phar - No Mas: How Side Channel Flaw Opens ATM, Pharmacies, and Gov to Attack
Demonstrates timing side-channel attacks against ATM PIN pads, pharmacy dispensing systems, and government ID verification terminals.
Summary
Timing Side Channels in Physical Infrastructure
phar presents timing side-channel vulnerabilities discovered in physical security infrastructure — ATM PIN pads, automated pharmacy dispensing systems, and government ID verification kiosks.
The Timing Oracle
In each target system, cryptographic operations (PIN verification, prescription authorization, identity validation) exhibit measurable timing differences based on whether partial PIN/credential bytes match, enabling byte-by-byte brute force through a timing oracle.
ATM PIN Pad Timing Leak
The PIN verification process in vulnerable ATM firmware leaks timing information proportional to the number of correct prefix bytes, reducing a 4-digit PIN brute force from 10,000 attempts to approximately 40 measurements — making physical PIN capture practical without skimmers.
Pharmacy Dispensing System
Automated pharmacy dispensing systems verify prescription pickup using a 4-digit authorization code with the same timing oracle vulnerability, enabling unauthorized medication access through a timing-based brute force attack.
Related talks
Main Stage·47 min
Roy Davis
Roy Davis evaluates modern retail ATM defenses, demonstrating physical bypasses, electronic lock manipulation, and safe compromise techniques that defeat recent security patches.
Main Stage·43 min
Elie Bursztein
Google researcher Elie Bursztein combines deep learning side-channel attacks with AI explainability to pinpoint and remediate cryptographic hardware leakage.
Payment Village·41 min
Meadow Ellis
Meadow Ellis demystifies ATM security architecture, explaining internal components, cash dispenser controllers, and why legitimate ATM research is so difficult.