NFC Flaws in POS Devices and ATMs

[Dave]

https://www.schneier.com/crypto-gram/archives/2021/0715.html#cg1

NFC Flaws in POS Devices and ATMs​

[2021.06.28] It’s a series of vulnerabilities:

Josep Rodriguez, a researcher and consultant at security firm IOActive, has spent the last year digging up and reporting vulnerabilities in the so-called near-field communications reader chips used in millions of ATMs and point-of-sale systems worldwide. NFC systems are what let you wave a credit card over a reader — rather than swipe or insert it — to make a payment or extract money from a cash machine. You can find them on countless retail store and restaurant counters, vending machines, taxis, and parking meters around the globe.
Now Rodriguez has built an Android app that allows his smartphone to mimic those credit card radio communications and exploit flaws in the NFC systems’ firmware. With a wave of his phone, he can exploit a variety of bugs to crash point-of-sale devices, hack them to collect and transmit credit card data, invisibly change the value of transactions, and even lock the devices while displaying a ransomware message. Rodriguez says he can even force at least one brand of ATMs to dispense cash though that “jackpotting” hack only works in combination with additional bugs he says he’s found in the ATMs’ software. He declined to specify or disclose those flaws publicly due to nondisclosure agreements with the ATM vendors.

 

[danlock]

Apparently, those systems really ARE POS systems. *rimshot*

Josep Rodriguez' method is much faster than using the Atari Portfolio DOS portable computer John Connor used in Terminator II for swiping and sorting to get a 4-digit PIN.

 

[Dave]

Apparently, those systems really ARE POS systems. *rimshot*

I had the same thought but left it for you. (That's the generic 'you'.)

Evoked a vague memory from WAY too many years ago. It might have even been Rowan_& Martin's Laugh-In. But someone picked up on an obvious opening and then added "You keep settin' 'em up, I'll keep bringin' 'em home!".

 

[rfrazier]

FYI, this thread is also related to this topic in terms of credit card fraud.

https://forums.grc.com/threads/how-do-i-test-rfid-blocking-devices.675/

May your bits be stable and your interfaces be fast. Ron

 

[rfrazier]

@Dave Why the angry face emoticon?

Ron

 

[Dave]

@Dave Why the angry face emoticon?

Ron

Oh, sorry for the ambiguity. It was in reaction to the mention of "credit card fraud.".

Thanks for asking if it wasn't clear.

Sometimes I think honey and fire ants would be too good for some of these low-life predators.

 

[rfrazier]

@Dave I tend to agree. Way too much slime on the planet.

May your bits be stable and your interfaces be fast. Ron