1 00:00:03,650 --> 00:00:07,520 Hello, this is Point-of-Sale Terminal Security Uncovered. 2 00:00:07,560 --> 00:00:13,780 My name is Alexey Stanikov, I am a hardware researcher, and I am going to talk about payment hardware security. 3 00:00:14,100 --> 00:00:20,500 When I started this research, I faced the lack of useful information related to these kinds of devices. 4 00:00:21,400 --> 00:00:26,280 All vendors still keep it a secret that there are technologies used in such hardware. 5 00:00:26,420 --> 00:00:31,920 Because of many reasons, Point-of-Sale Terminal Security is still a blind spot. 6 00:00:31,920 --> 00:00:40,020 This talk is a combination of two years of research related to payment devices, which handles your payment card data. 7 00:00:40,040 --> 00:00:48,540 I am going to present general approach to understand the internals of hardware, common weaknesses, and additionally, some of our results. 8 00:00:48,760 --> 00:00:50,380 So, let's start. 9 00:00:53,220 --> 00:00:59,000 As you can see, this presentation is divided into two main parts – hardware and software. 10 00:00:59,000 --> 00:01:05,980 Every topic in this list could be a separate talk, but I tried to highlight the most important things for each of them. 11 00:01:07,300 --> 00:01:12,360 At the first step, we have to understand that a POS system is not equal to POS terminal. 12 00:01:12,800 --> 00:01:20,220 Basically, Point-of-Sale Terminal, or Pinpad, is a part of Point-of-Sale system, or just a standalone device. 13 00:01:20,680 --> 00:01:27,320 Also, Point-of-Sale system may have a register, which in most cases is built on Windows-based PC. 14 00:01:27,320 --> 00:01:34,100 Additional hardware, like a barcode scanners, and can be integrated to ERP systems. 15 00:01:34,380 --> 00:01:42,960 Often, when we see the title like someone hacked the POS, it means hack of register or cashier workstation. 16 00:01:43,260 --> 00:01:49,160 Let's look at typical data flow in such systems, to define entry points for intruder. 17 00:01:49,400 --> 00:01:52,900 This is typical Point-of-Sale interaction scheme. 18 00:01:53,000 --> 00:01:55,680 What can go wrong in this case? 19 00:01:55,680 --> 00:01:59,620 As you can see, Pinpad has two kinds of interactions. 20 00:01:59,620 --> 00:02:06,820 First one is an interaction with terminal management system and payment processor through the Internet. 21 00:02:07,240 --> 00:02:13,040 Second one is an interaction with Point-of-Sale application using local network. 22 00:02:13,420 --> 00:02:23,540 Communication channel between the Pinpad and third-party application or Point-of-Sale application can be configured in two different ways, secure and insecure. 23 00:02:23,540 --> 00:02:31,960 Common attack in this case is indifference between amount shown on Pinpad and amount really charged from your card. 24 00:02:32,360 --> 00:02:35,180 This is about vulnerable configuration. 25 00:02:35,400 --> 00:02:40,000 But I want to pay attention to the most common thing in my talk. 26 00:02:40,000 --> 00:02:47,620 Just keep in mind to keep configuration as secure as possible, if you are maintainer of such systems. 27 00:02:48,420 --> 00:02:52,860 I am sure that you recognized at least two of these terminals. 28 00:02:52,860 --> 00:02:57,740 First two vendors are well-known for United States and European countries. 29 00:02:57,900 --> 00:03:04,820 And as far as I know, PAX is widely used in Russia and Asian countries because it's cheaper than previous two. 30 00:03:05,100 --> 00:03:10,320 If you try to connect to Pinpad via network connection, you will be surprised. 31 00:03:10,660 --> 00:03:16,760 There are no listening ports and one or two outcoming connections to some bank servers. 32 00:03:16,780 --> 00:03:20,520 In this case, you have to look at other physical ports. 33 00:03:20,520 --> 00:03:25,580 The interfaces exposed to intruder are basically attack surface. 34 00:03:25,640 --> 00:03:39,860 They can be divided to general communication interfaces like Ethernet, RS-232, different wireless interfaces and specific payment card interfaces, EMV and NFC. 35 00:03:39,860 --> 00:03:55,400 In some documentation you may find information that some of them are not used, but in real life operating system has drivers and handlers for some specific peripherals like barcode scanners and external receipt printers. 36 00:03:56,480 --> 00:04:01,620 The next important thing is rules how the payment hardware should be built. 37 00:04:01,660 --> 00:04:08,740 I know that regulation is a boring stuff, but it may provide a lot of information about physical security tests and behavior. 38 00:04:08,740 --> 00:04:13,000 Every payment terminal should satisfy these requirements and regulations. 