BREAKING	  	  THE	  PAYMENT	  POINTS	  OF	  INTERACTION	  (POI)
Nir  Valtman@ValtmaNir&Patrick	  Watson@PatrickTheDev

THE  CHALLENGE
Introduce  2  chatterboxes  in  1  slide!

2<?xml  version="1.0"  encoding="WTF-­8"?><speakers><identity  username="Nir  Valtman"  twitter="@ValtmaNir"><head>Application  Security</head><moto>If  security  is  expensive,  try  to  ignore  it!</moto><presented>Black  Hat,  DEF  CON,  OWASP  etc.</presented><opensource>SAPIA,  Cloudefigo,  Memory  Scraper,  Secure  TDD,  AntiDef</opensource></identity><identity  name="Patrick  Watson"  twitter="@PatrickTheDev"><body  id="Architect">Application  Security</body><moto>[Patrick  to  fill  it]</moto><presented  firstTimeSpeaker="YEAAAH"></presented><opensource>Who  cares?  I  develop  better  than  Nir!</opensource></identity></speakers><data>      <Instances><BucketPolicyPath>CloudServices/IaaS/RuntimeConfig/BucketPolicy.config</BucketPolicyPath><IAMBasicPolicyPath>CloudServices/Admin/RuntimeConfig/IAMBasicPolicy.config</IAMBasicPolicyPath><IAMStrictPolicyPath>CloudServices/IaaS/RuntimeConfig/IAMStrictPolicy.config</IAMStrictPolicyPath><CloudInitScriptPath>CloudServices/Admin/RuntimeConfig/CloudConfig.config</CloudInitScriptPath><NamingPrefix>cloudsec</NamingPrefix><ProductionSecurityGroupId>sg-­7befd21a</ProductionSecurityGroupId><ProductionSubnetId>subnet-­59e2f822</ProductionSubnetId><RemediationSecurityGroupId>sg-­e6323583</RemediationSecurityGroupId><EC2KeyName>mykey</EC2KeyName><CanonicalUserId>ebe679934645434355740c643faeb405a27ab195a29e5f20f326082fc5abdfb8</CanonicalUserId></Instances><Chef><KeyFilePath>validation.pem</KeyFilePath><ValidationClientName>cloudsecdemo-­validator</ValidationClientName><ServerURL>https://api.opscode.com/organizations/cloudsecdemo</ServerURL></Chef><Nessus><Protocol>https</Protocol><IPAddress>1.1.1.1</IPAddress><Port>8834</Port><Username>aaa</Username><Pssword>bbbbb</Pssword><ScanPolicyId>1</ScanPolicyId></Nessus><Chef><KeyFilePath>validation.pem</KeyFilePath><ValidationClientName>cloudsecdemo-­validator</ValidationClientName><ServerURL>https://api.opscode.com/organizations/cloudsecdemo</ServerURL></Chef><Instances><BucketPolicyPath>CloudServices/IaaS/RuntimeConfig/BucketPolicy.config</BucketPolicyPath><IAMBasicPolicyPath>CloudServices/Admin/RuntimeConfig/IAMBasicPolicy.config</IAMBasicPolicyPath><IAMStrictPolicyPath>CloudServices/IaaS/RuntimeConfig/IAMStrictPolicy.config</IAMStrictPolicyPath><CloudInitScriptPath>CloudServices/Admin/RuntimeConfig/CloudConfig.config</CloudInitScriptPath><NamingPrefix>cloudsec</NamingPrefix><ProductionSecurityGroupId>sg-­7befd21a</ProductionSecurityGroupId><ProductionSubnetId>subnet-­59e2f822</ProductionSubnetId><RemediationSecurityGroupId>sg-­e6323583</RemediationSecurityGroupId><EC2KeyName>mykey</EC2KeyName><CanonicalUserId>e55740c643faeb405a27ab195a29e5f20f326082fc5abdfb8</