Cash me outside - how about that POS
Synopsis
Mobile Point-of-Sale (POS) devices play a critical role in formal and informal businesses, and the financial sector as a whole, yet their security is often overlooked. Unlike traditional banking infrastructure, which undergoes rigorous security assessments, these devices can be purchased online by anyone with minimal verification prior to setup, making them an attractive target for attackers.
Jump into the rabbit hole with us as we present how we discovered several zero-day vulnerabilities across multiple POS devices, manufacturers, merchants and third parties. Demonstrating how seemingly isolated vulnerabilities can be chained across different devices and entities, resulting in broader and more dangerous security risks. This presentation will specifically look at the security controls applied on TMS (Terminal Management Systems) by device manufacturers. While initially our research was focused specifically on mobile POS devices, the interconnected nature of the supporting systems made them an attractive target.
We believe that these devices are criminally under-researched and that significant work will need to be done by the manufacturers to properly secure them. If we can inspire either other researchers or manufacturers, it would be a dream come true!
Detailed Outline (this has been heavily redacted to accommodate the word limit):
1. Introduction: POS Security Risks
- Common oversights and misconceptions about POS security
- High-level overview of research involving vulnerabilities across multiple POS vendors' and manufacturers'
2. Mapping vulnerabilities
- Vulnerability categories
- Vulnerability chaining within and across devices and connected systems.
- More information available on request in the form of a pre-prepared markdown document detailing the research.
3. Impacts of Exploitation
- TMS Authentication Bypasses
- Compromising Related Systems
- Compromising other vendor's applications
4. (Potential) An Overview of Responsible Disclosure Discussions
- If any of the affected entities provide us with additional context around how or why any vulnerabilities may have occurred, and they agree to allow us to present this information, these insights and perspectives will be included in our talk.
5. Implications for POS Security
- What needs to happen going forward:
Ultimately this will be a discussion around potential remedial actions for the identified vulnerabilities.
Please note that more information is available on request, we cut out a lot of the content so that the submission would fit within the word limit. For example, we were able to abuse a authentication bypass to gain access to about 150+ unique applications across two different device manufacturers.