39 00:04:13,000 --> 00:04:18,180 In any other cases, it can be approved to work with payment data. 40 00:04:18,380 --> 00:04:22,980 The first one is Pinintr devices physical security requirements. 41 00:04:22,980 --> 00:04:31,600 It defines protection measures against pin disclosing attacks like tamper detection, response mechanisms and other cases. 42 00:04:31,600 --> 00:04:41,880 For example, if reader permits access to internal areas, it is not possible using this access area to insert pin disclosing bug. 43 00:04:42,780 --> 00:04:48,360 Also sensitive functions or information are only used in protected areas. 44 00:04:49,300 --> 00:04:51,980 The next one is pin transaction security. 45 00:04:51,980 --> 00:04:53,820 They are almost the same. 46 00:04:53,820 --> 00:04:57,040 Both have purpose to prevent pin disclosing. 47 00:04:57,040 --> 00:05:04,160 These requirements also define tamper protection, sensitive data erasing, etc, etc. 48 00:05:04,680 --> 00:05:08,180 And what is the sensitive data is a question. 49 00:05:08,560 --> 00:05:13,220 Every vendor chose their own interpretation and way to erase. 50 00:05:13,960 --> 00:05:18,920 Let's have a look to common security mechanisms and anti-tampering. 51 00:05:18,920 --> 00:05:39,980 According to previous rules and payment system requirements, the following events should be registered, like a case opening, security circuit damage, power supply anomalies, also temperature anomalies, accelerometer anomalies, and finally, debugging interfaces connection. 52 00:05:40,000 --> 00:05:44,360 Two or more of them should be interpreted as intrusion. 53 00:05:44,360 --> 00:05:55,460 As a result, the terminal should lock the event, erase encryption keys, delete sensitive information, and finally become brick. 54 00:05:55,760 --> 00:06:03,980 This slide shows you tamper detection list we have extracted from Ingenio-Catalium-2 operating system code. 55 00:06:03,980 --> 00:06:14,660 As you may see, there are a lot of power supply detectors, JTAG connection detector, and mechanical tamper detectors like meshes or switches. 56 00:06:15,180 --> 00:06:17,780 Let's look at each of them. 57 00:06:18,100 --> 00:06:23,700 When you disassemble Ingenica pinpad, you will see a lot of membrane switches. 58 00:06:23,740 --> 00:06:28,880 Some of them are assigned to real buttons like numeric and navigation buttons. 59 00:06:28,880 --> 00:06:31,180 They are highlighted with green color. 60 00:06:31,180 --> 00:06:34,060 But what are the red membranes? 61 00:06:34,100 --> 00:06:36,540 They are mechanical tamper detectors. 62 00:06:36,540 --> 00:06:39,580 They are pressed by the pinpad body when assembled. 63 00:06:39,800 --> 00:06:51,800 When you start to rotate any screw in order to disassemble, the microcontroller receives a hardware interrupt, wakes up, and do defined actions to protect its data. 64 00:06:51,840 --> 00:06:57,160 Another critical measure is a wire mesh, as shown on this slide. 65 00:06:57,160 --> 00:07:01,900 It has two main purposes, anti-drilling protection and obfuscation. 66 00:07:01,900 --> 00:07:08,640 Case on this slide covers smart card reader and registers drilling when protection circuit is destroyed. 67 00:07:08,760 --> 00:07:14,480 This kind of meshes you also may find on print circuit boards and ribbon cables. 68 00:07:14,760 --> 00:07:26,820 And finally, this is example of tampered devices as a result of some of our attempts. 69 00:07:26,820 --> 00:07:32,840 Some of them became unusable, and some of them asks you for factory password. 70 00:07:32,840 --> 00:07:37,100 The main idea is when device is tampered, it should be passed to service. 71 00:07:37,520 --> 00:07:46,220 Basically, only authorized service may restore the device, and only bank service can restore it and lower the application. 72 00:07:46,360 --> 00:07:50,180 And what consequences anti-tampering bypass may have? 73 00:07:50,180 --> 00:07:56,300 One example related to mobile point-of-sale demonstrated on Black Hat United States. 74 00:07:56,300 --> 00:08:01,780 The researchers realized that this device doesn't have any anti-tampering detectors. 75 00:08:02,020 --> 00:08:08,720 They found points on circuit to connect in order to obtain encrypted magstripe data. 76 00:08:08,720 --> 00:08:14,660 And finally, it allows them to collect sensitive payment information directly from device. 77 00:08:14,840 --> 00:08:19,320 Another cool research made by SR Labs and presented on CCC. 78 00:08:19,320 --> 00:08:27,480 Among their findings were anti-tampering bypass, unlocked and exposed JTAG connection, and software vulnerabilities. 79 00:08:27,600 --> 00:08:31,660 What you may do with such vulnerabilities, we will discuss a bit later. 