Very Pwned - Hacking Verifone’s Card Machine Three Times in a Row

The talk follows an assessor who tested Verifone P400+ payment terminals during yearly PCI assessments. Each year the speaker found a new route to root after the vendor patched the previous one. The first foothold was a command injection in the file manager, triggered by a crafted MP3 filename, which gave a low-privilege shell. A later firmware update path let an archive be extracted in a way that wrote files outside the staging directory before signature checks ran.

The research continued through an unauthenticated recovery environment, a point-of-sale protocol that allowed file reads and writes, and HTML rendering that passed filenames unsafely to a media player. Further chains abused a privileged broker, a downgrade of a patched component, and a web server started from a writable location. With root, the speaker disabled the kernel's role-based access control, kept a persistent backdoor by recalculating the integrity hash of the protected filesystem, and ran Doom in a chroot.

The final section showed that plaintext card track data and account numbers appeared in process traces and memory dumps, despite the device's secure-world design. The vendor fixed most issues, but the card data exposure remained for this end-of-sale model. The practical takeaways are to patch terminals regularly, not to rely on certification alone, and to push vendors for more openness about device security.