Point-Of-Sale Vulnerabilities
Point-of-Sale Vulnerabilities
Hacker Factor Solutions
27-Aug-2007
Point-of-Sale Vulnerabilities
Dr. Neal Krawetz Hacker Factor Solutions White Paper
Copyright 2006-2007 Hacker Factor All rights reserved FOIA Exempt
Document history: Version 1.0: Initial draft. Version 1.1: Incorporated feedback from reviewers. Version 1.2: Incorporated additional feedback. Version 1.3: Limited release. Version 2.0: Public release.
Hacker Factor P.O. Box 270033 Fort Collins, CO 80527-0033 http://www.hackerfactor.com/
Page 1 of 17
Point-of-Sale Vulnerabilities
Hacker Factor Solutions
27-Aug-2007
Public Release
There are many issues related to the disclosure of the vulnerabilities described in this document. Ideally this document …show more content…
Instead, reporting attempts were limited to a small sample of representative companies, of which, few responded. The standard practice in the security community is to publicly release information when the vendor(s) is nonresponsive. However, the vulnerabilities disclosed in this document denote a set of fundamental flaws in the pointof-sale process. Even if a solution were available today, it would take years to be fully deployed. Given that a full disclosure of these vulnerabilities would unlikely lead to a rapid deployment and adoption of more secure systems, this public disclosure was delayed. It was hoped that the credit card industry would respond and address some of the more significant issues. Although a few of the issues appear to have been addressed (see Section 10: Addendum), there has not been any direct response or acknowledgement from the major credit card providers and processors. It is important to recognize that nothing in this paper is new or novel. In most cases, these risks have been known to the credit card industry for more than a decade, however little has been done to address these risks. In this paper, …show more content…
The main components are: • Card reader. A device for reading credit cards. This device is either a standalone unit, such as the Verifone TRANZ system, or integrated into a cash register. It is most recognizable by the magnetic strip reader (MSR), numeric keypad, and receipt printer. Transaction unit. This device sends the credit card information to an authenticating source (e.g., Visa) and receives a transaction confirmation number. For Verifone, the card reader and transaction unit are integrated into an embedded device (although Verifone does sell individual components as well). The Verifone units consist of a digital display and a numeric keypad. For other devices, such as IBM SurePOS or Panasonic’s POS Workstations, the card reader and transaction unit may be integrated into a cash register
Hacker Factor Solutions
27-Aug-2007
Point-of-Sale Vulnerabilities
Dr. Neal Krawetz Hacker Factor Solutions White Paper
Copyright 2006-2007 Hacker Factor All rights reserved FOIA Exempt
Document history: Version 1.0: Initial draft. Version 1.1: Incorporated feedback from reviewers. Version 1.2: Incorporated additional feedback. Version 1.3: Limited release. Version 2.0: Public release.
Hacker Factor P.O. Box 270033 Fort Collins, CO 80527-0033 http://www.hackerfactor.com/
Page 1 of 17
Point-of-Sale Vulnerabilities
Hacker Factor Solutions
27-Aug-2007
Public Release
There are many issues related to the disclosure of the vulnerabilities described in this document. Ideally this document …show more content…
Instead, reporting attempts were limited to a small sample of representative companies, of which, few responded. The standard practice in the security community is to publicly release information when the vendor(s) is nonresponsive. However, the vulnerabilities disclosed in this document denote a set of fundamental flaws in the pointof-sale process. Even if a solution were available today, it would take years to be fully deployed. Given that a full disclosure of these vulnerabilities would unlikely lead to a rapid deployment and adoption of more secure systems, this public disclosure was delayed. It was hoped that the credit card industry would respond and address some of the more significant issues. Although a few of the issues appear to have been addressed (see Section 10: Addendum), there has not been any direct response or acknowledgement from the major credit card providers and processors. It is important to recognize that nothing in this paper is new or novel. In most cases, these risks have been known to the credit card industry for more than a decade, however little has been done to address these risks. In this paper, …show more content…
The main components are: • Card reader. A device for reading credit cards. This device is either a standalone unit, such as the Verifone TRANZ system, or integrated into a cash register. It is most recognizable by the magnetic strip reader (MSR), numeric keypad, and receipt printer. Transaction unit. This device sends the credit card information to an authenticating source (e.g., Visa) and receives a transaction confirmation number. For Verifone, the card reader and transaction unit are integrated into an embedded device (although Verifone does sell individual components as well). The Verifone units consist of a digital display and a numeric keypad. For other devices, such as IBM SurePOS or Panasonic’s POS Workstations, the card reader and transaction unit may be integrated into a cash register