Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/2/2016
06:30 PM
Connect Directly
Facebook
Twitter
RSS
E-Mail
100%
0%

Hotel POS and Magstripe Cards Vulnerable to Attacks, Brute-Forcing

Researchers from Rapid7 at DefCon will demonstrate vulnerabilities that allow attackers to turn point-of-sale devices into keyboards

Magnetic stripe readers, you are the gift that keeps on giving. Unfortunately.

Researchers from Rapid7 Inc. will demonstrate how point-of-sale systems and hotel keys with magstripe technology can be hacked and used in brute-force attacks as part of a DefCon presentation this weekend.

Building on work from Samy Kamkar and his MagSpoof techniques, along with integrated bad barcode from Tencent, Rapid7's Weston Hecker will show how to inject OS commands into a Windows-based POS system with the magstripe reader.

"Often a magstripe reader is configured as a general-purpose device, so you can drop in commands to open a register, open a window, or download malware and install," said Tod Beardsley, senior security research manager at Rapid7, in a phone interview with Dark Reading.

With a device that's programmable via an electromagnetic field, the hacker has lots of options: open a cash register drawer, open a window on the computer, or download and install malware. "You only need to distract the operator for a couple seconds -- it all happens very quickly," Beardsley explained.

In effect, the attack turns the magstripe reader into a keyboard. "If you've seen the rubber ducky attacks with the exposed USB ports, you know that something that mimics a keyboard gives you direct access to the [POS] device," Beardsley added. The vulnerability affects everything from hotel keys to loyalty cards, gas cards, or special access cards for first responders to use elevators.

Rapid7 has already notified the manufacturer, Samsung, but the vulnerability affects nearly all vendors' POS devices, which aren’t that different from one another, according to Beardsley. There's also been no official response from Samsung, though Beardsley assumes they're doing their own testing and due diligence. Rapid7 is also working with CERT for handling the vulnerability disclosure.

Beardsley and Weston point to two areas that need to be fixed. The first is not to allow magstripe readers to be used as a keyboard, which can be addressed by new driver definitions, "an OS fix," Beardsley said. Secondly, because the devices can be tricked into taking certain types of commands, the applications they use should limit the kind of data they're expecting. "Credit card data is ASCII, not anything exciting. But the fact I can inject keystrokes, like the F8 key, is unexpected," Beardley said. "It's a fundamental design flaw in how these Windows-enabled systems run."

Brute-forcing a magstripe hotel card is also remarkably simple; the data it contains is encoded but not encrypted, Beardsley said. An attacker with a magstripe hotel card will look for the folio number associated with check-in, which is usually six digits and tends to be assigned incrementally (123456, 123457, 123458…) rather than randomly. The attacker will also look for the room number on the magstripe card and the checkout date. All three pieces of data have to be accurate for a room doorlock to open.

"Once you have a device, it's short work to guess a number on the fly that opens a lock – the doors to guest rooms," Beardsley said. By replacing incremental IDs with random ones and expanding the number of digits in the data fields, hotels and other affected industries can help address the vulnerabilities – a cheaper, easier fix than using encrypted cards. "Encryption will happen at some point, but today it's pretty much the same basic technology from the 1970s," Beardsley said.

Related Content From Black Hat 2016:

 

Terry Sweeney is a Los Angeles-based writer and editor who has covered technology, networking, and security for more than 20 years. He was part of the team that started Dark Reading and has been a contributor to The Washington Post, Crain's New York Business, Red Herring, ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jmyerson
50%
50%
jmyerson,
User Rank: Apprentice
8/4/2016 | 5:30:50 PM
Re: Vulnerabilities lurk everywhere
Hi Terry,

Yes I think white hats can be one or two steps ahead of black hats as long they are able to find and fix vulnerabilities in pentest tools.  A third party (legitimate, of course) discovered and reported to a vendor on a popular security tool's vulnerabilities,
T Sweeney
50%
50%
T Sweeney,
User Rank: Moderator
8/4/2016 | 1:58:37 PM
Re: Vulnerabilities lurk everywhere
Hi Judith... always good to hear from you. Yes, white hats and black hats, always in constant escalation with each other. Do you really think the white hats are one or two steps ahead most the time?
jmyerson
100%
0%
jmyerson,
User Rank: Apprentice
8/3/2016 | 5:31:40 AM
Vulnerabilities lurk everywhere
This is the first time I saw this marvelous article of yours. Vulnerabilities lurk everywhere not just at the hotels.  We try to stay one or two steps ahead of the hackers throough security awareness, security training, better vulnerability management and better pentest tools and techniques.
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
Capital One Breach: What Security Teams Can Do Now
Dr. Richard Gold, Head of Security Engineering at Digital Shadows,  8/23/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.