India's largest platform and marketplace for GCCs, AI & Analytics leaders & professionals

Sign in

⁠India’s largest platform & marketplace for AI & GCC leaders & professionals

3AI Digital Library

PoS Terminals Open Consumers to Fraud

3AI December 13, 2020

Point-of-sale terminal vendors Verifone and Ingenico have issued mitigations after researchers found the devices use default passwords.

Point-of-sale terminal vendors Verifone and Ingenico have issued mitigations after researchers found the devices use default passwords.

Researchers are detailing widespread security issues in point-of-sale (PoS) terminals – specifically, three terminal device families manufactured by vendors Verifone and Ingenico.

The issues, which have been disclosed to the vendors and since patched, open several popular PoS terminals used by retailers worldwide to a variety of cyberattacks. Affected devices include Verifone VX520, Verifone MX series, and the Ingenico Telium 2 series. These devices are widely used by retailers – for instance, more than 7 million VeriFone VX520 terminals have been sold.

“Through use of default passwords, we were able to execute arbitrary code through binary vulnerabilities (e.g., stack overflows, and buffer overflows),” said researchers with the Cyber R&D Lab team, in a new analysis of the flaws this week. “These PoS terminal weaknesses enable an attacker to send arbitrary packets, clone cards, clone terminals,and install persistent malware.”

PoS terminals are devices that read payment cards (such as credit or debit cards). Of note, the affected devices are PoS terminals – the device used to process the card – as opposed to PoS systems, which include the cashier’s interaction with the terminal as well as the merchants’ inventory and accounting records.

Security Issues

Researchers disclosed two security issues in these PoS terminals. The primary issue is that they ship with default manufacturer passwords – which a Google search can easily reveal.

“Those credentials provide access to special ‘service modes,’ where hardware configuration and other functions are available,” said researchers. “One manufacturer, Ingenico, even prevents you from changing those defaults.”

Looking closer at the special “service modes,” researchers then found that they contain ‘undeclared functions’ after tearing down the terminals and extracting their firmware.

“In Ingenico and Verifone terminals, these functions enable execution of arbitrary code through binary vulnerabilities (e.g., stack overflows, and buffer overflows),” said researchers. “For over 20-years, these ‘service super modes’ have allowed undeclared access. Often, the functions are in deprecated or legacy code that’s still deployed with new installs.”

Attackers could leverage these flaws to launch an array of attacks. For instance, the arbitrary code-execution issue could allow attackers to send and modify data transfers between the PoS terminal and its network. Attackers could also read the data, allowing them to copy people’s credit card information and ultimately run fraudulent transactions.

“Attackers can forge and alter transactions,” they said. “They can attack the acquiring bank via server-side vulnerabilities, for example in the Terminal Management System (TMS). This invalidates the inherent trust given between the PoS terminal and its processor.”

Researchers reached out to both Verifone and Ingenico, and patches for the problems have since been issued.

Verifone was informed at the end of 2019, and researchers confirmed that vulnerabilities were fixed later in 2020. “In Nov 2020 PCI has released an urgent update of Verifone terminals across the globe,” said researchers.

Meanwhile, researchers said it took almost two years to reach Ingenico and receive a confirmation of that fix.

“Unfortunately, they didn’t partner with us through the remediation process, but we’re glad it’s fixed now,” they said.

    3AI Trending Articles

  • Fintech startup Volopay raises $2.1M in seed round

    Singapore-based fintech startup Volopay has raised $2.1 million in seed funding to provide businesses and startups in the Asia Pacific region a powerful control center for all their financial needs. Singapore-based fintech startup Volopay has raised $2.1 million in seed funding. The company said it wants to use the funding to provide businesses and startups […]

  • AI in Drug Discovery

    Featured Article: Author: Vijay Morampudi, Director & Head of AI, Wavelabs Technologies Drug discovery takes 12-15 years and a median investment of nearly $1 billion to bring a new drug to market. While the true cost of research and development may be as high as $2.5 billion per marketed therapy, when factoring in abandoned trials and […]

  • Mirae Asset Launches $35 Mn Early Stage Fund For India

    The Mirae Asset Venture Opportunities Fund will have an average ticket size of $2 Mn – $4 Mn The early stage fund will back up the Mirae Asset-Naver Asia Growth Fund, which was launched in 2018 Besides its new early stage fund, Mirae Asset has invested in Ola, Bigbasket, Zomato, Shadowfax and other Indian startups […]

  • Sebi is setting up a Cybersecurity Fusion Centre

    Establishing a cybersecurity fusion centre or a cyber lab is part of Sebi’s three-tier structure for monitoring cybersecurity-related events in the securities markets. . NEW DELHI: Markets regulator Sebi is in the process of setting up a cybersecurity fusion centre, a move aimed at detecting cyber threats faster and resolve such incidents efficiently and effectively. […]