Slashdot Mirror
POS Vendor Uses Same Short, Numeric Password Non-Stop Since 1990
mask.of.sanity writes: Fraud fighters David Byrne and Charles Henderson say one of the world's largest Point of Sale systems vendors has been slapping the same default passwords – 166816 – on its kit since 1990. Worse still: about 90 per cent of customers are still using the password. Fraudsters would need physical access to the PoS in question to exploit it by opening a panel using a paperclip. But such physical PoS attacks are not uncommon and are child's play for malicious staff. Criminals won't pause before popping and unlocking. The enraged pair badged the unnamed PoS vendor by its other acronym labelling it 'Piece of S***t.
POS means Piece Of Shit, doesn't it? What would you expect from a POS vendor?
The fact that the vendor did not use a strong password does not make the system a "piece of shit." It just means that the vendor did not use a strong default password.
the 10% who managed to change the default password replaced it by 12345
Everybody jumps on the three-letter acronym, but no love for the researcher's name?
That way the password matches that of my luggage.
But it does make the vendor a piece of shit
Quick, change it to 12345!
Koans and fables for the software engineer
If they don't name the vender then what will change?
How can users be warned?
How do we know its even true?
They might as well be bashing some made up system by some fake company that doesn't exist.
I have to return some videotapes...
Using some secret number, calculate the hash of that number concatenated with the current hour and minute. Then, when someone comes by to unlock it, they just use the same algorithm with the same secret number to generate a hash that matches the one on the machine. Authenticate based off of equality of user given hash and machine calculated hash.
Of course, concatenation maybe isn't the best option if you want a large amount of entropy behind the hash code. Maybe replace the human and PIN input with a serial port.
What could someone possibly do if they gain admin access to a POS? Is this a Windows CE system where someone could run arbitrary code? Or is this a bespoke system where the admin password just gives you access to the settings of the system? The article mentions staff using a POS server to play games and download porn on but that is a server probably running Windows Server with some POS server software from the vendor. Rather than just making fun of the name, these guys should explain what exactly does the admin password get you.
Getting access to the network is something different. You could update every POS terminal out there with your own code to steal CCs or crash every terminal on Black Friday.
166831 has been the default pw on VeriFone card terminals and "multilane" on Hypercom ones for as long as I can remember. Of course these are supposed to be changed at install time, but we know how that goes...
The pair iterated some brazen criminal and hopeless customer cases they each dealt with while at Trustwave where PoS systems had been compromised. ...
In another, forensics were left stumped by a carder's keylogger which had logged repeat keys (such as aaaaa ggggg bbbbb) entered on the PoS server. It was later revealed staff had used the machine to play Guitar Hero, Call of Duty, and download porn.
Forensics had even established which songs were played based on the logged keys.
The researchers found that next to the ubiquitous use of the password 166816 amongst separate manufacturers, that Deep Purple's "Smoke on the Water" was the most played song on compromised PoS terminals. Strange.
Logic controls?
The vendor recently updated the default password to "166832".
I am very small, utmostly microscopic.
The vendor in question is Verifone.
I seem to remember from my days (quite some time ago) of doubling as a Nortel PBX admin, that **166816 was also the default admin pwd.
One of the most popular Point of Sales systems is called 'RealPOS'. I wouldn't be surprised if this is the one referenced in the article.
Any insufficiently advanced magic is indistinguishable from technology.
The actual presentation is much worse than just passwords.
Really pathetic that "chip and sign" won't do much to fix these issues. Disappointed that they didn't shame the manufacturer, although there are really only 3 left now among the majors.
(And sadly, the link to that presentation's directory is "writeable." Sometimes even security specialists get it wrong...)
