open Consumers to Fraud

3AI December 13, 2020

Point-of-sale terminal vendors Verifone and Ingenico have issued mitigations after researchers found the devices use default passwords.

Point-of-sale terminal vendors Verifone and Ingenico have issued mitigations after researchers found the devices use default passwords.

Researchers are detailing widespread security issues in point-of-sale (PoS) terminals – specifically, three terminal device families manufactured by vendors Verifone and Ingenico.

The issues, which have been disclosed to the vendors and since patched, open several popular PoS terminals used by retailers worldwide to a variety of cyberattacks. Affected devices include Verifone VX520, Verifone MX series, and the Ingenico Telium 2 series. These devices are widely used by retailers – for instance, more than 7 million VeriFone VX520 terminals have been sold.

“Through use of default passwords, we were able to execute arbitrary code through binary vulnerabilities (e.g., stack overflows, and buffer overflows),” said researchers with the Cyber R&D Lab team, in a new analysis of the flaws this week. “These PoS terminal weaknesses enable an attacker to send arbitrary packets, clone cards, clone terminals,and install persistent malware.”

PoS terminals are devices that read payment cards (such as credit or debit cards). Of note, the affected devices are PoS terminals – the device used to process the card – as opposed to PoS systems, which include the cashier’s interaction with the terminal as well as the merchants’ inventory and accounting records.

Security Issues

Researchers disclosed two security issues in these PoS terminals. The primary issue is that they ship with default manufacturer passwords – which a Google search can easily reveal.

“Those credentials provide access to special ‘service modes,’ where hardware configuration and other functions are available,” said researchers. “One manufacturer, Ingenico, even prevents you from changing those defaults.”

Looking closer at the special “service modes,” researchers then found that they contain ‘undeclared functions’ after tearing down the terminals and extracting their firmware.

“In Ingenico and Verifone terminals, these functions enable execution of arbitrary code through binary vulnerabilities (e.g., stack overflows, and buffer overflows),” said researchers. “For over 20-years, these ‘service super modes’ have allowed undeclared access. Often, the functions are in deprecated or legacy code that’s still deployed with new installs.”

Attackers could leverage these flaws to launch an array of attacks. For instance, the arbitrary code-execution issue could allow attackers to send and modify data transfers between the PoS terminal and its network. Attackers could also read the data, allowing them to copy people’s credit card information and ultimately run fraudulent transactions.

“Attackers can forge and alter transactions,” they said. “They can attack the acquiring bank via server-side vulnerabilities, for example in the Terminal Management System (TMS). This invalidates the inherent trust given between the PoS terminal and its processor.”

Researchers reached out to both Verifone and Ingenico, and patches for the problems have since been issued.

Verifone was informed at the end of 2019, and researchers confirmed that vulnerabilities were fixed later in 2020. “In Nov 2020 PCI has released an urgent update of Verifone terminals across the globe,” said researchers.

Meanwhile, researchers said it took almost two years to reach Ingenico and receive a confirmation of that fix.

“Unfortunately, they didn’t partner with us through the remediation process, but we’re glad it’s fixed now,” they said.

    3AI Trending Articles

  • Sebi is setting up a Cybersecurity Fusion Centre

    Establishing a cybersecurity fusion centre or a cyber lab is part of Sebi’s three-tier structure for monitoring cybersecurity-related events in the securities markets. . NEW DELHI: Markets regulator Sebi is in the process of setting up a cybersecurity fusion centre, a move aimed at detecting cyber threats faster and resolve such incidents efficiently and effectively. […]

  • RBI provides new set of guidelines for the Digital Banking and Payments ecosystem

    The master direction on digital payment security controls, released last week, casts a wide net. The skyrocketing of online transactions in the country—Covid-19 has provided no small impetus, with the amount transacted via UPI doubling in January 2021, at Rs 4.3 lakh crore, from lasts year’s Rs 2.1 lakh crore—calls for fortifying cybersecurity in the […]

  • Upside AI to use ML to make Fundamental Investment Decisions

    The pandemic has made humans more dependent on technology, be it for working, shopping and now even for investing. Upside AI — a SEBI registered Portfolio Management Service (PMS) is among the first funds in India to use machine learning to make fundamental investment decisions. The technology-focused fund believes that the next Warren Buffett would […]

  • Inventory Redeployment through Optimized and Automated Recommendations

    Featured Article: Author: Shrinath Bhat, Senior Data Scientist, AB InBev Supply Chain of Future (SCoF) Analytics team’s vision, which is a part of Growth Analytics Centre (GAC): the global analytics hub for Ab-InBev, is to create value via adoption of cutting-edge practices in Supply Chain domain with a series of digital transformations and advanced analytics […]