Slashdot Mirror
POS Vendor Uses Same Short, Numeric Password Non-Stop Since 1990
mask.of.sanity writes: Fraud fighters David Byrne and Charles Henderson say one of the world's largest Point of Sale systems vendors has been slapping the same default passwords – 166816 – on its kit since 1990. Worse still: about 90 per cent of customers are still using the password. Fraudsters would need physical access to the PoS in question to exploit it by opening a panel using a paperclip. But such physical PoS attacks are not uncommon and are child's play for malicious staff. Criminals won't pause before popping and unlocking. The enraged pair badged the unnamed PoS vendor by its other acronym labelling it 'Piece of S***t.
The fact that the vendor did not use a strong password does not make the system a "piece of shit." It just means that the vendor did not use a strong default password.
the 10% who managed to change the default password replaced it by 12345
Everybody jumps on the three-letter acronym, but no love for the researcher's name?
Quick, change it to 12345!
Koans and fables for the software engineer
If they don't name the vender then what will change?
How can users be warned?
How do we know its even true?
They might as well be bashing some made up system by some fake company that doesn't exist.
I have to return some videotapes...
Using some secret number, calculate the hash of that number concatenated with the current hour and minute. Then, when someone comes by to unlock it, they just use the same algorithm with the same secret number to generate a hash that matches the one on the machine. Authenticate based off of equality of user given hash and machine calculated hash.
Of course, concatenation maybe isn't the best option if you want a large amount of entropy behind the hash code. Maybe replace the human and PIN input with a serial port.
What could someone possibly do if they gain admin access to a POS? Is this a Windows CE system where someone could run arbitrary code? Or is this a bespoke system where the admin password just gives you access to the settings of the system? The article mentions staff using a POS server to play games and download porn on but that is a server probably running Windows Server with some POS server software from the vendor. Rather than just making fun of the name, these guys should explain what exactly does the admin password get you.
Getting access to the network is something different. You could update every POS terminal out there with your own code to steal CCs or crash every terminal on Black Friday.
166831 has been the default pw on VeriFone card terminals and "multilane" on Hypercom ones for as long as I can remember. Of course these are supposed to be changed at install time, but we know how that goes...
The pair iterated some brazen criminal and hopeless customer cases they each dealt with while at Trustwave where PoS systems had been compromised. ...
In another, forensics were left stumped by a carder's keylogger which had logged repeat keys (such as aaaaa ggggg bbbbb) entered on the PoS server. It was later revealed staff had used the machine to play Guitar Hero, Call of Duty, and download porn.
Forensics had even established which songs were played based on the logged keys.
The researchers found that next to the ubiquitous use of the password 166816 amongst separate manufacturers, that Deep Purple's "Smoke on the Water" was the most played song on compromised PoS terminals. Strange.
The vendor recently updated the default password to "166832".
I am very small, utmostly microscopic.
One of the most popular Point of Sales systems is called 'RealPOS'. I wouldn't be surprised if this is the one referenced in the article.
Any insufficiently advanced magic is indistinguishable from technology.
The actual presentation is much worse than just passwords.
Really pathetic that "chip and sign" won't do much to fix these issues. Disappointed that they didn't shame the manufacturer, although there are really only 3 left now among the majors.
(And sadly, the link to that presentation's directory is "writeable." Sometimes even security specialists get it wrong...)
Without additional context I would say "So what?".
Questions that need answering:
- Can end user change the default password?
- Do installation best practices from manufacturer dictate to change the default password?
- Who performs the installation and maintains the devices?
Without answers to these it is hard to say whether the issue lies with the manufacturer, the reseller or the end user.
Which is why vendors shouldn't ship products with default passwords at all. Instead, they should require all users to set a password when the system is first installed.
And the customer will simply set it to "123456".
I had a client in the financial business, and the so-called, "Office-Manager" / Comptroller set all the passwords to "password" and several variations on this! He REFUSED to set them to secure passwords, even though if they were hacked, they could have lost millions of dollars in their client's money and securities!
That company is now someone else's headache now.
And the customer will simply set it to....
Than the onus of responsibility lies with the client of the vendor and not with the PoS vendor directly. Yes, the PoS vendor could enforce password complexity because it's industry best practice to do so, but not required unless legislated into law.
Life is not for the lazy.
They won't be dragged off to court, or now that we have DMCA bullshit they won't be dragged off to jail like Dmitry S. vs Adobe. If they name them one or both may happen.
This isn't really a problem. Where are regular people who don't work in security going to get a paperclip?
Get free satoshi (Bitcoin) and Dogecoins
And the default password isn't something obvious like "123456" so it's not like the vendor didn't care about it either.
Get free satoshi (Bitcoin) and Dogecoins
Criminals won't pause before popping and unlocking.
My own preference is to pop and lock.
Ok, how about the fact that credit card numbers are stored in the memory dump of the unit? When encrypted, credit cards storage uses a symmetric key? Servers are regularly stolen, but the drives are not encrypted? The software must be installed as the admin user?
From a security perspective, these units really are a POS and a betrayal of trust by the vendors. Most retailers do not have staff on-property to do IT security, so they out-source it. They have been charged an arm and a leg, but do not get a secure, reliable system.
What does knowing this password allow a malicious person to do, that he couldn't do otherwise?
I don't care if it's 90,000 hectares. That lake was not my doing.
Our solution by Food Service Solutions has a hard-coded superuser admin account with the username of "a" and the password of "a."
It's used by thousands of institutions.
You can't disable it.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
What if you made the default password the date the system was turned on? Sure, it's a simple 8 digit numeric value, but it would be somewhat unique per machine or local bank of machines. Don't ask them for a default password, tell them what it is and make them go change it. Various studies suggest they probably won't.
There's a reason why linksys, D-link and others do pretty much the same thing.
Wuddooeyeno? IITYWYBMAD? Like nuts? eclecticallyincorrect.com
Any half-decent system will disallow passwords like this.
Enforce strong passwords? Prepare for a sticky notes.
Change the password! If you're not going to be proactive about security, why should anyone help you?
I don't keep bundles of Cash, Checks, and Credit Card receipts in my Router. I'm somewhat surprised that you do.
So you say changing resolvers in your router would do you no harm?
It was funny in Thailand - 2 major ADSL internet providers, with most adsl modems/routers configured with 3 default admin passwords - 3bb, tot, and, you guessed it, admin. By default they were all open from WAN - I checked once, just opened in browser a few IP's in a same subnet with mine - could login to about 5 out of about 10 IP's tested. About a year ago probably somebody exploited this, so what did providers do? Simple solution - just drop all incoming connections, anyway nobody noticed.
And at *that* point it's the user's fault. But not until the vendor stops shipping things with default passwords and not asking you to change it at first setup.
What if you made the default password the date the system was turned on?
Then I as a thief would do some basic research into the date that that location opened for business and try 2-3 guesses close to that date before getting it bang on.
The Military used to call our cars POV's and I used to call my car a POV, POS. Then came the point of sale setups and they appropriated my acronym. Now we can go back to using POS as it's original intended purpose. BTW thanks for giving me the password, it think I might just get rich and lucky this weekend...
Paul E. Bahre
Most large commercial device makers do exactly this same thing.
Routers, Credit Card terminals, Coke machines.
Not only do they all do this, the default passwords and the correct menus to select are all well documented online.
You can walk up to most digital Coke machines and reboot them, and reconfigure their settings to do all kinds of things.