80 00:08:31,920 --> 00:08:38,260 Anyway, these findings compromised the whole device, and now it's deprecated. 81 00:08:40,000 --> 00:08:43,660 Another two examples related to the relay attacks and scheming. 82 00:08:43,660 --> 00:08:46,600 You can read more using the links below. 83 00:08:46,600 --> 00:08:51,380 And now it's time to talk about debugging maintenance features. 84 00:08:52,880 --> 00:08:59,020 When you disassembled the point-of-sale terminal, you realized that it is a very complex device. 85 00:08:59,060 --> 00:09:04,020 Your imagination and background paint something like what you see on this slide. 86 00:09:04,020 --> 00:09:09,600 Because you know that the iPhone, for example, has a very specific JTAG adapter. 87 00:09:09,600 --> 00:09:17,800 In this case, you can find some forum topics about firmware uploading, tamper clearing, and related stuff. 88 00:09:18,100 --> 00:09:21,020 But this is what you see in reality. 89 00:09:21,760 --> 00:09:29,340 Verifone and PEX use the adapter from simple RS-232 to Ethernet connector with custom wiring. 90 00:09:29,340 --> 00:09:31,840 You can reproduce them yourself. 91 00:09:31,900 --> 00:09:37,440 Injenica used just a usual USB port for firmware uploading and service actions. 92 00:09:37,440 --> 00:09:45,440 These cables are used for factory reset, clear security flags, upload firmware, and sometimes for specific debugging. 93 00:09:45,820 --> 00:09:53,800 But at the moment we still don't have firmware and don't know any information about architecture of microcontroller. 94 00:09:53,820 --> 00:09:56,420 And now we should fill this gap. 95 00:09:56,860 --> 00:10:00,300 Teardown is my favorite step when I work with new hardware. 96 00:10:00,300 --> 00:10:08,840 It delivers a lot of happiness to you, as a favorite thing to all children is to broke new toy and see what do they have inside. 97 00:10:10,060 --> 00:10:16,100 In the case if you already have the firmware, it's good to understand the internals of hardware. 98 00:10:16,200 --> 00:10:26,460 If you properly define the exact CPU or MCU, it helps you to understand the operating system internals, peripherals, and other helpful things. 99 00:10:26,460 --> 00:10:30,400 This is an example of old model made by Verifone. 100 00:10:30,400 --> 00:10:33,500 It built using Samsung ARM-based CPU. 101 00:10:33,740 --> 00:10:37,160 You may read more about using a link below. 102 00:10:50,960 --> 00:10:54,920 But our region of interest is more modern devices. 103 00:10:54,920 --> 00:10:59,820 This is the internals of modern Verifone 520. 104 00:10:59,960 --> 00:11:03,620 Here you can see the branded MCU and non-flash memory. 105 00:11:03,640 --> 00:11:07,580 Definitely this MCU should be relatively popular one. 106 00:11:07,580 --> 00:11:10,220 But in this case it is rebranded. 107 00:11:10,220 --> 00:11:14,020 It makes more difficult to understand the firmware internals. 108 00:11:14,440 --> 00:11:19,820 In this case firmware could be dumped from non-flash memory using non-programmer. 109 00:11:19,820 --> 00:11:24,060 Luckily I found one guy in Twitter who solved the same task. 110 00:11:24,860 --> 00:11:28,300 He defined the exact model of MCU by pinout. 111 00:11:28,300 --> 00:11:33,100 It was Broadcom Secure MCU BCM5892. 112 00:11:33,340 --> 00:11:39,700 You can find header files with definitions of all peripherals in some Linux kernel sources. 113 00:11:39,700 --> 00:11:43,900 There are some other ways to determine the exact MCU. 114 00:11:44,000 --> 00:11:47,600 And I am going to show one of them in next slides. 115 00:11:49,720 --> 00:11:52,140 The next one is Ingenico pinpad. 116 00:11:52,140 --> 00:11:56,680 There is basically no difference is it portable or countertop. 117 00:11:56,740 --> 00:12:01,300 They all built using the same hardware and uses the same operating system. 118 00:12:01,400 --> 00:12:04,040 I am sure it is well known for all of you. 119 00:12:04,880 --> 00:12:08,140 You saw this photo on the slide with tampering detectors. 120 00:12:08,140 --> 00:12:13,160 In this case pay attention to the microcontroller under the membrane. 121 00:12:13,960 --> 00:12:15,920 It is branded cryptoprocessor. 122 00:12:15,920 --> 00:12:18,860 They called it booster in their binaries. 123 00:12:18,940 --> 00:12:27,680 It stores the encryption keys inside and handles the most of critical cryptography tasks like updates, signature checks, etc. 124 00:12:30,440 --> 00:12:33,600 This is other side of print circuit board. 125 00:12:33,600 --> 00:12:36,760 And we see another branded microcontroller. 126 00:12:36,760 --> 00:12:41,040 They called it application processor according to its purpose. 