""Take widely used old and new VeriFone POS devices, which Henderson says have a default password that's been well-documented since at least 1990. When Trustwave does a POS audit, "90 percent of the VeriFone card readers that we test have that password," he says, noting that too many retailers do not change the default passwords on their VeriFone devices, which makes it easy for anyone who can get malware onto the device to then seize full control. "And that's just one vendor, and that's just one example," he says."
http://www.bankinfosecurity.com/pos-malware-still-works-a-8044/op-1
I fail to see how it is the vendors fault that the end user FAILED to change the default password. I mean hell 90% of the default router passwords are admin:admin. Do you hear people shouting at the moon that the router manufacturers NEED to send each router out with a custom username/password burned into its firmware? No, generally you hear the sane argument that the morons who leave the default password in place are at fault for whatever data breach occurs due to their ineptitude. Along with the battle cry, "Learn to configure your damn router!"
Without additional context I would say "So what?".
Questions that need answering:
- Can end user change the default password?
- Do installation best practices from manufacturer dictate to change the default password?
- Who performs the installation and maintains the devices?
Without answers to these it is hard to say whether the issue lies with the manufacturer, the reseller or the end user.
Clearly, all the owners and managers care about is getting more than their fair share and abusing those beneath them.
ROT5 that bitch
I'm unfamiliar with these devices, could someone tell me what you could really accomplish with getting into a POS? I'd guess you can probably open the register, but beyond that is there really much of a security risk here?
Really folks, why name the vendor?
http://router-defaults.com/Router/Verifone--Junior+2.05-ip-password-username
They won't be dragged off to court, or now that we have DMCA bullshit they won't be dragged off to jail like Dmitry S. vs Adobe. If they name them one or both may happen.
This isn't really a problem. Where are regular people who don't work in security going to get a paperclip?
Get free satoshi (Bitcoin) and Dogecoins
Criminals won't pause before popping and unlocking.
My own preference is to pop and lock.
What does knowing this password allow a malicious person to do, that he couldn't do otherwise?
I don't care if it's 90,000 hectares. That lake was not my doing.
Our solution by Food Service Solutions has a hard-coded superuser admin account with the username of "a" and the password of "a."
It's used by thousands of institutions.
You can't disable it.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Unfortunately, this kind of finding is not just once in a lifetime. These little creatures may seem like they're just talking heads, but we shouldn't treat them like they're speaking in tongues. These are true stories. Something something fear of music. Ok, I'm done. Naked. Now I'm really done.
There's a reason why linksys, D-link and others do pretty much the same thing.
Wuddooeyeno? IITYWYBMAD? Like nuts? eclecticallyincorrect.com
Change the password! If you're not going to be proactive about security, why should anyone help you?
If they stubbornly insist on bad passwords, abuse the system. Disrupt it in some way, or transfer money to Nigeria. Halve all prices. Then they loose, and learn. Don't go with defaults, don't trust vendors of broken policies.
At my previous employer, Epicor (formally CRS) we did this, and I think it was the same password in the article. You could hit alt backspace, enter it in, and then have admin level access to windows. Crazy!!
One client, Ecko Unlimited had a virus in the base image. Thankfully the anti-virus caught it, but its just stupid. Oh, and they never updated their definitions, so some systems were 6 years outdated! Finally, the real kicker, is that credit card data was stored encrypted in the database that anyone could access. Wait for it, it gets better. Once they settled credit nightly, the card information was stored UNENCRYPTED for a YEAR!!! They didn't want to pay to fix any of this.
Yeah, dont EVER shop there!!!!!
The Military used to call our cars POV's and I used to call my car a POV, POS. Then came the point of sale setups and they appropriated my acronym. Now we can go back to using POS as it's original intended purpose. BTW thanks for giving me the password, it think I might just get rich and lucky this weekend...
Paul E. Bahre
Most large commercial device makers do exactly this same thing.
Routers, Credit Card terminals, Coke machines.
Not only do they all do this, the default passwords and the correct menus to select are all well documented online.
You can walk up to most digital Coke machines and reboot them, and reconfigure their settings to do all kinds of things.