Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Security Businesses

POS Vendor Uses Same Short, Numeric Password Non-Stop Since 1990 128

mask.of.sanity writes: Fraud fighters David Byrne and Charles Henderson say one of the world's largest Point of Sale systems vendors has been slapping the same default passwords – 166816 – on its kit since 1990. Worse still: about 90 per cent of customers are still using the password. Fraudsters would need physical access to the PoS in question to exploit it by opening a panel using a paperclip. But such physical PoS attacks are not uncommon and are child's play for malicious staff. Criminals won't pause before popping and unlocking. The enraged pair badged the unnamed PoS vendor by its other acronym labelling it 'Piece of S***t.
This discussion has been archived. No new comments can be posted.

POS Vendor Uses Same Short, Numeric Password Non-Stop Since 1990

Comments Filter:
  • by EmagGeek ( 574360 ) <gterich AT aol DOT com> on Thursday April 23, 2015 @08:48AM (#49535709) Journal

    The fact that the vendor did not use a strong password does not make the system a "piece of shit." It just means that the vendor did not use a strong default password.

    • by rmdingler ( 1955220 ) on Thursday April 23, 2015 @09:00AM (#49535811) Journal
      Indeed, and any retailer who entrusts all their monetary transactions to a manufacturer's default password is probably going to slip up somewhere anyway.
      • by Anonymous Coward

        While it is the POS implementor's responsibility to properly set the password, the vendor can do things to enable the vendor to act securely.

        * Don't ship a default password
        * ship a default password, but force it to change on first login, and don't ever allow it to set back to teh default
        * offer stronger authentication options (smart card, OTP, etc)
        * provide a secure configuration guide so that customers are aware of everything they need to do in order to properly configure their stuff

        • by Just Some Guy ( 3352 ) <kirk+slashdot@strauser.com> on Thursday April 23, 2015 @11:50AM (#49537537) Homepage Journal

          provide a secure configuration guide so that customers are aware of everything they need to do in order to properly configure their stuff

          So much this. In the Slashdot echo chamber we presume that everyone in the world should be the security experts we are. No one outside forums like this thinks the way we do. Your average mom & pop grocer doesn't know about security, can't imagine what a "default password" is or why it would be bad, and sees a POS as an appliance much like a refrigerator or stove.

          Tell a restaurateur that they're stupid for not changing the default password, and they're likely to tell you how your stupid home food storage and cooking methods are likely to give you listeriosis. We are experts in our domain, and expecting everyone else to care about it (especially while remaining ignorant of their specialties) is a major failing on our part, not theirs.

        • by dgatwood ( 11270 )

          Better choice is #5. Ship a different, randomly-generated password on each device. Print it along with the serial number on a slip of paper that comes with the device. That way, there's a strong default passcode for people who won't bother to set a good one, and it isn't shared across devices.

          • by DutchUncle ( 826473 ) on Thursday April 23, 2015 @01:18PM (#49538519)
            ... And every single customer will wind up calling customer service asking why they can't get into their system. The papers got filed in shipping, or in finance, or tossed with the packaging. Maybe you could print it on a sticker, just like the serial number; then you have the physical security issue, but at least there's no global exposure.
      • by tlhIngan ( 30335 ) <slashdot&worf,net> on Thursday April 23, 2015 @12:38PM (#49538055)

        Indeed, and any retailer who entrusts all their monetary transactions to a manufacturer's default password is probably going to slip up somewhere anyway.

        Except it's likely the retailer doesn't know about it period. They buy a POS system, and it's actually installed, programmed and setup by the company they purchased it from. A lot of POS systems (excepting custom designed ones or franchisees who often have to purchase a specific unit from the franchiser) are purchased, set up, and installed by companies who do this. In fact, a lot of it is blocked out for customers (i.e., the retailer) by the manufacturer. The programming information and interface setup is often provided only to installers who are under orders to never reveal it to the retailer.

        Sure, the retailer has a few "controls" (they could add/remove products from inventory, do inventory and other day-to-day operations) but other ones including setting it up with a server, or even setting tax rates or categories (non taxable, partially taxable, fully taxable, etc) require an installer to do it.

        The retailer might not know of the password's existence or it could even be locked away under a anti-tamper seal put in by the installer so the retailer doesn't try to ... experiment.

      • That's why the payment card brands require PCI certification. Now that the rules are finally getting enforced with third party auditors checking such things, this crap is getting fixed.

