Compromising Windows Based Internet Kiosks

Architecture and Background

DEF CON 16 - Paul Craig: Compromising Windows Based Internet Kiosks Internet Kiosks have become common place in today's Internet centric society. Public Internet Kiosks can be found everywhere, from Airports, Train stations, Libraries and Hotels to corporate lobbies and street corners. Kiosks are used by thousands of users daily from all different walks of life, creed, and social status.

Vulnerability Analysis

Internet kiosk terminals often implement custom browser software which rely on proprietary security mechanisms and access controls. Kiosks are designed to limit the level of access a user has to the Internet kiosk, and attempt to thwart malicious activity. Kiosk users are prohibited from accessing the Kiosk's local file system, or the surrounding local network attached to the Kiosk.

Exploitation and Demonstrations

The only guaranteed functionality is a "secured" web-browser. For a service so common-place, there has been practically zero research regarding the security of Internet Kiosk software. This talk will cover Internet Kiosk software exploitation techniques, and demonstrate multiple methods of compromising Windows based Internet Kiosk terminals.

Remediation and Defensive Strategies

Paul Craig is a principal security consultant at Security-Assessment.com based in Auckland New Zealand. Paul is a kiwi hacker with a passion for breaking technology whenever possible. Its highly suggested to buy Paul a beer whenever possible. For copies of the slides and additional materials please see the DEF CON 16 Archive here: