Slashdot Mirror
Attackers Use Email Spam To Infect Point-of-Sale Terminals
jfruh writes: Point-of-sale software has meant that in many cases where once you'd have seen a cash register, you now see a general-purpose PC running point-of-sale (PoS) software. Unfortunately, those PCs have all the usual vulnerabilities, and when you run software on it that processes credit card payments, they become a tempting target for hackers. One of the latest attacks on PoS software comes in the form of malicious Word macros downloaded from spam emails.
So, WTF is an e-mail client doing on a POS terminal in the first place? It doesn't need one, it shouldn't have one. Ditto a Web browser. You don't have to worry about vulnerabilities in software that isn't present on the machine in the first place. There are of course other things to be looked at, but those are a good starting point.
Or has he missed? If you know what I mean. Do you know mean? Know? Know what I mean?
No, I don't.
Or has he missed? If you know what I mean. Do you know mean? Know? Know what I mean?
No, I don't.
(And, yes, that breakin was mentioned in TFA.)
I supply various systems, including retail chain management built with security by design. It is hard to achieve proper security in stores and offices, the users are so far away from being computer savvy it hurts. We move them off windows in many cases to Linux solutions. In any case POS should not be connected to the Internet. We set up linux machines as router / firewall and as a store management server. It talks to everything on the inside, it provides connectivity for the bank terminals, the cameras and another administrative computer. POS gets its instructiin s through it and offloads sales data to it and then everything is synchronized with the central system by it.
The amount of crazy that happens in stores is staggering, almost inconceivable. We have to prevent meltdown with minimal resources and as little pain as possible but it is not easy when a retailer has a few stores and maybe one admin. Remote administration is vital, proper backup solutions are vital, the whole thine can degrade in no time if none is watching.
You can't handle the truth.
I think GP might have been an attempt at sarcasm. Either that or really stupid.
There ought to be competent CTOs out there.
Two questions for you:
1: What have you been smoking?
2: Can I have some?
I think 'competent' and 'CTO' in the same sentence probably constitutes a contradiction in terms.
Most POS systems that I have encountered run WinXP
From the article:
One of the latest attacks on PoS software comes in the form of malicious Word macros downloaded from spam emails.
It looks like you might be right.
"general-purpose PC running point-of-sale (PoS) .. PCs have all the usual vulnerabilities"
Only when running Microsoft Windows and connected to the Internet.
Using Windows were there is any sensitive information is the equivalent of promoting criminal activity. The only exception is if the system is tightly configured and continuously updated. In the real world a vanishingly small percentage of all Windows installations do the right thing.
The only way this will ever change is if the organization (or person) responsible for the system is held accountable for any sensitive data leaks. Accountability must include fines, monetary indemnification and criminal liability. In plain English, that means if you screw up and loose someone's private info, you are on the hook for paying a fine and compensating the victim for all their losses, including the time they spend dealing with the mess. And if the breach is significant enough, you should be facing a criminal trial and serious jail time.
If this was in place there would be very few data breaches, obviously. I also think that it would be better for the overall economy, because the cost of data loss would be accounted for. Right now the cost accrues to the victim and so the real economic damage is invisible. It's the same situation as a manufacturing company not paying for waste disposal because they can get away with dumping their trash on the neighbors property.
Of course this will never happen because Profit!
Why is Snark Required?
I thought that word macros and such were a solved problem. Is anyone still running Office 97? After that, macros were disabled by default.
"Freedom in the USA is not the ability to do what you want. It is the ability to stop others from doing what THEY want"
The case for the 'principle of least authority' has been made many times. People have even tried to design operating systems around it. But when the dominant PC operating system is simply designed to make its maker money and give them market dominance, stuff like this happens. PCs vulnerable to this sort of thing are the product of laziness and the business obsession with (and present-day necessity of) short time-to-market. Unfortunately modern business reality means people often cannot afford to make things properly anymore.
John_Chalisque
1995 called, they want their zero day exploits back.
This is what happens when you have employees who think they have a god given right to surf the internet and conduct personal business on company time and equipment.
I'm sorry, you would not have that "right" in my shop. Especially these days with smart phones and tablets. You want to check your email or surf the web? Do it on your own god damned device, and it better damn well be after you've completed all your work, or on your break.
Yes employees have rights, but so do employers. They have the right to not have their equipment fucked up by ignorant employees who fall for the latest click-bait headline or flashy-shiny desktop icon thinngymabob that compromise their entire business.
--- Keep the choice with the user..
If the network infra-structure allows for POS to connect to the Internet at large, the managers are idiots without a clue and are asking from problems. Probably sooner than later.
This raises a couple of obvious questions: Why does a cash register have an e-mail client installed and capable of receiving e-mail? Why does a cash register have Word installed?