127 00:12:41,180 --> 00:12:45,840 Exactly you can find any information about this microcontroller. 128 00:12:46,040 --> 00:12:52,480 As in previous case flash memory in upper left corner stores operating system and application codes. 129 00:12:54,400 --> 00:13:09,170 You can desolder the flash memory in order to obtain operating system and application code for research. 130 00:13:09,170 --> 00:13:16,750 In this case it is good to know the exact MCU to understand work with peripherals and other peculiarities. 131 00:13:17,090 --> 00:13:22,190 One other important thing is flash contents you are going to dump is compressed. 132 00:13:22,190 --> 00:13:25,490 You should solve unpacking task by yourself. 133 00:13:25,690 --> 00:13:33,610 Booster probably is one of Atmel Cortex-M3 MCU series but in unusual package. 134 00:13:33,610 --> 00:13:39,630 I can't do anything in this case without laboratory and tools for decaping. 135 00:13:39,630 --> 00:13:43,490 Application processor looks like general purpose microcontroller. 136 00:13:43,490 --> 00:13:46,630 And I tried to define the exact model. 137 00:13:47,890 --> 00:13:51,130 This is another scenario to define MCU. 138 00:13:51,130 --> 00:13:55,550 At the first step I desoldered this MCU and defined the exact package. 139 00:13:55,550 --> 00:14:00,490 At the next step I made list of all microcontroller candidates for this package. 140 00:14:00,870 --> 00:14:09,510 Then I defined power supply pins by PCB using multimeter and filtered all unfit candidates by pinout. 141 00:14:09,670 --> 00:14:15,310 The next thing you can see in testpad close to the microcontroller. 142 00:14:15,490 --> 00:14:20,910 It may be interface used during production for factory flashing and setting up. 143 00:14:20,910 --> 00:14:25,390 This hypothesis is confirmed by pull-up resistor block. 144 00:14:25,770 --> 00:14:28,310 The next list I made was pinout candidates. 145 00:14:28,310 --> 00:14:33,290 At the moment I had list of microcontrollers only by microchip. 146 00:14:33,290 --> 00:14:35,930 This list is on the slide. 147 00:14:36,710 --> 00:14:46,550 And as a result I defined G-tag pinout and I think the exact model is AT91SAM9G20. 148 00:14:46,550 --> 00:14:52,770 We tried to apply memory and register maps to our banners and it's fit. 149 00:14:52,810 --> 00:14:56,910 But sadly the G-tag is turned off. 150 00:14:56,910 --> 00:15:01,670 The next case of pinpads is Chinese PAX point-of-sale terminals. 151 00:15:01,670 --> 00:15:05,590 They are very similar to Verifone by their internals. 152 00:15:05,590 --> 00:15:08,820 But it is completely different software inside. 153 00:15:09,430 --> 00:15:14,830 When you disassemble one of them you will find the same microcontroller. 154 00:15:14,830 --> 00:15:24,990 When you disassemble one of them you will find the same microcontroller and almost the same non-flash memory as used in all modern Verifones. 155 00:15:25,750 --> 00:15:34,170 Non-flash contents exposes to you encrypted and uncompressed binaries of proprietary operating system and application. 156 00:15:34,170 --> 00:15:37,830 Exactly the file system structure is proprietary. 157 00:15:38,790 --> 00:15:45,130 Now you can buy a couple of them from eBay for example and start your own payment hardware research. 158 00:15:46,390 --> 00:15:49,970 And a few words about tampering reset. 159 00:15:49,970 --> 00:15:54,910 Definitely all terminals have different ways to clear tampering flags. 160 00:15:54,910 --> 00:15:59,170 Some of them, like PAX, uses simple hard-coded passwords. 161 00:15:59,170 --> 00:16:04,570 Verifone models needed to upload dummy encryption keys to clear tamper flags. 162 00:16:04,570 --> 00:16:10,650 And in Jenica, as far as I know, storage security flags and keys in separate hardware controller. 163 00:16:10,770 --> 00:16:14,710 And it can be reset using an external hardware. 164 00:16:15,430 --> 00:16:22,330 Also some forum topics contain the information about maintenance, tampering, clearing, etc, etc. 165 00:16:22,870 --> 00:16:29,610 Here you may see tips from closed Russian forum about hard-coded passwords and special software. 166 00:16:29,610 --> 00:16:36,750 The true way to understand all things related to tampering is reverse engineering. 167 00:16:37,270 --> 00:16:41,090 What can you do if you can clear tampering flags? 168 00:16:41,290 --> 00:16:48,370 For example, when you cleared these flags, you are able to upload the application again and play with the configuration. 169 00:16:49,310 --> 00:16:53,490 You may try to write and upload your own firmwares. 170 00:16:53,490 --> 00:17:02,450 Tamper clearing may help you to restore after your experiments or use it opened in order to research internal interfaces using logical analyzer. 