        The system works if the rules are followed. Take a look at the 30 page+ PCI assessment (https://www.pcisecuritystandards.org/security_standards/documents.php) and ask yourself - if all these measure were *really* in place, how could a breach possibly happen?
    • POS = Point of Sale (Like a cash register)
      • by cdrudge ( 68377 )

        He knows what POS means. But calling it a piece of shit isn't entirely the fault of the manufacturer. It's also the fault of the retailer or installer for not changing it to something that is unique to that location or company.

        I own a padlock that allows me to set the combination by removing and rotating 4 dials to the letters or numbers that I want. It ships with a default combination of 0000. If I used it straight out of the package, does that make the lock a piece of shit just because it has a easy to

        • by markxz ( 669696 )

          Setting the default combination to 0000 would make users know that it is a default password (and make them dumb for not changing it). Using a more complex default combination would make it less likely that people will change it thinking they were allocated a secure code, not the default for that manufacturer.

    • by AmiMoJo ( 196126 ) <mojo@world3.nBLUEet minus berry> on Thursday April 23, 2015 @09:33AM (#49536123) Homepage Journal

      It was probably the customers who demanded the weak default password too. Anyone who has ever developed a system like this knows that the users are basically morons and won't be able to look up the default password in the manual (which they lost years ago) and will call your tech support line instead.

      I used to write software for fire alarms and the customers demanded the default password on everything (which was the first four digits of the manufacturer's phone number, back in the late 80s before the great re-numbering). Often they wanted a sticker on the damn alarm panel with the password printed on it, preferring instead to rely on locking the cabinet with a key. The fire alarm panel could control various vents and fans that were designed to extract smoke from a burning building, but people liked to use them for day-to-day climate control as well.

      Most people don't care about security. If they get hacked it's someone else's fault, they are the victim. They just want an easy life and cool breeze in the summer.

    • by SCPaPaJoe ( 767952 ) on Thursday April 23, 2015 @09:44AM (#49536231)
      One of the requirements of PCI compliance with the credit card companies is that you don't use default passwords in any equipment tied to the card transaction.
      • by bondsbw ( 888959 )

        Does that mean the company using the POS would be held liable in the case of a direct breach of their system?

      • One of the requirements of PCI compliance with the credit card companies is that you don't use default passwords in any equipment tied to the card transaction.

        True, but...

        1) Does PCI compliance/certification even go near individual retailers/businesses, or does it stop cold at the merchant card processor that the retailer/PoS dials into with each transaction? I'm not quite seeing a small Mom-n-Pop store undergoing a PCI audit anytime soon...

        2) For folks who do their own in-house processing, how many auditors do you know of that painstakingly test each and every PoS machine in every store (e.g. Wal-Mart, whenever they recertify)? Hell - they barely sample servers,

        • We have four retail clothing stores. Each store is scanned by the card processor once a quarter. Once a year I have to fill out a Self Assessment Questionnaire which addresses the default password issue among other things. It's a royal pain in the ass. I failed scans in the past for having our systems locked down so tight that the scans were blocked. That seemed ideal to me, but the processor saw it differently. I had to white-list their ip range.
      • One of the requirements of PCI compliance with the credit card companies is that you don't use default passwords in any equipment tied to the card transaction.

        Which makes this even more interesting. Based on the password and the fact that a paperclip is required I know the specific vendor and equipment to which the article refers, despite the authors going to great lengths to omit that information. The vendor is a big one and their equipment is involved in millions of electronic payments made every day. You

    • by dbIII ( 701233 )
      It also makes it more likely that since they put so little thought and care into one thing that there are other things that add up to a pile of shit, not just a piece of shit.
      I've actually seen even worse passwords on POS systems and remote access requirements meant they could not be changed away from the default - which was printed on the side of the devices!
    • by Jawnn ( 445279 )
      With apologies to Momma, shitty is as shitty does.
    • The problem is not the passwords they use. Its that all these POS system ARE RUNNING WINDOWS! An OS that has been proven time and again to have ZERO security.
      • Whether or not it is a "piece of shit" does not depend on what O/S it is running. It depends on whether it meets all of the customer requirements.

    • Using it since 1990 though is pretty standard. It's harder to change the code for this than it is to design a brand new system from scratch. Half the departments will start screaming at you for making unnecessary changes, and the other half of the departments will scream at you because they fear thousands of customers being locked out of their systems.

