POS Vendor Uses Same Short, Numeric Password Non-Stop Since 1990 128
mask.of.sanity writes: Fraud fighters David Byrne and Charles Henderson say one of the world's largest Point of Sale systems vendors has been slapping the same default passwords – 166816 – on its kit since 1990. Worse still: about 90 per cent of customers are still using the password. Fraudsters would need physical access to the PoS in question to exploit it by opening a panel using a paperclip. But such physical PoS attacks are not uncommon and are child's play for malicious staff. Criminals won't pause before popping and unlocking. The enraged pair badged the unnamed PoS vendor by its other acronym labelling it 'Piece of S***t.
Not a Piece of Shit (Score:5, Insightful)
The fact that the vendor did not use a strong password does not make the system a "piece of shit." It just means that the vendor did not use a strong default password.
Re:But it does (Score:5, Insightful)
Which is why vendors shouldn't ship products with default passwords at all. Instead, they should require all users to set a password when the system is first installed.
Re: (Score:2)
And the customer will simply set it to "123456".
I had a client in the financial business, and the so-called, "Office-Manager" / Comptroller set all the passwords to "password" and several variations on this! He REFUSED to set them to secure passwords, even though if they were hacked, they could have lost millions of dollars in their client's money and securities!
That company is now someone else's headache now.
Re: (Score:3)
Re: (Score:3)
What if you made the default password the date the system was turned on? Sure, it's a simple 8 digit numeric value, but it would be somewhat unique per machine or local bank of machines. Don't ask them for a default password, tell them what it is and make them go change it. Various studies suggest they probably won't.
Re: (Score:2)
What if you made the default password the date the system was turned on?
Then I as a thief would do some basic research into the date that that location opened for business and try 2-3 guesses close to that date before getting it bang on.
Re: (Score:3)
Any half-decent system will disallow passwords like this.
Enforce strong passwords? Prepare for a sticky notes [arstechnica.com].
Re: (Score:2)
And at *that* point it's the user's fault. But not until the vendor stops shipping things with default passwords and not asking you to change it at first setup.
Re: (Score:2)
And the default password isn't something obvious like "123456" so it's not like the vendor didn't care about it either.
Re: (Score:3)
Ok, how about the fact that credit card numbers are stored in the memory dump of the unit? When encrypted, credit cards storage uses a symmetric key? Servers are regularly stolen, but the drives are not encrypted? The software must be installed as the admin user?
From a security perspective, these units really are a POS and a betrayal of trust by the vendors. Most retailers do not have staff on-property to do IT security, so they out-source it. They have been charged an arm and a leg, but do not get a s
Re:Not a Piece of Shit (Score:5, Insightful)
Re: (Score:1)
While it is the POS implementor's responsibility to properly set the password, the vendor can do things to enable the vendor to act securely.
* Don't ship a default password
* ship a default password, but force it to change on first login, and don't ever allow it to set back to teh default
* offer stronger authentication options (smart card, OTP, etc)
* provide a secure configuration guide so that customers are aware of everything they need to do in order to properly configure their stuff
Re:Not a Piece of Shit (Score:5, Insightful)
provide a secure configuration guide so that customers are aware of everything they need to do in order to properly configure their stuff
So much this. In the Slashdot echo chamber we presume that everyone in the world should be the security experts we are. No one outside forums like this thinks the way we do. Your average mom & pop grocer doesn't know about security, can't imagine what a "default password" is or why it would be bad, and sees a POS as an appliance much like a refrigerator or stove.
Tell a restaurateur that they're stupid for not changing the default password, and they're likely to tell you how your stupid home food storage and cooking methods are likely to give you listeriosis. We are experts in our domain, and expecting everyone else to care about it (especially while remaining ignorant of their specialties) is a major failing on our part, not theirs.
Re:Not a Piece of Shit (Score:4, Insightful)
People are stupid if they don't realize a password is like a key.
They do, and the problem is that they treat it exactly like one. When you buy a lock, do you immediately re-key it? No: you use it as-is. Now maybe if the key looked very suspicious, like say it was a perfect sine or square wave or it was completely smooth, then you might ask the blacksmith whether that's normal. I bet those shopkeepers would be asking the same of their POS installer if the password was "123456" or "111111".