CanonicalUserId></Instances><Nessus><Protocol>https</Protocol><IPAddress>1.1.1.1</IPAddress><Port>8834</Port><Username>aaa</Username><Pssword>bbbbb</Pssword><ScanPolicyId>1</ScanPolicyId><Instances><BucketPolicyPath>CloudServices/IaaS/RuntimeConfig/BucketPolicy.config</BucketPolicyPath><IAMBasicPolicyPath>CloudServices/Admin/RuntimeConfig/IAMBasicPolicy.config</IAMBasicPolicyPath><IAMStrictPolicyPath>CloudServices/IaaS/RuntimeConfig/IAMStrictPolicy.config</IAMStrictPolicyPath><CloudInitScriptPath>CloudServices/Admin/RuntimeConfig/CloudConfig.config</CloudInitScriptPath><NamingPrefix>cloudsec</NamingPrefix><ProductionSecurityGroupId>sg-­7befd21a</ProductionSecurityGroupId><ProductionSubnetId>subnet-­59e2f822</ProductionSubnetId><RemediationSecurityGroupId>sg-­e6323583</RemediationSecurityGroupId><EC2KeyName>mykey</EC2KeyName><CanonicalUserId>e55740c643faeb405a27ab195a29e5f20f326082fc5abdfb8</CanonicalUserId></Instances><Nessus><Protocol>https</Protocol><IPAddress>1.1.1.1</IPAddress><Port>8834</Port><Username>aaa</Username><Pssword>bbbbb</Pssword><ScanPolicyId>1</ScanPolicyId></Nessus><Chef><KeyFilePath>validation.pem</KeyFilePath><ValidationClientName>cloudsecdemo-­validator</ValidationClientName><ServerURL>https://api.opscode.com/organizations/cloudsecdemo</ServerURL></Chef><Instances><BucketPolicyPath>CloudServices/IaaS/RuntimeConfig/BucketPolicy.config</BucketPolicyPath><IAMBasicPolicyPath>CloudServicesdfdsfdsffsfsfdsfdsfdsfsds/Admin/RuntimeConfig/IAMBasicPolicy.config</IAMBasicPolicyPath><IAMStrictPolicyPath>CloudServices/IaaS/sdfdsfsdRuntimeConfig/IAMStrictPolicy.config</IAMStrictPolicyPath><CloudInitScriptPath>CloudServices/Asdfsdfdmin/RuntimeConfig/CloudConfig.config</CloudInitScriptPath><NamingPrefix>cloudsec</NamingPrefix><ProductionSecurityGroupId>sg-­7befd21a</ProductionSecurityGroupId><ProductionSubnetId>subnet-­59e2f822</ProductionSubnetId><RemediationSecurityGroupId>sg-­e6323583</RemediationSecurityGroupId><EC2KeyName>mykey</EC2KeyName><CanonicalUserId>e55740c643faeb405a27ab195a29e5f20f32wdsfsdfdfdsfdsfsdfsdfsfsdfsdf6082fc5abdfb8</CanonicalUserId></Instances></data>  <?xml	  version="1.0"	  encoding="WTF-­‐8"?><speakers><identity username="Nir	  Valtman"	  twitter="@ValtmaNir"><org	  title=“Head”>NCR	  Application	  Security</org><motto>If	  security	  is	  expensive,	  try	  to	  ignore	  it!</motto><presented>Black	  Hat,	  DEF	  CON,	  OWASP	  etc.</presented><opensource>SAPIA,	  Cloudefigo,	  Secure	  TDD,	  AntiDef</opensource></identity><identity	  username="Patrick	  Watson"	  twitter="@PatrickTheDev"><org	  title="Architect">NCR	  Application	  Security</org><motto>If	  I	  shouldn't	  tell	  you	  how	  my	  system	  works,	  it	  isn't	  secure</motto><presented	  firstTimeSpeaker=”F***K	  YEAAAH” /><opensource>Who	  cares?	  I	  develop	  better	  than	  Nir!</opensource></identity></speakers>3

