Slashdot Mirror
Attackers Use Email Spam To Infect Point-of-Sale Terminals
jfruh writes: Point-of-sale software has meant that in many cases where once you'd have seen a cash register, you now see a general-purpose PC running point-of-sale (PoS) software. Unfortunately, those PCs have all the usual vulnerabilities, and when you run software on it that processes credit card payments, they become a tempting target for hackers. One of the latest attacks on PoS software comes in the form of malicious Word macros downloaded from spam emails.
So, WTF is an e-mail client doing on a POS terminal in the first place? It doesn't need one, it shouldn't have one. Ditto a Web browser. You don't have to worry about vulnerabilities in software that isn't present on the machine in the first place. There are of course other things to be looked at, but those are a good starting point.
Or has he missed? If you know what I mean. Do you know mean? Know? Know what I mean?
No, I don't.
I supply various systems, including retail chain management built with security by design. It is hard to achieve proper security in stores and offices, the users are so far away from being computer savvy it hurts. We move them off windows in many cases to Linux solutions. In any case POS should not be connected to the Internet. We set up linux machines as router / firewall and as a store management server. It talks to everything on the inside, it provides connectivity for the bank terminals, the cameras and another administrative computer. POS gets its instructiin s through it and offloads sales data to it and then everything is synchronized with the central system by it.
The amount of crazy that happens in stores is staggering, almost inconceivable. We have to prevent meltdown with minimal resources and as little pain as possible but it is not easy when a retailer has a few stores and maybe one admin. Remote administration is vital, proper backup solutions are vital, the whole thine can degrade in no time if none is watching.
You can't handle the truth.
Most POS systems that I have encountered run WinXP
From the article:
One of the latest attacks on PoS software comes in the form of malicious Word macros downloaded from spam emails.
It looks like you might be right.
This raises a couple of obvious questions: Why does a cash register have an e-mail client installed and capable of receiving e-mail? Why does a cash register have Word installed?
Once again, stupidity and incompetence trumps everything.
because word macros are still fundamentally tied to the way the kernel works with metafiles (ie the first thing it does with any binary object is try to execute it), and Windows xp comes wth an email client installed by default (Outlook Express) which for some unknown reason and unlike earlier versions of Windows (any from the 9x stable spring to mind) you can't deselect it from optional component install.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
An email client may be installed by default, but it is not a threat unless it is set up with an account, and the account is used.
> This is what happens when you have employees who think they have a god given right to surf the internet
Or when you have an employer mandate to check employee email about store policies, schedules, delivery dates, and inventory, verifying store hours for other branches, verifying alternative vendor prices for price matching, checking the weather for a customer buying exterior paint, looking up a product review or product specifications with a customer, or any of a dozen other uses. It is _embarrassing_ for a modern vendor to be unable to work with a customer checking the same information that the customer can obtain at home on their home computer, or to be unable to print out the specifications for a product that the vendor sells.
Such terminals have become quite common and are much more necessary now that customers expect one store to be able to verify inventory or reserve an item before proceeding to another physical store. If they cannot do this, they will lose the sale to an online vendor.
A lot of different things can constitute a POS terminal today. For an iPad, you have Square, Shopify, and any number of other comparable packages. Pretty hard to eliminate an email client.
At one end of the spectrum, many of these types of systems use cellular service for their internet connection; pretty hard to lock them down at the network level as well.
The old model for these types of systems was to provide dedicated "appliances" to solve the problem. Costs were absurd, so merchants worked hard to find alternatives. It has taken about 18 years to get to this point. (Second linux project I was interested in was a POS system, back in 1997...) Not every shop has an IT guy on staff... and not all IT guys are experts at security, networking, or much more than rebooting the system when it has a problem.
The sort of people who set up these compromised systems probably never knew them in the first place.
The real WTF in this scenario is why does the POS software have access to credit card numbers? A one-way transaction will have all credit card information go directly through the PINpad, without ever being exposed to the controlling PC.
"Evil will always triumph over good, because good is dumb." - Dark Helmet (Spaceballs)
It used to be that a register only needed to do basic calculations, then credit card transactions. Now, they are a lot more complicated, especially with EMV, Apple Pay, SmartCard, CurrenC, Google Wallet, PayPal, NFC, and all the other pay standards out there. Since these standards rarely stay static, where in the past an embedded QNX appliance could do the job well, it requires pretty much a Windows PC that can be easily updated via a MSI files.
Since a business requires Apple Pay or shut their doors, having to move to a POS machine that is "smart" is a part of life.