171 00:17:02,790 --> 00:17:07,650 Some of the pinpads are able to turn on some debug capabilities. 172 00:17:08,030 --> 00:17:12,750 And in this case, you can run any applications under the debugger. 173 00:17:13,190 --> 00:17:19,730 Now when we know some information about the hardware and connections, we should cover another blind spot. 174 00:17:19,730 --> 00:17:21,730 Payment card interfaces. 175 00:17:21,730 --> 00:17:27,350 EMV is a payment method based upon a technical standard for smart payment cards. 176 00:17:27,350 --> 00:17:35,210 EMV originally stood for EuroPay, MasterCard and Visa, the three companies which created the standard. 177 00:17:35,270 --> 00:17:41,630 In most cases, the hardware allows you to intercept and modify payment card data isn't cheap. 178 00:17:41,630 --> 00:17:46,670 In this case, we used a device called Smart Card Detective with custom firmware. 179 00:17:46,670 --> 00:17:55,010 Now it's not supported by original developer, but you can find the PCB and sources to assemble one for you. 180 00:17:55,010 --> 00:17:58,570 Here's a link with some information related to this device. 181 00:17:59,350 --> 00:18:06,450 In order to understand the EMV packets, you should read a bit about tagline value format. 182 00:18:06,450 --> 00:18:14,830 Then you should go to the official site of EMV and you will be surprised by amount of information what you should read. 183 00:18:14,830 --> 00:18:19,990 Now you see some information available for download and related to EMV. 184 00:18:20,150 --> 00:18:30,250 Every of these documents is very thick because it defines all things started from physical layer and deep description for every tag of EMV. 185 00:18:30,770 --> 00:18:35,130 I recommend you to read them briefly at least. 186 00:18:38,300 --> 00:18:42,480 Another interesting thing is NFC interface. 187 00:18:42,480 --> 00:18:47,900 Frame format is close to the EMV, but the physical layer is near field communication. 188 00:18:48,100 --> 00:18:52,900 There are some approaches to start to work with NFC depends on your skills. 189 00:18:53,220 --> 00:18:55,730 The most simple of them is Proxmark. 190 00:18:56,060 --> 00:19:05,440 Another way is assemble your own sniffer or repeater based on some available stuff like PN532 or TRF-based board. 191 00:19:05,440 --> 00:19:11,540 Also you can use Android device with NFC or something else that fits to your skills. 192 00:19:11,540 --> 00:19:17,400 Our assembly was PN532 based boards with Raspberry Pi Zero. 193 00:19:17,400 --> 00:19:19,900 It was cheap and dirty trick as you see. 194 00:19:19,900 --> 00:19:24,580 But the components for it available literally everywhere. 195 00:19:25,200 --> 00:19:27,880 And another batch of documentation. 196 00:19:27,880 --> 00:19:30,580 Now it is related to the NFC. 197 00:19:30,880 --> 00:19:34,540 There are many descriptions of contactless payment transactions. 198 00:19:34,540 --> 00:19:38,000 I also recommend read it briefly at least. 199 00:19:38,000 --> 00:19:39,580 Why is it important? 200 00:19:39,580 --> 00:19:43,620 Every card payment interaction has its own handler. 201 00:19:44,220 --> 00:19:49,020 And you are able to fuzz every check and you will be surprised. 202 00:19:49,540 --> 00:19:55,620 And now it is time to discuss the software and firmware part of point-of-sale terminals. 203 00:19:58,230 --> 00:20:02,690 During our research we faced two different operating systems. 204 00:20:02,690 --> 00:20:11,390 Part of them was completely proprietary like Verifone Verix, Sage Antelium used by Ingenico and PaxOS. 205 00:20:11,950 --> 00:20:17,310 They all have legacy codebase, proprietary binary format, etc. 206 00:20:18,440 --> 00:20:22,130 Another part was Linux-based devices. 207 00:20:22,990 --> 00:20:27,370 Android devices in this case are out of our scope. 208 00:20:28,410 --> 00:20:32,430 The first thing we have to understand is device boot order. 209 00:20:32,430 --> 00:20:42,490 It also has a lot of legacy because almost all of these operating systems developed before traditional secure boot approach became a mainstream. 210 00:20:42,890 --> 00:20:46,750 After reset zero-stage boot loader should be started. 211 00:20:46,750 --> 00:20:52,570 Usually it is located inside microcontroller in form of mass-corridor memory. 212 00:20:52,570 --> 00:21:06,530 It loads the next-step boot loader from flash memory and checks its cryptographic signature using the keys stored in OTP, read-only memory or any secure memory. 