If a payment terminal could be forced into servitude as a crude handheld gaming device, what else could it be made to do? Researchers at the Black Hat conference showed just what mischief a commonly used UK PoS terminal could get up to when they inserted a chip-and-pin card crafted with malicious code. That enabled them to install a racing game and play it, using the machine's pin pad and screen. With the same hack, they were able to install a far less whimsical program as well -- a Trojan that could record card numbers and PINs, which could be extracted later by inserting another rogue card. On top of that, criminals could use the same method to fool the terminal into thinking a transaction was bank-approved, allowing them to walk out of a store with goods they hadn't paid for. Finally, the security gurus took a device popular in the US, and used non-encrypted ethernet communication between the terminal and other peripherals to hack into the payment device and take root control. Makes you want to put those credit cards (and NFC devices) away and stick to cash -- at least you can see who's robbing you blind.
[Original image credit: Shutterstock]
Filed under: Misc. Gadgets
Security experts hack payment terminals to steal credit card info, play games originally appeared on Engadget on Fri, 27 Jul 2012 06:41:00 EDT. Please see our terms for use of feeds.
Permalink |
PC World |
Email this |
Comments
We are essentially a cashless society. With the rise of debit cards in the late 1980s early '90s, fewer and fewer of us use paper money to pay for things. Throw in online shopping and single-retailer payment apps like the one from Starbucks, and ATMs...
Walmart isn't happy that Visa still allows customers to sign for purchases made with their chip-equipped debit cards. The retail giant has filed a lawsuit against Visa in New York in an effort to compel the credit card brand to require PIN verificati...
