Researchers Find Way to Break Into Ingenico and Verifone POS Terminals

guest · Dec 9, 2020

Researchers Find Way to Break Into “Ingenico” Telium 2 POS Terminals
A large number of “Ingenico” Telium 2 POS terminals could be vulnerable to severe attacks
December 6, 2020
https://www.technadu.com/researchers-find-way-break-into-ingenico-telium-2-pos-terminals/229882/

Researchers from the “Positive Technologies” team have found a way to exploit a lengthy chain of vulnerabilities and obtain full control over an “Ingenico” Telium 2 POS terminal. The attack enables an actor to intercept card PIN codes and magnetic strip data, which makes cloning possible. Moreover, the attacker can send money withdrawal requests to a bank account and practically empty it before the victim is given a chance to realize what’s happening.

As the researchers detail, some of the flaws could be exploited remotely, but most would require physical access. Below are the vulnerabilities relevant to the Telium 2 POS terminals.
Ingenico, being one of the largest electronic transactions company in the world, has already pushed fixing updates for the above flaws
Click to expand...

Positive Technologies: vulnerabilities in Ingenico POS terminals allowed hackers to intercept PIN code and data needed to clone the magnetic strip of a bank card

"Some of these vulnerabilities could be exploited remotely. Although most of the vulnerabilities require physical access to a terminal to be exploited, obtaining such access is not a big deal for an attacker. POS terminals are usually owned by banks but can be easily accessed by third parties, such as employees of trade or service companies.
An attacker could modify a terminal by exploiting its vulnerabilities and attack clients of a trade company by sending arbitrary authorization commands to acquiring banks or cloning the magnetic strip of a bank card to be used in a region with less stringent card verification requirements."
Click to expand...

guest · Dec 10, 2020

‘Millions’ Of Payment Terminals Are Vulnerable To Credit Card Theft Hacks
December 10, 2020
https://www.forbes.com/sites/thomas...ls-are-vulnerable-to-credit-card-theft-hacks/

Point-of-sale payment devices made by two of the industry’s biggest manufacturers contained vulnerabilities that made stealing credit card data much simpler. Millions of devices may be affected, according to cybersecurity researchers Timur Yunosov and Aleksei Stennikov, who will present their findings at the Black Hat EU security conference on Thursday.

The weaknesses lay in devices made by Verifone and Ingenico.
The first issue was that they used default passwords that let anyone with physical access through to a “service menu.” These menus contained functions that could be abused to write malware onto the terminals. The malware could then hoover up credit card numbers once the device was in use again.
Click to expand...

The researchers provided Forbes with an image showing they’d fully compromised a Verifone terminal to display whatever they wanted.
Disclosure to Verifone and Ingenico started two years ago and the issues have now been patched, according to the vendors. Both companies said the attacks were limited given the need for physical access and prior research to hack into them.
Click to expand...

A Verifone spokesperson said they affected devices were “legacy” and the company was not aware of the vulnerabilities being exploited by real-world hackers.
An Ingenico spokesperson said: “Different vulnerabilities impacting Ingenico POS Telium 2 terminal solutions have been identified. Proper security measures have been developed immediately to include suitable corrections after the vulnerabilities have been identified.
Click to expand...

Positive Technologies: Fix issued for Verifone POS terminals after Positive Technologies discovers eight dangerous vulnerabilities

Log in or Sign up

Researchers Find Way to Break Into Ingenico and Verifone POS Terminals

guest Guest

guest Guest

Log in or Sign up

Researchers Find Way to Break Into Ingenico and Verifone POS Terminals

guest Guest

guest Guest

Useful Searches