India's largest platform and marketplace for AI & Analytics leaders & professionals

Sign in

India's largest platform and marketplace for AI & Analytics leaders & professionals

3AI Digital Library

PoS Terminals Open Consumers to Fraud

3AI December 13, 2020

Point-of-sale terminal vendors Verifone and Ingenico have issued mitigations after researchers found the devices use default passwords.

Point-of-sale terminal vendors Verifone and Ingenico have issued mitigations after researchers found the devices use default passwords.

Researchers are detailing widespread security issues in point-of-sale (PoS) terminals – specifically, three terminal device families manufactured by vendors Verifone and Ingenico.

The issues, which have been disclosed to the vendors and since patched, open several popular PoS terminals used by retailers worldwide to a variety of cyberattacks. Affected devices include Verifone VX520, Verifone MX series, and the Ingenico Telium 2 series. These devices are widely used by retailers – for instance, more than 7 million VeriFone VX520 terminals have been sold.

“Through use of default passwords, we were able to execute arbitrary code through binary vulnerabilities (e.g., stack overflows, and buffer overflows),” said researchers with the Cyber R&D Lab team, in a new analysis of the flaws this week. “These PoS terminal weaknesses enable an attacker to send arbitrary packets, clone cards, clone terminals,and install persistent malware.”

PoS terminals are devices that read payment cards (such as credit or debit cards). Of note, the affected devices are PoS terminals – the device used to process the card – as opposed to PoS systems, which include the cashier’s interaction with the terminal as well as the merchants’ inventory and accounting records.

Security Issues

Researchers disclosed two security issues in these PoS terminals. The primary issue is that they ship with default manufacturer passwords – which a Google search can easily reveal.

“Those credentials provide access to special ‘service modes,’ where hardware configuration and other functions are available,” said researchers. “One manufacturer, Ingenico, even prevents you from changing those defaults.”

Looking closer at the special “service modes,” researchers then found that they contain ‘undeclared functions’ after tearing down the terminals and extracting their firmware.

“In Ingenico and Verifone terminals, these functions enable execution of arbitrary code through binary vulnerabilities (e.g., stack overflows, and buffer overflows),” said researchers. “For over 20-years, these ‘service super modes’ have allowed undeclared access. Often, the functions are in deprecated or legacy code that’s still deployed with new installs.”

Attackers could leverage these flaws to launch an array of attacks. For instance, the arbitrary code-execution issue could allow attackers to send and modify data transfers between the PoS terminal and its network. Attackers could also read the data, allowing them to copy people’s credit card information and ultimately run fraudulent transactions.

“Attackers can forge and alter transactions,” they said. “They can attack the acquiring bank via server-side vulnerabilities, for example in the Terminal Management System (TMS). This invalidates the inherent trust given between the PoS terminal and its processor.”

Researchers reached out to both Verifone and Ingenico, and patches for the problems have since been issued.

Verifone was informed at the end of 2019, and researchers confirmed that vulnerabilities were fixed later in 2020. “In Nov 2020 PCI has released an urgent update of Verifone terminals across the globe,” said researchers.

Meanwhile, researchers said it took almost two years to reach Ingenico and receive a confirmation of that fix.

“Unfortunately, they didn’t partner with us through the remediation process, but we’re glad it’s fixed now,” they said.

    3AI Trending Articles

  • Transforming Indian Judiciary with GPT4

    Featured Article: Author: Vivek Gupta, Founder & CEO, Softsensor.ai Indian judiciary suffers significant backlog with 35 million cases across many courts. Assuming that each case requires about 100 pages of drafting, we are looking at about 3.5 billion pages to be drafted. Each page takes about 30 mins, we are looking at 100 billion minutes […]

  • Importance Of Data-Centric AI In Business And The Role Of Observability In It

    Featured Article: Author:  Anirban Nandi, Vice President, AI Products & Business Analytics, Rakuten India We all have heard the old saying that “Data is the new oil”. But wait!! Is that completely true? Just like oil, unrefined data is of little to no use. So, allow me to correct the maxim a little – “Quality […]

  • Blockchain mustn’t get blocked: Regulate but do not ban Bitcoin

    The government’s proposed bill to ban cryptocurrency could deal a blow to India’s tech credentials . Since I started writing this column on technology a couple of years ago, two things have been eminently predictable. One is Elon Musk, the richest man in the world now, doing unpredictable things: Boring tunnels, implanting chips in pigs’ […]

  • Driving innovation in B2B payments through AI

    Featured Article: Author:  Shireen Ali, Senior Vice President – Analytics, Citi The B2B payments sector is estimated to be a $120 trillion* business. Yet, despite recent technological advancements,  B2B payments still falls behind its counterpart, B2C,  in terms of both customer experience and efficiency. If you have to go out to a café and buy […]