THE  RESEARCH
Nir:  ”Can’t  we  just  change  this  damn  flow  in  the  POI?”
Patrick:  “LOL,  see  what  happens!  We’re  going  to  Vegas  this  year!”  4The  result  – high  fived  our  product  to  research  anarchy!

5Various  Business  Flows
What  would  you  say  if  I  told  you  that  the  Retail industry  is  the  most  secure?

RetailHospitality

Petroleum  &  Convenience6

7

INTRO  TO
PAYMENTS  &  POIPayments  POI,  meet  Nir &  Patrick.  We  hack  stuff  for  fun!

8

Segregated  store  architecture9All-­in-­one  store  architecture

10Fuel  station  architecture11

Typical  Payment  Flow

12

WEAK  AUTHENTICATION  TO  POIKnock-­knock.  Who’s  there?  It’s  YOU!

13

How  fuel  pumps  authenticate  to  the  L2  adaptor?

Current  Loop
14

How  shim  software  works?

Point  of  Sale

Payment  App

POI

Shim  Software  (TCP/IP,  Serial,  Binary)15

A  shim  software  demo  using  a  Pi

16

Encryption  strength  limitations

Sometimes  NOT  even  SSLv3!
Business  justification:  “we  have  old  hardware  (POS  or  POI)”
Hackers’  justification:  “it  wasn’t  encrypted,  I  had  to  steal  it”

17Showing  off  with  a  demo

18

19

7/28

20

Unclear  API  documentation

21

FORGET  ABOUT  SWIPING!  
WHAT  ABOUT  EMV?
It’s  obviously  secure  as  hell,  isn’t  it?

22

EMV  DOES
Prevent	  duplication	  of	  card

Chip	  &	  PIN	  prevents	  using	  a	  stolen	  card

23

EMV  DOES  NOTPrevent	  using	  card	  number	  elsewhere
Prevent	  using	  modified	  Track	  2	  in	  offline	  mode
Prevent	  unmodified	  Track	  2	  w/	  EMV	  after	  tricking	  into	  technical	  fallback	  to	  swipe24

Passive  MITM
Track  2  Compromise25

I’m  all  ears!  Where’s  the  demo?

26

The  Basics  of  EMV;=?
27

Which  info  you  need  to  make  a  purchase  online?
✓Personal  Account  Number  (aka  PAN)
✓Expiration  Date
✓Cardholder’s  Name
CVV228BYPASSING  THE  EMV  FLOWS
It’s  obviously  secure  as  hell,  isn’t  it?

29

Active  MITM
Track  2  &  CVV2  Compromise

30

31

Active  MITM  Track  2  &  PIN  Compromise

32DEMO:  Let’s  steal  few  PINs

33

WHAT  IF  CVV2/PAN  ARE  RESTRICTED  BY  A  WHITE  LIST?
We  leverage  other  white  listed  functionality!

34

Bypassing  the  prompt  white  list
Enter	  User	  IDEnter	  Phone

Enter	  Card	  NumberPlease	  Reenter

Enter	  CVVEnter	  SSN
35

Form/Screen  Injection
Remember  that  there  is  NO  authentication  to  POI?

PhotoMasked
4-­digit  control

Signing	  MAY	  be	  required	  by	  several	  vendors	  though

36

37

ANY  OTHER  ATTACK  VECTORS?
Let  me  think  about  it  for  a  day  or  two  …  YES!

38

Skimmers

39

Exploit  POI’s  Operating  System

40

MITIGATIONS
Enough  complaining  about  problems!

41

Point-­to-­Point  Encryption  (P2PE)

Use  ONLY  hardware-­based  message  encryption
Preferably  SRED  enabled42

Point-­to-­Point  Encryption  (P2PE)

Leverage  strong  crypto  algorithms
AES/3DES  DUKPTRSA

43

Point-­to-­Point  Encryption  (P2PE)

Prevent  remote  firmware  downgrades  to  software-­based  encryption
Firmware  must  be  signed  anyway

44

Point-­to-­Point  Encryption  (P2PE)

Allow  ONLY  signed  white  list  updates  by  vendor
Credit  card  bin  ranges
Trusted  Certificate  Authorities

45

Point-­to-­Point  Encryption  (P2PE)

Encrypt  offline  transaction  data  on  payment  applications

46

What  if  the  POI  or  Payment  Application  doesn’t  support  P2PE?

47

What  can  merchants/vendors  do?

TLS	  it!

Sign	  all	  requests	  to	  POI

48

WHAT  CAN  A  CONSUMER  DO?
Except  paying  with  cash…

49

AWARENESS  AWARENESS  AWARENESS
Never	  re-­‐enter	  PINBe	  cautious	  of	  unusual	  prompts	  App-­‐based	  payment	  systems	  MAY	  be	  preferredNo	  PAN	  transmission	  -­‐ tokenization
Unique	  Track2	  per	  transaction50Summary§ Relatively  easy  to  exploit  common  POI  deployments.
§ The  lack  of  authentication  poses  the  POI  to  major  risks.  
§ EMV  can  be  bypassed  by  easily  tricking  the  POI.

§ Points  of  interaction  can  be  secure.
§ P2PE  solution§ Added  authentication  mechanisms

51

QUESTIONSQUESTIONSQUESTIONS
Nir  Valtman@ValtmaNir
QUESTIONSQUESTIONSPatrick  Watson@PatrickTheDev
QUESTIONS

52