This is Alex and Micos and I had to practice like 10 times.  Speaking about point of sale vulnerabilities specifically in places that the TSA won't like so be nice to them because they're probably stuck here.  Gentleman. 
>> Hello.  Thank you.  Thank you for the introduction.  We're going to present a case study of an attack of POS that takes place in an airport.  This is a real airport but we're not going to disclose the name.  So, our presentation and now I give this to Mr. Alex. 
>> So, we're going to discuss about specially involved POS attacks but before we talk about that let's discuss about why they choose to target travelers.  So travelers are really vulnerable people.  They're running around trying to catch a flight and they don't think about what kind of wireless access they use or what especially if they trust the place in which they're using let's say an airport.  It's supposed to be a place very trustworthy.  So you have a number of travelers running around, causing many devices and trying to juggle around trying to catch a flight and he guards his mobile phone, laptop, tablet, maybe his corporate mail.  I know most of you think that's not a secret service guy so we're talking about these guys, too
So let's get a little better closeup look at the point of sale attack interpretation.  It's a little bit different than usual, what we usually know about POS attacks where we target credit card details.  In our case we're trying to identify the traveler so we're looking about the names, the traveler, his flight number, his seat, who is he communicating and the worst case we're trying to get passport ID so we're talking about this stuff and not credit cards which is usually what happens in POS attacks.
So let's go through the ways usually the point of sale attack is introduced.  There are three ways.  We're talking about the first one in our case but I'll go through all three of them.
So the first thing is when a system has unpatched vulnerabilities someone might find out and expose the whole system and get the information he needs out of the system
The second way is maybe an employee of a company which is not aware of how things work about security, send mail, a link or whatever and introduces a trojan in the company's network and it reaches the point of sale system so that's where you get the information from.
Or the third way is that the employee himself is the bad guy, the inside man that produces the malware in order to harm.
So first of all who is going to benefit from this?  Okay.  Well, there are three but maybe more but I'm quoting three there, Cyber criminals, usually for identity theft in the case of passwords and stuff.  Private investigators who just want to find you, or maybe the government if they want to find you.
What do you get out of a point of sale attack.  As I said before we're trying to provide the traveler, we don't get airport data to do so, we do it on our own so what we can achieve is like at the end of getting information is that we can find out the designation and perform queries like who's traveling from Greece to Germany in the last month, or which company is used by most travelers or what class were these travelers traveling?  Or on a specific flight and date who was traveling.
So here's the case study now.  We're talking about the real airport and this really happened.  So the airport has different systems that can be exploited the way we're describing here in order to see information.  So we have the check-in kiosks which probably you've all used before.  There are some systems that we have exploited but you can purchase wi‑fi time and have other information but usually you can find in many airports.  Also we can find internet access points and all of them hold information that could be found useful by us attackers, in order to exploit the traveler.
Let's get some more information about the airport, how big is the attack vector that we're dealing with and how much the people are affected.  These are from the specific airport, we're talking about an average of 12 million travelers per year of whom 30 percent as you can see these are from 2012.  30% are business passengers which are really more interesting to attack or learn more about them.
The first two numbers are real but the last one is the hypothesis that says 100% of them are using the POS system.  36,000 people can be attacked per year.  Seems small but it isn't that small.
So ‑‑ 
>> No, keep going. 
>> Okay.  I'll continue.  So we chose to attack this, it seemed better than the rest, seemed to have less security, it's supposed to even buy wi‑fi time in order to default.  Change back you can check your flight details by scanning your ticket and you can also make VOIP calls,it has a web cam in it, and there were six machines in there. 
>> Excuse me for a second.  May I take the podium for a quick second? 
>> So we have a first time speaker, and for those of you who are not familiar, for a first time speaker.
[Applause] 
>> We have a little bit of a welcome tradition here and unfortunately we don't have any vodka.  But yeah, next time 
>> You guys are from Greece? 
>> We got the wrong information.
[Applause] 
>> Yeah.
