USA 2012

### Overview In this presentation, Rafa and Nils from MWR InfoSecurity examine the software security posture of point-of-sale (POS) payment terminals. While physical security, anti-skimming protections, and hardware tampering have historically received significant attention, software and firmware attack surfaces on these devices are frequently overlooked. Using an entirely black-box approach with terminals acquired second-hand from eBay and private sellers, the researchers identify critical software flaws across multiple widely used devices, demonstrating arbitrary code execution via malicious smart cards and remote network interfaces.

### Key Topics - **Payment Terminal Ecosystem & Second-Hand Risks:** Payment terminals represent single points of failure relied upon by retailers and consumers. Secondary-market devices often arrive fully configured with active payment applications, proprietary logos, and sensitive settings intact due to liquidation without data sanitization. - **EMV Protocol & Smart Card Interaction:** An overview of chip and pin (EMV) transactions, application protocol data units (APDUs), and the structure of EMV records formatted with Tag-Length-Value (TLV). Nested and length-delimited structures in EMV records introduce classic parsing vulnerabilities. - **Black-Box Testing Methodology:** Due to nondisclosure agreements tied to vendor SDKs, the researchers built custom testing tooling using Basic Cards programmed to log APDU commands, replay them against legitimate payment cards via a PC, and sequentially emulate responses to map terminal communication.

### Technical Details & Case Studies - **Case Study 1 (Custom OS Terminal - Network & EMV Exploitation):** On an ARM-based terminal running a custom OS and third-party payment software, the researchers discovered a stack-based buffer overflow via network communication. Lacking an interactive debugger, they deduced the stack layout and dump memory iteratively across an established TCP connection. They also uncovered a stack-based buffer overflow in EMV TLV parsing. Controlling only 40 bytes after the initial crash, they leveraged return-oriented programming (ROP) to request subsequent stages from the smart card. They loaded an 870-byte ARM Thumb payload that commandeered the screen and receipt printer to run an interactive racing game ("Pin Pad Racer"). - **Case Study 2 (Embedded Linux Terminal - Remote Administrative Spoofing):** Targeting a signature-based US terminal running embedded Linux, BusyBox, and a vendor management application, the researchers analyzed the remote management interface. When the device attempted periodic or boot-time administrative check-ins, the researchers spoofed the remote management server, pushed an unsigned application (bypassing application signature enforcement by launching directly from the underlying OS), enabled Telnet, and reset the root password for full system compromise. - **Case Study 3 (Malicious Card Infection & Data Harvest):** On another popular payment terminal running a custom OS, deeper EMV parsing flaws were exploited using a two-stage attack. The initial malicious card ("Tinkerbell") triggered card-handling flaws to install an in-memory backdoor hooked into payment transactions. Subsequent legitimate customer card transactions and PIN entries were logged to internal memory. Later, an attacker inserted a second card ("Winnie the Pooh") to authorize an unverified payment and exfiltrate all captured credit card numbers and PINs onto the smart card's storage.

### Takeaways & Future Work The research underscores a dangerous disparity between heavy hardware tamper protections and lax software security in payment infrastructure. Common systemic issues included unchanged default credentials and hardcoded backdoor passwords ("super mega password"). Although memory protections were largely nonexistent, the vendors were notified; one vendor produced a patch within three weeks. Proposed future areas of research include evaluating the security of custom user-mode Wi-Fi/Bluetooth stacks, exploring OS privilege escalation and persistence mechanisms via unsigned configuration files, and assessing NFC implementations that share underlying EMV parsing code.