But to their (and my) untrained eye, "166816" looks reasonably random. It looks as random as my Schlage house key does. Maybe there's a locksmith forum where experts are making fun of me for not changing my obviously default lock. After all, they can tell at a glance that I have the standard factory issue! How stupid am I for using it without making my own pattern!
No, I think you're exactly wrong. People think of these passwords as keys. They use the ones manufacturers give them. They hand them out to the same staff that have keys to the front door and cash drawers. They don't routinely change them when people quit. They don't audit their usage. They treat them just like the little medal danglies on the ring in their pocket, no more, no less. We've done a very poor job of telling them why they should think otherwise.
Re: (Score:2)
Re: (Score:2)
Better choice is #5. Ship a different, randomly-generated password on each device. Print it along with the serial number on a slip of paper that comes with the device. That way, there's a strong default passcode for people who won't bother to set a good one, and it isn't shared across devices.
Re:Not a Piece of Shit (Score:4, Interesting)
Re:Not a Piece of Shit (Score:5, Informative)
Except it's likely the retailer doesn't know about it period. They buy a POS system, and it's actually installed, programmed and setup by the company they purchased it from. A lot of POS systems (excepting custom designed ones or franchisees who often have to purchase a specific unit from the franchiser) are purchased, set up, and installed by companies who do this. In fact, a lot of it is blocked out for customers (i.e., the retailer) by the manufacturer. The programming information and interface setup is often provided only to installers who are under orders to never reveal it to the retailer.
Sure, the retailer has a few "controls" (they could add/remove products from inventory, do inventory and other day-to-day operations) but other ones including setting it up with a server, or even setting tax rates or categories (non taxable, partially taxable, fully taxable, etc) require an installer to do it.
The retailer might not know of the password's existence or it could even be locked away under a anti-tamper seal put in by the installer so the retailer doesn't try to ... experiment.
Re: (Score:2)
The system works if the rules are followed. Take a look at the 30 page+ PCI assessment (https://www.pcisecuritystandards.org/security_standards/documents.php) and ask yourself - if all these measure were *really* in place, how could a breach possibly happen?
Re: (Score:1)
Re: (Score:2)
He knows what POS means. But calling it a piece of shit isn't entirely the fault of the manufacturer. It's also the fault of the retailer or installer for not changing it to something that is unique to that location or company.
I own a padlock that allows me to set the combination by removing and rotating 4 dials to the letters or numbers that I want. It ships with a default combination of 0000. If I used it straight out of the package, does that make the lock a piece of shit just because it has a easy to
Re: (Score:1)
Setting the default combination to 0000 would make users know that it is a default password (and make them dumb for not changing it). Using a more complex default combination would make it less likely that people will change it thinking they were allocated a secure code, not the default for that manufacturer.
Re:Not a Piece of Shit (Score:5, Insightful)
It was probably the customers who demanded the weak default password too. Anyone who has ever developed a system like this knows that the users are basically morons and won't be able to look up the default password in the manual (which they lost years ago) and will call your tech support line instead.
I used to write software for fire alarms and the customers demanded the default password on everything (which was the first four digits of the manufacturer's phone number, back in the late 80s before the great re-numbering). Often they wanted a sticker on the damn alarm panel with the password printed on it, preferring instead to rely on locking the cabinet with a key. The fire alarm panel could control various vents and fans that were designed to extract smoke from a burning building, but people liked to use them for day-to-day climate control as well.
Most people don't care about security. If they get hacked it's someone else's fault, they are the victim. They just want an easy life and cool breeze in the summer.
Re:Not a Piece of Shit (Score:5, Informative)
Re: (Score:2)
Does that mean the company using the POS would be held liable in the case of a direct breach of their system?
Re: (Score:2)
One of the requirements of PCI compliance with the credit card companies is that you don't use default passwords in any equipment tied to the card transaction.
True, but...
1) Does PCI compliance/certification even go near individual retailers/businesses, or does it stop cold at the merchant card processor that the retailer/PoS dials into with each transaction? I'm not quite seeing a small Mom-n-Pop store undergoing a PCI audit anytime soon...
2) For folks who do their own in-house processing, how many auditors do you know of that painstakingly test each and every PoS machine in every store (e.g. Wal-Mart, whenever they recertify)? Hell - they barely sample servers,
Re: (Score:2)
Re: (Score:3)
Which makes this even more interesting. Based on the password and the fact that a paperclip is required I know the specific vendor and equipment to which the article refers, despite the authors going to great lengths to omit that information. The vendor is a big one and their equipment is involved in millions of electronic payments made every day. You
Re: (Score:2)
I've actually seen even worse passwords on POS systems and remote access requirements meant they could not be changed away from the default - which was printed on the side of the devices!