Once again, stupidity and incompetence trumps everything.
because word macros are still fundamentally tied to the way the kernel works with metafiles (ie the first thing it does with any binary object is try to execute it), and Windows xp comes wth an email client installed by default (Outlook Express) which for some unknown reason and unlike earlier versions of Windows (any from the 9x stable spring to mind) you can't deselect it from optional component install.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
An email client may be installed by default, but it is not a threat unless it is set up with an account, and the account is used.
> This is what happens when you have employees who think they have a god given right to surf the internet
Or when you have an employer mandate to check employee email about store policies, schedules, delivery dates, and inventory, verifying store hours for other branches, verifying alternative vendor prices for price matching, checking the weather for a customer buying exterior paint, looking up a product review or product specifications with a customer, or any of a dozen other uses. It is _embarrassing_ for a modern vendor to be unable to work with a customer checking the same information that the customer can obtain at home on their home computer, or to be unable to print out the specifications for a product that the vendor sells.
Such terminals have become quite common and are much more necessary now that customers expect one store to be able to verify inventory or reserve an item before proceeding to another physical store. If they cannot do this, they will lose the sale to an online vendor.
Why does a PoS computer have an email client installed?
Why does a PoS computer have Microsoft Word installed?
And why is the email client even running?
A PoS computer should only be connected to an intranet and should only be running the PoS software. Everything else should be completely locked down. Someone messed up, big time.
Get free satoshi (Bitcoin) and Dogecoins
that wasn't the question, but OK :)
I've dealt with POS systems myself, as recently as 2007. From the ground up, and using hardware supplied by the client, I ended up with a custom NT4 build (needed for the barcode scanner, I wasn't about to drop a DOS based system on it), connected to a SuSE backend and airgapped from the Internet. The NT system ran on 16MB of RAM, and last time I looked (2013) it was still running on the same system build, same hardware and same backend. With eight simple rules the client has never had a problem with the system - he's had to replace one barcode scanner.
1. There is one USB port, and that is on the backend machine.
2. That port is for one data drive that is supplied with the system.
3. When you plug that data drive in, the system copies the data you need itself. When the red light goes out, unplug the drive.
4. When you've done with the data on the drive (ie when you've emailed it from another machine), format the drive*.
5. Nothing else ever gets plugged into that USB port.
6. No other data ever gets written onto that USB drive.
7. There is no network port on the NT box. Don't ever install one.
8. There is no network port on the backend system. Don't ever install one.
*The backend box formatted the drive on insertion anyway prior to the data write, this just gave the client some sense of interaction.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
I think you missed the invisible /sarc tag at the end of his post.
If you're scared of your govt then you need to further restrict its powers
Vote 3rd Party in 2016 and beyond
Who says it was the cash register receiving e-mails? It may well have been the back-end server, which, for small businesses, could easily be a regular PC, maybe even dual purposed as the owner's workstation.
Indeed - back in the late 90's I worked for a company that sold POS software. It was installed on Windows NT4 and Windows 2000 machines.
Nowadays I believe XP is the dominant system.
The real WTF in this scenario is why does the POS software have access to credit card numbers? A one-way transaction will have all credit card information go directly through the PINpad, without ever being exposed to the controlling PC.
"Evil will always triumph over good, because good is dumb." - Dark Helmet (Spaceballs)
It used to be that a register only needed to do basic calculations, then credit card transactions. Now, they are a lot more complicated, especially with EMV, Apple Pay, SmartCard, CurrenC, Google Wallet, PayPal, NFC, and all the other pay standards out there. Since these standards rarely stay static, where in the past an embedded QNX appliance could do the job well, it requires pretty much a Windows PC that can be easily updated via a MSI files.
Since a business requires Apple Pay or shut their doors, having to move to a POS machine that is "smart" is a part of life.
I do see a lot of XPe (XP Embedded) point of sale installations around my neck of the woods.
Cash registers have two odd quantities. On one hand, they need good security. On the other hand, they may need to keep up with the latest things. At the minimum, EMV credit cards, but things like various payment items from a cellphone are can be needed as well.
Maybe POS machines should be split up into two VMs:
One part does the item totaling, inventory, calculations, purchase/returns, and other parts which stay pretty much static. Even EMV credit card processing can be added here.
The second VM would be just for handling the latest and greatest e-pay stuff, be it ISIS, SoftCard, PayPal, Google Wallet, Apple Wallet, CurrenC, Bitcoin, AltCoin, Namecoin, DogeCoin, pyreals, gil, ounces of precious metals, platinum pieces, and so on. This VM pretty much gets the total transaction amount from the other VM, and does a purchase, audit, or return.
Add a decent hypervisor coupled with a decent snapshot/backup mechanism, and this would provide adequate security and separation of functions.
Done right, it can be done relatively seamlessly, and would limit what happens if one side gets compromised.
On Another Site, someone asked (relatively recently) how to run a web browser on windows 3.1... on industrial computer controlling a bandsaw. At this point, Win 3.1 and any IE that could run on it would be not updateable. So let's allow our bandsaw controller to be pwn3d.
People do stupid things.
You mean kinda like bank's ATM's that blue screen?