Jackson Thuraisamy & Jason Tran

### Overview In this presentation at NorthSec, security practitioners Jackson Thuraisamy and Jason Tran discuss practical techniques for assessing and hacking Point of Sale (POS) systems. While industry standards such as PCI DSS and PA-DSS aim to secure cardholder data and payment applications, real-world implementations frequently suffer from design flaws, configuration mistakes, and bypassable controls. The speakers walk through testing methodologies, physical access vectors, kiosk escapes, and in-depth application vulnerabilities across desktop, enterprise server, and mobile POS systems.

### Key Topics - **POS Security Standards and Gaps**: An analysis of PA-DSS requirements versus real-world risk. PA-DSS often focuses on post-authorization storage but can overlook unencrypted data held in memory or stored in cleartext before transmission, insecure database connections, default credentials, and perimeter exposure. - **Physical and Hardware Access**: Overcoming physical enclosures (e.g., picking locks or removing port covers on systems like RealPOS, pulling out USB port blockers using bent paperclips) to attach physical keyboards and mice. Reprogramming existing barcode scanners via Advanced Data Formatting to send keyboard shortcuts like Windows+R or Ctrl+O. - **Kiosk Breakout Techniques**: Bypassing locked-down Windows kiosk environments through interrupted administrative startup scripts, sticky keys, application dialogs (such as Internet Explorer add-on menus), Explorer preview panes, and media key shortcuts. - **Testing Methodology**: Recommending a two-specialist, two-device setup for assessments: one tester works on a production-hardened OS to focus on kiosk breakouts and privilege escalation, while a second tester examines the application on an unhardened environment to target application-layer vulnerabilities directly.

### Technical Details - **Memory Scraping and Magstripe Interception**: Exploring USB magnetic stripe readers operating in keyboard emulation mode. Attackers can monitor keyboard events with simple API hooks to capture Track 1 and Track 2 data. Where systems use card swipe IDs without secondary passwords, sequential ID tampering enables credential reuse or privilege escalation. - **Two-Tier Desktop POS Exploitation**: In a system connecting directly to Microsoft SQL Server without an application tier, database credentials in an INI settings file were encrypted using symmetric keys hardcoded in the client binary. The speakers decompiled the binary, identified an unused `decryptString` routine, and patched the executable to decrypt the database credentials via the GUI. Further client-side analysis showed cardholder data was decrypted on the client, exposing cached pricing tables and user IDs. - **Oracle OPERA Property Management System**: Demonstrating three chained vectors against Oracle OPERA: 1. Session hijacking via exposed session logs located in a temporary static directory, allowing administrative impersonation and querying of encrypted card data via the OPERA SQL tool. 2. Exposure of direct database connection strings via unauthenticated server pages. 3. Remote code execution as SYSTEM by exploiting a diagnostic process information servlet with command injection via a process ID (`pid`) parameter, chained with an information leak servlet (revealing `opera.home`) and a file upload servlet to supply missing required files. 4. Decryption of Triple DES credit card data stored in the database by dumping and de-obfuscating the PL/SQL package body containing stored encryption keys. - **Mobile POS on iOS (Appcelerator Titanium)**: Assessing an in-store roaming payment application compiled with Titanium. Using Frida on a jailbroken iOS device, the presenters hooked internal decryption routines to extract plain JavaScript source files from memory. This revealed that the store app communicated with a payment app via a custom URI scheme authenticated by a hardcoded token. Manipulating parameters allowed an attacker to flip the mode from payment to refund with arbitrary amounts.

### Takeaways - PA-DSS certification does not guarantee absolute security; severe vulnerabilities regularly persist in certified systems. - Gaining Domain Admin (DA) is rarely necessary in POS assessments; the primary objective is cardholder data, which must be extracted at the application or database layer. - Attackers frequently bypass OS kiosk constraints by targeting third-party vendor applications, client-side decryption routines, and peripheral interfaces. Thorough reconnaissance, reading documentation, and code analysis yield the most critical attack paths.