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
Whether or not it is a "piece of shit" does not depend on what O/S it is running. It depends on whether it meets all of the customer requirements.
Re: (Score:2)
Using it since 1990 though is pretty standard. It's harder to change the code for this than it is to design a brand new system from scratch. Half the departments will start screaming at you for making unnecessary changes, and the other half of the departments will scream at you because they fear thousands of customers being locked out of their systems.
Unfortunately... (Score:5, Funny)
the 10% who managed to change the default password replaced it by 12345
Re: (Score:1)
That's stupid. Of course they replaced it with 54321. That's really secure. Nobody would think of that.
Of course I've found plenty that were set to 00001.
Re: (Score:2)
Quick, change it to 12345!
Same as it ever was... (Score:2)
Everybody jumps on the three-letter acronym, but no love for the researcher's name [wikipedia.org]?
Re: (Score:2)
This is not my beautiful POS!
Comment removed (Score:3)
Re: useless story (Score:5, Insightful)
Based on it being 6 digits starting with 166, I'd say it is VeriFone. Their card terminals have the same kind of 6 digit code starting with 166.
Re:useless story (Score:5, Informative)
It's VeriFone. Anyone who's been a credit card terminal tech could tell you that. Hypercom has a well known default password as well. Any competent fraudster trying to reprogram the pad would know it as well.
They have to put in something at the factory, so they put in a default. It's supposed to be changed when the system is programmed and set up.
I used to have the default password for VeriFone's 101 pin pads in muscle memory due to having set up so many of them. (Yes, part of the setup was changing the default to something else.)
Re: (Score:2)
They have to put in something at the factory, so they put in a default.
It's not the only option is a single password for every device. They could just as easily plug it in to something, set a random password for just that device, and have a sticker print out with the password that gets put on the device. I've seen modems ship like that, with a 20-character password that is obviously random for that device (since it's printed on the same sticker as the MAC).
Re: (Score:3)
And then some idiots would leave the sticker attached to it and if forced to change the password they'd change it back to the original. You know what they say about "foolproof".
Re: (Score:2)
So you're suggesting that a better alternative is to set the same password for every device instead of shipping each device with a unique password? I didn't say anything about "foolproof". I'm saying that shipping every device with the same password is not the only option, it's not even a good option.
Re: (Score:2)
No, I was simply noting that technical solutions are limited in solving what are human problems at the base.
The base problem is valuing "easy" over secure.
The real problem to be solved is a bit harder: Finding a technical or human way to block that problem, that's still workable (think about bricked devices from an unknown password that can't be reset) enough to be accepted by users and the companies fielding them.
Naming Adobe landed Dmitry S. in jail (Score:2)
They won't be dragged off to court, or now that we have DMCA bullshit they won't be dragged off to jail like Dmitry S. vs Adobe. If they name them one or both may happen.
Don't use a password (Score:1)
Using some secret number, calculate the hash of that number concatenated with the current hour and minute. Then, when someone comes by to unlock it, they just use the same algorithm with the same secret number to generate a hash that matches the one on the machine. Authenticate based off of equality of user given hash and machine calculated hash.
Of course, concatenation maybe isn't the best option if you want a large amount of entropy behind the hash code. Maybe replace the human and PIN input with a seria
Re: (Score:2)
I'll bite... wut?!
If you're asking a user to calculate a hash in their head based on a secret plus the current time when entering a password, you're greatly overestimating the amount of time and mental capacity regular people have.
If OTOH you're talking about using a hash of a secret plus the unhashed current time, your suggestion is completely useless. The hash would be static and simply be a normal static password, and the addition of the current time would be of no extra significance to security. Not to
Re: (Score:1)
I wasn't thinking straight. A smart card is definitely better
Re: Don't use a password (Score:1)
That weakens security. It means the computer needs to store the secret in a readable way, and once readthe secret is known, and the time and hashing simply obscures the sending over the wire. Since the hash is not a shared secret, no extra security is proviDed. Best to have the secret hashed in a non readable way.
