India's largest platform for AI & Analytics leaders, professionals & aspirants

Sign in

India's largest platform for AI & Analytics leaders, professionals & aspirants

3AI Digital Library

PoS Terminals Open Consumers to Fraud

3AI December 13, 2020

Point-of-sale terminal vendors Verifone and Ingenico have issued mitigations after researchers found the devices use default passwords.

Point-of-sale terminal vendors Verifone and Ingenico have issued mitigations after researchers found the devices use default passwords.

Researchers are detailing widespread security issues in point-of-sale (PoS) terminals – specifically, three terminal device families manufactured by vendors Verifone and Ingenico.

The issues, which have been disclosed to the vendors and since patched, open several popular PoS terminals used by retailers worldwide to a variety of cyberattacks. Affected devices include Verifone VX520, Verifone MX series, and the Ingenico Telium 2 series. These devices are widely used by retailers – for instance, more than 7 million VeriFone VX520 terminals have been sold.

“Through use of default passwords, we were able to execute arbitrary code through binary vulnerabilities (e.g., stack overflows, and buffer overflows),” said researchers with the Cyber R&D Lab team, in a new analysis of the flaws this week. “These PoS terminal weaknesses enable an attacker to send arbitrary packets, clone cards, clone terminals,and install persistent malware.”

PoS terminals are devices that read payment cards (such as credit or debit cards). Of note, the affected devices are PoS terminals – the device used to process the card – as opposed to PoS systems, which include the cashier’s interaction with the terminal as well as the merchants’ inventory and accounting records.

Security Issues

Researchers disclosed two security issues in these PoS terminals. The primary issue is that they ship with default manufacturer passwords – which a Google search can easily reveal.

“Those credentials provide access to special ‘service modes,’ where hardware configuration and other functions are available,” said researchers. “One manufacturer, Ingenico, even prevents you from changing those defaults.”

Looking closer at the special “service modes,” researchers then found that they contain ‘undeclared functions’ after tearing down the terminals and extracting their firmware.

“In Ingenico and Verifone terminals, these functions enable execution of arbitrary code through binary vulnerabilities (e.g., stack overflows, and buffer overflows),” said researchers. “For over 20-years, these ‘service super modes’ have allowed undeclared access. Often, the functions are in deprecated or legacy code that’s still deployed with new installs.”

Attackers could leverage these flaws to launch an array of attacks. For instance, the arbitrary code-execution issue could allow attackers to send and modify data transfers between the PoS terminal and its network. Attackers could also read the data, allowing them to copy people’s credit card information and ultimately run fraudulent transactions.

“Attackers can forge and alter transactions,” they said. “They can attack the acquiring bank via server-side vulnerabilities, for example in the Terminal Management System (TMS). This invalidates the inherent trust given between the PoS terminal and its processor.”

Researchers reached out to both Verifone and Ingenico, and patches for the problems have since been issued.

Verifone was informed at the end of 2019, and researchers confirmed that vulnerabilities were fixed later in 2020. “In Nov 2020 PCI has released an urgent update of Verifone terminals across the globe,” said researchers.

Meanwhile, researchers said it took almost two years to reach Ingenico and receive a confirmation of that fix.

“Unfortunately, they didn’t partner with us through the remediation process, but we’re glad it’s fixed now,” they said.

    3AI Trending Articles

  • Commodity Price Forecasts using ML driven Insights

    Featured Article: Author: Tarana Chauhan, Procurement Analyst, AB InBev Dependency on Commodities and Associated Risks: Companies with Agricultural commodities as their core raw material face several risks in supply security. Agricultural commodities not only suffer from the risks associated with market dynamics like all other commodities but are also impacted by environmental factors making them […]

  • The Impact of AI on Global Economy: Trends and Initiatives to Shape the Future

    Featured Article: Author: Princy Gupta, Data Analytics Leader, Honeywell Artificial Intelligence (AI) is revolutionizing the global economy, providing unprecedented opportunities for businesses and governments to thrive in the age of data. According to McKinsey’s latest report, AI is projected to contribute $13 trillion to the global economy by 2030, a figure equivalent to the output […]

  • Algorithms to take Digital Businesses to Next Level

    Digital transformation is vital for business growth, but working out what to do and how to do it remains difficult for IT and business leaders.  At its heart, the digital revolution is about consumer behavior and business opportunity, not technology. The major changes in how consumers use technology, and to where technology is applied, represent […]

  • Process Mining and Task Mining fuels Automation across the Enterprise

    Featured Article: Author: Prakash Narayanan, Head of RPA & Intelligent Automation, Cyient Every business is a collection of core processes. Processes are the foundational infrastructure and form the basic element of business operations. In 1911, Frederick Winslow Taylor became the first person to study and optimize workplace productivity. His monograph ‘The Principles of Scientific Management’ […]