213 00:21:06,530 --> 00:21:14,370 Every next-step boot loader also should check the cryptographic signature of every loaded piece of code, etc. 214 00:21:15,350 --> 00:21:20,310 Every vendor reinvented their own boot order in this case. 215 00:21:20,310 --> 00:21:23,010 Sometimes the boot chain is very long. 216 00:21:23,410 --> 00:21:28,930 Finally, when operating system loads an application, it also should check its signature. 217 00:21:29,470 --> 00:21:34,050 This slide shows you the boot log from the Linux-based Verifone. 218 00:21:34,470 --> 00:21:38,930 Before the kernel started, we can see boot loader output. 219 00:21:38,930 --> 00:21:41,830 In this case, it is very talkative. 220 00:21:41,830 --> 00:21:43,570 It called SBI. 221 00:21:43,710 --> 00:21:46,010 Now we know its version. 222 00:21:46,010 --> 00:21:50,250 Also, it can load some files from USB stick. 223 00:21:50,250 --> 00:21:52,590 And it loaded uboot. 224 00:21:52,590 --> 00:21:57,170 And finally, kernel output disclosed the CPU model. 225 00:21:57,590 --> 00:22:02,770 Now you see the Verix operating system-based Verifone output. 226 00:22:02,770 --> 00:22:05,810 Surprisingly, it started the same boot loader. 227 00:22:05,810 --> 00:22:13,030 Again, it can work with USB sticks, but in this case it loads the proprietary operating system kernel. 228 00:22:13,030 --> 00:22:17,320 Please look at the operating system kernel output. 229 00:22:17,590 --> 00:22:24,890 Here you can see the Broadcom CPU model that was previously rebranded to internal Verifone name. 230 00:22:25,050 --> 00:22:30,350 In both cases, this boot loader located at the start of NAND flash. 231 00:22:32,170 --> 00:22:38,090 When we dumped the SBI boot loader, we are able to disassemble and research it. 232 00:22:38,090 --> 00:22:45,470 Surprisingly, it has a lot of features for factory resetting, maintenance and building command-line interface. 233 00:22:45,470 --> 00:22:55,410 But to run this command-line interface, you should exploit the vulnerability related to arbitrary memory write that we found during our research. 234 00:22:57,950 --> 00:23:02,730 Another good example is Ingenio Cartelium 2 based pinpads. 235 00:23:02,730 --> 00:23:18,210 Its maintenance mode contains a lot of features like boot tracing, firmware upload, operating systems and application updates, application tracing, application debug and also undisclosed command-line interface. 236 00:23:19,920 --> 00:23:24,120 Well, how to get into these maintenance modes? 237 00:23:24,120 --> 00:23:27,760 The answer we found in official documentation. 238 00:23:27,760 --> 00:23:37,220 As you see, to enter this mode, you have to press F2 and F4 during the boot of pinpad and enter the password. 239 00:23:37,220 --> 00:23:43,400 The default password in this case discussed many, many times, but no one changes it. 240 00:23:43,400 --> 00:23:44,640 Surprisingly. 241 00:23:45,920 --> 00:23:51,080 You may think that another terminals have more secure ways to enter this mode. 242 00:23:53,770 --> 00:23:57,950 This is Linux based Verifone model from MX series. 243 00:23:58,610 --> 00:24:04,630 And surprisingly, it has the same password with different hotkeys to enter the maintenance mode. 244 00:24:04,630 --> 00:24:07,350 It called the system mode in this case. 245 00:24:07,470 --> 00:24:12,930 At the first time when you enter to this mode, it asks you to change the password. 246 00:24:13,010 --> 00:24:16,090 And please look at that official screenshot. 247 00:24:16,450 --> 00:24:22,390 We all see that many people changes password to the same except one last digit. 248 00:24:24,690 --> 00:24:31,570 Completely different approach we found in IngeniCode telecom operating system based terminals. 249 00:24:31,570 --> 00:24:37,830 They uses a special software called LLT, as shown on the pinpad display. 250 00:24:38,190 --> 00:24:40,710 What can go wrong in this case? 251 00:24:40,710 --> 00:24:47,210 The application establishes the PPP connection over virtual USB serial. 252 00:24:47,210 --> 00:24:54,470 When it sends some bytes to pinpad, and pinpad launches the internal FTP server. 253 00:24:54,470 --> 00:24:59,490 This FTP server used for updates and configuration. 254 00:24:59,490 --> 00:25:05,110 The directory structure is shown in the LLT software interface. 255 00:25:05,210 --> 00:25:07,050 And the fun facts. 256 00:25:07,050 --> 00:25:11,230 The PPP connection uses constant hard-coded credentials. 257 00:25:11,230 --> 00:25:18,410 Custom protocol is clear text and has always the same bytes to open the FTP server. 258 00:25:18,410 --> 00:25:26,290 The FTP server also uses constant hard-coded credentials like FTP user or FTP password. 259 00:25:26,350 --> 00:25:30,370 You may do these findings without any reverse engineering. 