Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/2/2016
06:30 PM
Connect Directly
Facebook
Twitter
RSS
E-Mail
100%
0%

Hotel POS and Magstripe Cards Vulnerable to Attacks, Brute-Forcing

Researchers from Rapid7 at DefCon will demonstrate vulnerabilities that allow attackers to turn point-of-sale devices into keyboards

Magnetic stripe readers, you are the gift that keeps on giving. Unfortunately.

Researchers from Rapid7 Inc. will demonstrate how point-of-sale systems and hotel keys with magstripe technology can be hacked and used in brute-force attacks as part of a DefCon presentation this weekend.

Building on work from Samy Kamkar and his MagSpoof techniques, along with integrated bad barcode from Tencent, Rapid7's Weston Hecker will show how to inject OS commands into a Windows-based POS system with the magstripe reader.

"Often a magstripe reader is configured as a general-purpose device, so you can drop in commands to open a register, open a window, or download malware and install," said Tod Beardsley, senior security research manager at Rapid7, in a phone interview with Dark Reading.

With a device that's programmable via an electromagnetic field, the hacker has lots of options: open a cash register drawer, open a window on the computer, or download and install malware. "You only need to distract the operator for a couple seconds -- it all happens very quickly," Beardsley explained.

In effect, the attack turns the magstripe reader into a keyboard. "If you've seen the rubber ducky attacks with the exposed USB ports, you know that something that mimics a keyboard gives you direct access to the [POS] device," Beardsley added. The vulnerability affects everything from hotel keys to loyalty cards, gas cards, or special access cards for first responders to use elevators.

Rapid7 has already notified the manufacturer, Samsung, but the vulnerability affects nearly all vendors' POS devices, which aren’t that different from one another, according to Beardsley. There's also been no official response from Samsung, though Beardsley assumes they're doing their own testing and due diligence. Rapid7 is also working with CERT for handling the vulnerability disclosure.

Beardsley and Weston point to two areas that need to be fixed. The first is not to allow magstripe readers to be used as a keyboard, which can be addressed by new driver definitions, "an OS fix," Beardsley said. Secondly, because the devices can be tricked into taking certain types of commands, the applications they use should limit the kind of data they're expecting. "Credit card data is ASCII, not anything exciting. But the fact I can inject keystrokes, like the F8 key, is unexpected," Beardley said. "It's a fundamental design flaw in how these Windows-enabled systems run."

Brute-forcing a magstripe hotel card is also remarkably simple; the data it contains is encoded but not encrypted, Beardsley said. An attacker with a magstripe hotel card will look for the folio number associated with check-in, which is usually six digits and tends to be assigned incrementally (123456, 123457, 123458…) rather than randomly. The attacker will also look for the room number on the magstripe card and the checkout date. All three pieces of data have to be accurate for a room doorlock to open.

"Once you have a device, it's short work to guess a number on the fly that opens a lock – the doors to guest rooms," Beardsley said. By replacing incremental IDs with random ones and expanding the number of digits in the data fields, hotels and other affected industries can help address the vulnerabilities – a cheaper, easier fix than using encrypted cards. "Encryption will happen at some point, but today it's pretty much the same basic technology from the 1970s," Beardsley said.

Related Content From Black Hat 2016:

 

Terry Sweeney is a Los Angeles-based writer and editor who has covered technology, networking, and security for more than 20 years. He was part of the team that started Dark Reading and has been a contributor to The Washington Post, Crain's New York Business, Red Herring, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jmyerson
50%
50%
jmyerson,
User Rank: Apprentice
8/4/2016 | 5:30:50 PM
Re: Vulnerabilities lurk everywhere
Hi Terry,

Yes I think white hats can be one or two steps ahead of black hats as long they are able to find and fix vulnerabilities in pentest tools.  A third party (legitimate, of course) discovered and reported to a vendor on a popular security tool's vulnerabilities,
T Sweeney
50%
50%
T Sweeney,
User Rank: Moderator
8/4/2016 | 1:58:37 PM
Re: Vulnerabilities lurk everywhere
Hi Judith... always good to hear from you. Yes, white hats and black hats, always in constant escalation with each other. Do you really think the white hats are one or two steps ahead most the time?
jmyerson
100%
0%
jmyerson,
User Rank: Apprentice
8/3/2016 | 5:31:40 AM
Vulnerabilities lurk everywhere
This is the first time I saw this marvelous article of yours. Vulnerabilities lurk everywhere not just at the hotels.  We try to stay one or two steps ahead of the hackers throough security awareness, security training, better vulnerability management and better pentest tools and techniques.
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...