Inbar Raz - Physical (In)Security – it’s not –ALL– about Cyber

©2013 Check Point Software Technologies Ltd.

Physical (In)security

Inbar RazMalware & Security ManagerCheck Point Software Technologies

2©2013 Check Point Software Technologies Ltd.

Types of Vulnerability Disclosures

Responsible Disclosure:– Contact the vendor only and inform them of the vulnerability– If asked, work with the vendor– After 3-6 months, proceed to Full Disclosure

Full Disclosure:– Publish all information, including POC– Sometimes – only a video of POC


Disclosure #1

Vendor: An Online Movie Ticket Service

Field: Online shopping and entertainment

Affected Product: On-site Ticket Kiosk

Vulnerability: Multiple vulnerabilities cause the compromise of both customer and company data


Disclosure Details

On-site Kiosk

Touch Screen

Credit CardReader

Ticket Printer

No peripherals,No interfaces

And the journey begins…

http://www.k-kiosks.com/?view=products&id=522784


Disclosure Details

Improper interface settingsallow the opening of menuoptions.

Menus can be used tobrowse for a new printer.


Disclosure Details

A limited browser is notrestricted enough.

A right-click can be used…

To open a full, unlimitedWindows Explorer.

Now the sky is the limit…


Disclosure Details

Browsing through thefile system revealsindicative directory names…

And even more indicativefile names.


Disclosure Details

Bingo: Credit Card Data(Unencrypted!)

Tools of the trade: Notepad

We can use the ticketprinter to take it home


Disclosure Details

But that’s not all:RSA Keys and Certificatesare also found on the drive!

Which we can print, takehome and then use afree OCR software to read…


Disclosure Details

The result:

RSA Keys used tobill credit cards.


Disclosure #2

Vendor: Point-of-Sale Manufacturer and Users

Field: Network Security

Vulnerability: Improper physical security allows access to insecure PoS devices during afterhours.


Disclosure Details

Point-Of-Sale devicesare all around you.


Disclosure Details

Location: A bar in Tel-Aviv

During working hours – tables, chair and PoS outside

During afterhours – everything is locked inside the facility

But the Ethernet port remains hot– In public space…


Attack Vector

In the past – play hacker/script kiddie with BackTrack.

Today: Fire up wireshark, discover IPs of live machines.


Attack Vector

In the past – play hacker/script kiddie with BackTrack.

Today: Fire up wireshark, discover IPs of live machines.

Detected IP addresses:– 192.168.0.1– 192.168.0.2– 192.168.0.4– 192.168.0.250– 192.168.0.254

Confirm by ping (individual and broadcast)


Attack Vector

Evidence of SMB (plus prior knowledge) lead to the next step:

And the response:

17©2013 Check Point Software Technologies Ltd.[Restricted] ONLY for designated groups and individuals

Things to do with an open share

#1: Look around


Things to do with an open share

#1: Look around

#2: Create a file list


The mystery of 192.168.0.250

Answers a ping, but no SMB.

First guess: the ADSL Modem.

Try to access the Web-UI:


The mystery of 192.168.0.250

Use the full URL:


Reminder: We actually had this information.

Going for the ADSL router


Going for the ADSL router

Naturally, there is access control:

Want to guess?


Unlocked Achievements

Best for me, worst for them: Credit card data.

Database files (yet to be analyzed).

The program files of the billing system.

Potential attack through the internet.


Next Steps

Create a Responsible Disclose document for the PoS manufacturer

Send an Advisory to businesses


IMPORTANT NOTICE

The bar operation was with full cooperation and consent.

DOING THIS ON YOUR OWN IS ILLEGAL.

Technology

Inbar Raz - Physical (In)Security – it’s not –ALL– about Cyber