260 00:25:30,370 --> 00:25:39,730 Just launch any USB sniffer on this USB bus and you surprisingly see that there is no encryption. 261 00:25:42,540 --> 00:25:48,520 And finally, you should pay attention to alternative work modes. 262 00:25:48,520 --> 00:25:54,460 In the case of Ingenico it called mockup mode and used for some software demonstration. 263 00:25:54,480 --> 00:25:57,790 Some security features are turned off in this mode. 264 00:25:58,180 --> 00:26:10,600 For other terminals like PUX you may find special firmwares that don't register tampering and allows you to run any applications without any cryptographic checks. 265 00:26:10,600 --> 00:26:13,940 The only one thing you will see in this case. 266 00:26:13,940 --> 00:26:17,640 This notification when device turns on. 267 00:26:20,620 --> 00:26:25,480 And now it's time to summarize all of our results in this research. 268 00:26:25,480 --> 00:26:31,600 Let's start from this well-known Linux-based verifon of MX series. 269 00:26:32,240 --> 00:26:39,980 In this case we don't discuss any old verifon MX models because they are deprecated by payment system. 270 00:26:39,980 --> 00:26:43,780 Because they were very buggy. 271 00:26:43,780 --> 00:26:50,290 At the first look the security measures are enough to make device unhackable. 272 00:26:50,820 --> 00:27:02,320 It has all traditional tampering detectors and additionally maintenance password, no declared access to command-line interface, signed updates. 273 00:27:02,320 --> 00:27:08,410 And on the Linux level it has well-configured role-based access control. 274 00:27:08,410 --> 00:27:16,770 But the reality multiplies these security measures by zero, because no one changes the default password. 275 00:27:16,970 --> 00:27:23,210 There is special mode when stdout and stdr logged via serial port exists. 276 00:27:23,410 --> 00:27:33,570 Also you may find interesting a lot of shell command injection directly from the user interface and very simple role-based access control bypass. 277 00:27:33,570 --> 00:27:39,710 The link to this research when the researcher started the Doom game is below. 278 00:27:39,710 --> 00:27:45,230 And again, we found the way to install and run unsigned packages. 279 00:27:45,930 --> 00:27:51,030 The next interesting case is Verix operating system-based terminals. 280 00:27:51,150 --> 00:27:54,410 I'm sure all of you saw this kind of devices. 281 00:27:54,410 --> 00:28:03,910 Please don't be confused by a wide range of modules like countertop, portable devices, devices with Bluetooth or with GSM modules. 282 00:28:03,910 --> 00:28:15,150 Every vulnerability you found in one device will work on every other Verix operating system-based device, because they all have the same code base. 283 00:28:16,030 --> 00:28:33,770 As the previous devices, Verix-based pinpads have the same measures like maintenance password, command-line interface doesn't exist, updates are signed and encrypted, and they should have well-tested and strong code base. 284 00:28:34,350 --> 00:28:38,380 But again, no one changes the maintenance password. 285 00:28:38,690 --> 00:28:44,350 During our research we found pre-installed binaries from standard OS package. 286 00:28:44,350 --> 00:28:52,390 One of them called VSH like Verix shell and can be run directly from maintenance mode. 287 00:28:52,390 --> 00:28:55,490 The result you may see on the screenshot. 288 00:28:55,990 --> 00:29:02,410 We found weak cryptography schemes which allows you to run any unsigned code. 289 00:29:02,410 --> 00:29:09,570 And finally, decryption keys for updates decryption could be extracted from the device memory. 290 00:29:09,570 --> 00:29:16,910 One of the most interesting sort of devices is Teleum operating system-based devices by Ingenico. 291 00:29:17,370 --> 00:29:24,810 I also showed that at least one of these devices from the picture is known for you in real life. 292 00:29:25,170 --> 00:29:31,350 And again, there is very wide range of devices with the same code base. 293 00:29:31,370 --> 00:29:33,830 Let's look at their security. 294 00:29:34,490 --> 00:29:39,130 The vendor approach looks like in previous cases, but with some peculiarities. 295 00:29:39,130 --> 00:29:47,970 For example, they use specialized software for maintenance and separate cryptoprocessor for cryptographic operations. 296 00:29:48,050 --> 00:29:51,770 And other things like tamper detectors, encryption, etc. 297 00:29:51,770 --> 00:29:52,670 etc. 298 00:29:52,670 --> 00:29:57,850 are standard for any point-of-sale terminals, as we already know. 299 00:29:59,190 --> 00:30:03,390 And what we realized during our Ingenico research. 300 00:30:03,550 --> 00:30:07,270 Private maintenance software is accessible from the Internet. 