  • by Anonymous Coward on Thursday April 23, 2015 @08:49AM (#49535731)

    the 10% who managed to change the default password replaced it by 12345

    • by ebvwfbw ( 864834 )

      That's stupid. Of course they replaced it with 54321. That's really secure. Nobody would think of that.

      Of course I've found plenty that were set to 00001.

  • Everybody jumps on the three-letter acronym, but no love for the researcher's name [wikipedia.org]?

  • by CrAlt ( 3208 ) on Thursday April 23, 2015 @08:58AM (#49535793) Homepage Journal

    If they don't name the vender then what will change?
    How can users be warned?
    How do we know its even true?

    They might as well be bashing some made up system by some fake company that doesn't exist.

    • Re: useless story (Score:5, Insightful)

      by Anonymous Coward on Thursday April 23, 2015 @09:05AM (#49535835)

      Based on it being 6 digits starting with 166, I'd say it is VeriFone. Their card terminals have the same kind of 6 digit code starting with 166.

    • Re:useless story (Score:5, Informative)

      by Hartree ( 191324 ) on Thursday April 23, 2015 @09:43AM (#49536221)

      It's VeriFone. Anyone who's been a credit card terminal tech could tell you that. Hypercom has a well known default password as well. Any competent fraudster trying to reprogram the pad would know it as well.

      They have to put in something at the factory, so they put in a default. It's supposed to be changed when the system is programmed and set up.

      I used to have the default password for VeriFone's 101 pin pads in muscle memory due to having set up so many of them. (Yes, part of the setup was changing the default to something else.)

      • They have to put in something at the factory, so they put in a default.

        It's not the only option is a single password for every device. They could just as easily plug it in to something, set a random password for just that device, and have a sticker print out with the password that gets put on the device. I've seen modems ship like that, with a 20-character password that is obviously random for that device (since it's printed on the same sticker as the MAC).

        • by Hartree ( 191324 )

          And then some idiots would leave the sticker attached to it and if forced to change the password they'd change it back to the original. You know what they say about "foolproof".

          • So you're suggesting that a better alternative is to set the same password for every device instead of shipping each device with a unique password? I didn't say anything about "foolproof". I'm saying that shipping every device with the same password is not the only option, it's not even a good option.

            • by Hartree ( 191324 )

              No, I was simply noting that technical solutions are limited in solving what are human problems at the base.

              The base problem is valuing "easy" over secure.

              The real problem to be solved is a bit harder: Finding a technical or human way to block that problem, that's still workable (think about bricked devices from an unknown password that can't be reset) enough to be accepted by users and the companies fielding them.

    • If they don't name the vender then what will change?

      They won't be dragged off to court, or now that we have DMCA bullshit they won't be dragged off to jail like Dmitry S. vs Adobe. If they name them one or both may happen.

  • Using some secret number, calculate the hash of that number concatenated with the current hour and minute. Then, when someone comes by to unlock it, they just use the same algorithm with the same secret number to generate a hash that matches the one on the machine. Authenticate based off of equality of user given hash and machine calculated hash.

    Of course, concatenation maybe isn't the best option if you want a large amount of entropy behind the hash code. Maybe replace the human and PIN input with a seria

    • by Sneeka2 ( 782894 )

      I'll bite... wut?!

      If you're asking a user to calculate a hash in their head based on a secret plus the current time when entering a password, you're greatly overestimating the amount of time and mental capacity regular people have.
      If OTOH you're talking about using a hash of a secret plus the unhashed current time, your suggestion is completely useless. The hash would be static and simply be a normal static password, and the addition of the current time would be of no extra significance to security. Not to

      • hash ( (secret) concat (date) concat (time-to-the-nearest-second) )

        I wasn't thinking straight. A smart card is definitely better

        • That weakens security. It means the computer needs to store the secret in a readable way, and once readthe secret is known, and the time and hashing simply obscures the sending over the wire. Since the hash is not a shared secret, no extra security is proviDed. Best to have the secret hashed in a non readable way.

  • What could someone possibly do if they gain admin access to a POS? Is this a Windows CE system where someone could run arbitrary code? Or is this a bespoke system where the admin password just gives you access to the settings of the system? The article mentions staff using a POS server to play games and download porn on but that is a server probably running Windows Server with some POS server software from the vendor. Rather than just making fun of the name, these guys should explain what exactly does the a

    • What could someone possibly do if they gain admin access to a POS?

      Ummm ... it's kind of the cash register, tied into what sales you've made. So, with the admin password, maybe your staff can fiddle with the numbers and rob you blind.

