Its a Payment Terminal - Its My Arcade - Its Everywhere - It Cost Me $9

The speaker bought a retail payment terminal for about nine dollars to see whether a production unit, with no debug shell and only Wi-Fi exposed, could be compromised. Physical teardown was blocked by tamper mesh and key erasure on case opening, so attention moved to a service on port 5555 that spoke an ADB-like protocol. Its handshake skipped the authentication step Android requires, granting full file system access without credentials.

Code execution took more work. A debug-level variable in signature checks looked promising but turned out to be a different variable with a similar name. Later, the installer was found to exempt library packages from signature verification through a single flipped flag, and an archive extraction setting lacked the bit that guards against symbolic links. A crafted package could redirect writes into a system library loaded by every process, and a reboot restored the read-only partition, so testing stayed safe. An AI agent did much of the reverse engineering and retried failed exploit attempts, while the human handled hardware and reboots.

The vendor's replies moved from calling the firmware unsupported, to saying the issues did not exist in the latest version, to fixing them only after a public talk date was set. Units sold this year still ship with the vulnerable firmware, and no release notes or public updates were available. The takeaway is that certification or retail availability says nothing about whether a device is patched, and that buyers and researchers need transparent advisories with fixes tied to versions.