301 00:30:07,270 --> 00:30:11,410 A lot of protocols are accessible from the LLT mode. 302 00:30:11,410 --> 00:30:13,390 Some of them are vulnerable. 303 00:30:13,390 --> 00:30:19,370 Another one allows you to run device with some debug capabilities. 304 00:30:20,050 --> 00:30:26,190 Update signature doesn't matter if you have remote code execution on the device or debug. 305 00:30:26,550 --> 00:30:30,510 Finally, there is a lot of buggy legacy code. 306 00:30:32,680 --> 00:30:36,870 The last one kind of pinpads is PAX devices. 307 00:30:36,870 --> 00:30:44,210 They are less known for you, but the vendor approaches are less complex than any of previous cases. 308 00:30:46,430 --> 00:30:51,170 This is why I'd recommend to start your research from these models. 309 00:30:51,170 --> 00:30:56,630 Surprisingly, the maintenance software is accessible from the Internet again. 310 00:30:56,630 --> 00:31:06,550 Also, you can find operating system builds with turned-off security features for testing your own applications and to play with operating system kernel. 311 00:31:07,070 --> 00:31:12,630 And probably, you may do a lot of findings related to the legacy code base. 312 00:31:17,400 --> 00:31:21,040 Why you shouldn't afraid to start paying hardware research? 313 00:31:21,040 --> 00:31:26,040 Basically, you don't need to have any banking account to interact with hardware. 314 00:31:26,040 --> 00:31:34,220 The only thing you need at start is buy a couple of such pinpads and be ready that some of them goes to the trash bin. 315 00:31:34,220 --> 00:31:38,480 The approximate list of our findings is on the slide. 316 00:31:38,480 --> 00:31:41,300 There are a lot of untested critical code. 317 00:31:41,620 --> 00:31:50,540 We found some buffer overflows and logical flaws in kernel, as well as network state and others. 318 00:31:50,720 --> 00:31:54,900 Almost all vulnerabilities are exploitable easily. 319 00:31:54,900 --> 00:31:59,660 In secure maintenance and special modes we develop passwords. 320 00:32:00,980 --> 00:32:10,360 Also, you may find altered and debug signed operating system builds, as well as maintenance software and software development kits. 321 00:32:12,080 --> 00:32:16,440 And what is the impact of such findings, flaws and vulnerabilities? 322 00:32:16,600 --> 00:32:22,240 First of all, you have to understand that this hardware works with your payment card data. 323 00:32:22,240 --> 00:32:25,940 It means that hardware works with your money directly. 324 00:32:25,960 --> 00:32:29,530 The very short list of different attacks is on the slide. 325 00:32:30,280 --> 00:32:33,540 I have to say a few words about fake POS. 326 00:32:33,540 --> 00:32:40,360 If you were or live in Europe, you saw a lot of terminals in almost every touristic shops. 327 00:32:41,080 --> 00:32:47,940 The only one reason why it happens is in different rules for different terminals with different payment systems. 328 00:32:47,940 --> 00:32:57,300 When you card swiped or inserted in fake, not licensed and evil pinpad, your money became not yours. 329 00:32:57,480 --> 00:33:04,260 It happens because someone bought the POS terminal with not banking application, but evil. 330 00:33:04,260 --> 00:33:11,820 You may see on this slide advertisement about selling such firmware on some Russian underground forum. 331 00:33:11,820 --> 00:33:18,600 Any other attacks are mostly understandable and you may read more about them in open sources. 332 00:33:18,600 --> 00:33:24,940 This is another short list, but in this case it contains vulnerabilities we found by our team. 333 00:33:25,000 --> 00:33:33,920 As you may see, there exist such things like hardcoded credentials, insecure clear text and vulnerable protocols. 334 00:33:33,920 --> 00:33:37,580 A lot of arbitrary code executions, etc, etc. 335 00:33:37,580 --> 00:33:45,160 And one of my favorite is the last one, operating system independent code execution in Verifone Bootloader. 336 00:33:45,160 --> 00:33:53,440 Soon we are going to disclose technical details for every CVE from this list, but it would be a bit later. 337 00:33:55,680 --> 00:34:00,360 Finally, I want to thank these cool guys for their work and help. 338 00:34:00,360 --> 00:34:03,960 It was great to work together on this research. 339 00:34:03,960 --> 00:34:14,200 The team members are Timur Inusov, Dmitry Sklyarov, Igor Zaitsev, Vladimir Karanovich, Artem Ivachev and Maxim Kozhevnikov. 340 00:34:14,580 --> 00:34:16,080 And that's all for today. 341 00:34:16,080 --> 00:34:21,700 If you have any questions, suggestions or topics to discuss, feel free to contact me. 342 00:34:21,700 --> 00:34:24,280 Thank you for attention and stay healthy!