      Hell, it could be tied to your inventory system. Oh, and don't forget credit cards details of your patrons.

      Your POS is the keys to the kingdom.

    • by dbIII ( 701233 )
      Gain? Change the transaction information so the numbers match when you steal a lot of money out of the till for one thing.
  • by Anonymous Coward

    166831 has been the default pw on VeriFone card terminals and "multilane" on Hypercom ones for as long as I can remember. Of course these are supposed to be changed at install time, but we know how that goes...

  • Odd Findings (Score:3, Interesting)

    by Anonymous Coward on Thursday April 23, 2015 @09:04AM (#49535829)

    The pair iterated some brazen criminal and hopeless customer cases they each dealt with while at Trustwave where PoS systems had been compromised. ...
    In another, forensics were left stumped by a carder's keylogger which had logged repeat keys (such as aaaaa ggggg bbbbb) entered on the PoS server. It was later revealed staff had used the machine to play Guitar Hero, Call of Duty, and download porn.

    Forensics had even established which songs were played based on the logged keys.

    The researchers found that next to the ubiquitous use of the password 166816 amongst separate manufacturers, that Deep Purple's "Smoke on the Water" was the most played song on compromised PoS terminals. Strange.

  • by gatkinso ( 15975 ) on Thursday April 23, 2015 @09:11AM (#49535887)

    The vendor recently updated the default password to "166832".

  • One of the most popular Point of Sales systems is called 'RealPOS'. I wouldn't be surprised if this is the one referenced in the article.
    • by Holi ( 250190 )
      It's not, it's Verifone, which is odd because I thought they did payment solutions not the actual POS software. Looking at their site I don't see any POS solutions, just payment solutions for actual POS software (like Micros).
    • by Holi ( 250190 )
      isn't RealPOS NCR's hardware line? Their software would be Counterpoint or OmniPOS among others, it depends on the industry. I don't know much about the retail market in POS, but I support several different systems for the Restaurant/Bar industry, most of them suck.
  • The actual presentation [rsaconference.com] is much worse than just passwords.

    Really pathetic that "chip and sign" won't do much to fix these issues. Disappointed that they didn't shame the manufacturer, although there are really only 3 left now among the majors.

    (And sadly, the link to that presentation's directory is "writeable." Sometimes even security specialists get it wrong...)

  • Without additional context I would say "So what?".

    Questions that need answering:
    - Can end user change the default password?
    - Do installation best practices from manufacturer dictate to change the default password?
    - Who performs the installation and maintains the devices?

    Without answers to these it is hard to say whether the issue lies with the manufacturer, the reseller or the end user.
  • Fraudsters would need physical access to the PoS in question to exploit it by opening a panel using a paperclip.

    This isn't really a problem. Where are regular people who don't work in security going to get a paperclip?

    • You'll need a three day wait and a background check to secure one of these terrorist "paperclips". Sure, you could 3D bend your own with some wire and a few thousand dollars in equipment, but it will still be inferior to the real thing.


    • by PPH ( 736903 )

      Tweeted from a 787 in flight: "I have a paperclip."

  • Criminals won't pause before popping and unlocking.

    My own preference is to pop and lock [youtube.com].

  • What does knowing this password allow a malicious person to do, that he couldn't do otherwise?

    • Apparently play games and download porn on the PoS.
      In theory an american PoS has access to credit card numbers. Since the PoS apparently is a fully fledged Windows machine with internet access these cc numbers could be stolen.

  • by toadlife ( 301863 ) on Thursday April 23, 2015 @11:55AM (#49537595) Journal

    Our solution by Food Service Solutions has a hard-coded superuser admin account with the username of "a" and the password of "a."

    It's used by thousands of institutions.

    You can't disable it.

  • There's a reason why linksys, D-link and others do pretty much the same thing.

  • Change the password! If you're not going to be proactive about security, why should anyone help you?
  • The Military used to call our cars POV's and I used to call my car a POV, POS. Then came the point of sale setups and they appropriated my acronym. Now we can go back to using POS as it's original intended purpose. BTW thanks for giving me the password, it think I might just get rich and lucky this weekend...
  • Most large commercial device makers do exactly this same thing.

    Routers, Credit Card terminals, Coke machines.

    Not only do they all do this, the default passwords and the correct menus to select are all well documented online.

    You can walk up to most digital Coke machines and reboot them, and reconfigure their settings to do all kinds of things.

Our business in life is not to succeed but to continue to fail in high spirits. -- Robert Louis Stevenson