Contactless Overflow: Code Execution in Payment Terminals & ATMs
Josep Rodriguez demonstrates contactless buffer overflow vulnerabilities in NFC payment readers across major ATM and POS brands, enabling ATM jackpotting.
Summary
The Attack Surface of Contactless NFC Payment Readers
NFC payment terminals deployed across major retail stores, gas pumps, and ATMs must parse complex Application Protocol Data Units (APDUs) from unauthenticated wireless taps.
Discovering APDU Buffer Overflows Across Major Vendors
Josep Rodriguez analyzes firmware across seven leading terminal vendors (including IDTech, Ingenico, Verifone, and BBPOS), uncovering memory corruption bugs in APDU parsers.
Compromising Terminals via Malicious Android Taps
Using a custom Android application, an attacker can transmit malformed APDUs during an NFC exchange, executing arbitrary shellcode on bare-metal and embedded Linux readers.
Chaining Host USB Exploits and ATM Jackpotting
Rodriguez demonstrates pivoting from compromised NFC readers over internal USB connections to exploit host operating system SDKs, enabling physical ATM cash dispensing jackpotting.
Related talks
Main Stage·47 min
Roy Davis
Roy Davis evaluates modern retail ATM defenses, demonstrating physical bypasses, electronic lock manipulation, and safe compromise techniques that defeat recent security patches.
Main Stage·50 min
Trey Keown · Brenda So
Trey Keown and Brenda So reverse engineer automated teller machines, defeating firmware code signing and discovering network zero-days to jackpot ATMs remotely.
Kaspersky·3 min
Analysts investigate attack surfaces and defenses concerning Santiago Pontiroli and Roberto Martinez explain what ATM jackpotting malware is.