What can you do? (Score:2)
What could someone possibly do if they gain admin access to a POS? Is this a Windows CE system where someone could run arbitrary code? Or is this a bespoke system where the admin password just gives you access to the settings of the system? The article mentions staff using a POS server to play games and download porn on but that is a server probably running Windows Server with some POS server software from the vendor. Rather than just making fun of the name, these guys should explain what exactly does the a
Re: (Score:3)
Ummm ... it's kind of the cash register, tied into what sales you've made. So, with the admin password, maybe your staff can fiddle with the numbers and rob you blind.
Hell, it could be tied to your inventory system. Oh, and don't forget credit cards details of your patrons.
Your POS is the keys to the kingdom.
Re: (Score:3)
Credit Card Terminals, too. (Score:2, Informative)
166831 has been the default pw on VeriFone card terminals and "multilane" on Hypercom ones for as long as I can remember. Of course these are supposed to be changed at install time, but we know how that goes...
Odd Findings (Score:3, Interesting)
The pair iterated some brazen criminal and hopeless customer cases they each dealt with while at Trustwave where PoS systems had been compromised. ...
In another, forensics were left stumped by a carder's keylogger which had logged repeat keys (such as aaaaa ggggg bbbbb) entered on the PoS server. It was later revealed staff had used the machine to play Guitar Hero, Call of Duty, and download porn.
Forensics had even established which songs were played based on the logged keys.
The researchers found that next to the ubiquitous use of the password 166816 amongst separate manufacturers, that Deep Purple's "Smoke on the Water" was the most played song on compromised PoS terminals. Strange.
Not quite accurate (Score:5, Funny)
The vendor recently updated the default password to "166832".
Re: (Score:2)
or 166831a
One of the most popular POS systems (Score:2)
Re: (Score:2)
Re: (Score:2)
,UDH Worse than just Passwords (Score:2)
The actual presentation [rsaconference.com] is much worse than just passwords.
Really pathetic that "chip and sign" won't do much to fix these issues. Disappointed that they didn't shame the manufacturer, although there are really only 3 left now among the majors.
(And sadly, the link to that presentation's directory is "writeable." Sometimes even security specialists get it wrong...)
Re: (Score:2)
I don't keep bundles of Cash, Checks, and Credit Card receipts in my Router. I'm somewhat surprised that you do.
So you say changing resolvers in your router would do you no harm?
It was funny in Thailand - 2 major ADSL internet providers, with most adsl modems/routers configured with 3 default admin passwords - 3bb, tot, and, you guessed it, admin. By default they were all open from WAN - I checked once, just opened in browser a few IP's in a same subnet with mine - could login to about 5 out of about 10 IP's tested. About a year ago probably somebody exploited this, so what did providers do? Simple solution - just
More context needed (Score:2)
Questions that need answering:
- Can end user change the default password?
- Do installation best practices from manufacturer dictate to change the default password?
- Who performs the installation and maintains the devices?
Without answers to these it is hard to say whether the issue lies with the manufacturer, the reseller or the end user.
Not really a problem (Score:2)
This isn't really a problem. Where are regular people who don't work in security going to get a paperclip?
Re: (Score:3)
You'll need a three day wait and a background check to secure one of these terrorist "paperclips". Sure, you could 3D bend your own with some wire and a few thousand dollars in equipment, but it will still be inferior to the real thing.
-SD
Re: (Score:2)
Tweeted from a 787 in flight: "I have a paperclip."
pop and lock (Score:2)
Criminals won't pause before popping and unlocking.
My own preference is to pop and lock [youtube.com].
Dumb question (Score:2)
What does knowing this password allow a malicious person to do, that he couldn't do otherwise?
Re: (Score:2)
Apparently play games and download porn on the PoS.
In theory an american PoS has access to credit card numbers. Since the PoS apparently is a fully fledged Windows machine with internet access these cc numbers could be stolen.
Comment removed (Score:4, Interesting)
Can you say... normal? (Score:2)
There's a reason why linksys, D-link and others do pretty much the same thing.
User Error (Score:1)
Back in the early 80's when I was in the Air Force (Score:1)
Sadly this is normal (Score:2)
Most large commercial device makers do exactly this same thing.
Routers, Credit Card terminals, Coke machines.
Not only do they all do this, the default passwords and the correct menus to select are all well documented online.
You can walk up to most digital Coke machines and reboot them, and reconfigure their settings to do all kinds of things.