[Laughing] 
>> A little bit of support.  Here.  Are you good? 
>> I'm better now. 
>> Would you like some help? 
>> No, no.
[Applause] 
>> Thank you guys.  So I'll give the slide from the beginning because I'm drunk now.  So wi‑fi, you can buy wi‑fi time, they accept coins and bills and they give you change back. You can take your flight scanning your bar code on your ticket and you can make VOIP calls on them.  There are six perfectly placed around the airport so what better things to attack?  So let's go a little bit more.  On them there's a screen of the wi‑fi interface, this is for the VOIP calls and this is the simplest attack you can do on them, press alt tab and escape the front end also yes the thing didn't work from the left but it worked from the right.  So, but it's not the worst thing.  They also had the USB port open.  So you can understand what's going on here. 
>> Excuse me.  It was clearly visible when you went in upstairs from arrivals to departures so when you get upstairs via the automated stairs you can clearly ‑‑ 
>> You are like oh ‑‑
[Laughing] 
>> So, so, okay.  After going on a bit more about the system we show that the escape used Windows 7, they had a connect because of the protocols, it was getting worse and worse, because if you hit escape button there were processes running in the background they were giving you full control of the system so they were running in the background.  So you sent some money, which we did without using the machine we clicked how much we want and we said pay and you know slot machines you've seen are worse than, I mean they're harder to get money.  This is real easy.  So okay some more victims here.  The communication with the process behind the front end is talking to the back end.  This makes sense.  It's in Greek but I will explain.  This is how much money is in there.  Around 500 in Europe are missing and the good thing we find how much money we want to get out of them.  Where you can see down there is you just pick how much money you want and there's a pay button in the middle.  Get the money out of the system.  So you want to talk about how we ‑‑ 
>> So why this happen?  This happens because we're using the airport to go around the world working the security industry so when this was found we decide to inform the airport because its not only the risk of losing money at the airport, it's also things an attacker can do with these type of skills so we decided to call the airport.  When we called the airport they didn't believe us.  They said no, there's no way.  And then we called again.  And it was one week time before they sent people to check it.  After one week they called us back and told us you are lying, this is not possible to happen because we checked and it is not happening.  We insisted, we said no it's happened.  They said come here.  So we went there, showed them the bug.
So after a while they decided to fix the alt tab issue and then we decided to see who can do further stuff regarding the point of sale at the airport and everywhere else but we did more testing after they fixed the  alt tab there's still a possibility to have access from the Skype interface that locates your flight.
They do a fork from Skype and internet explorer from where you can see your flight status and when your flight arrives.  Then you can get access to XML and then you can get access to whatever you want from there you can download whatever malware you want also internet explorer is an old version, so it's probably exploitable.  We can't show you this stuff because it's highly illegal.
[Laughing] 
>> So this, we found these extra bugs and the other was the bar code.  So you have a lot of point of sales, you have this infrared scanner and from there they pass product bar codes, they send information back to the machines so we decided to build an application that would generate not so random bar codes or QR codes to applications
Here you can see the interface, you can see that there's a map showing the flag if you point there then it opens up a Gmail account to the mail to send to look in and use Google Maps for the information.  It will be exposed again after they are fixed okay so you can have the pay option. 
>> It was a really bad application.  The service we've seen before.  This black screen.  This one.  If you close this window the call service went down so they executed something like CNV cell and then it will run the application something like that.  Whenever you scan the code there the code was displayed in this console okay?  So that's one of the things you can take information from the bar code.
We will see the maps and we will go to the mail account information.  Here can you pay yourself, and so we found that it was very interesting, they also have web cams in it. So if you own this part of the network you can possibly monitor all of the cameras in these machines so can you take pictures of all of the passengers passing by.  These were placed in important places inside the airport so you can have a very good view of the passengers going in or out.
They then, the malware must have RAM scrapping capabilities so they can take the information from RAM of the machine.  And the fast way will be able to pass the infrared in the interface and cause more errors.  So here's the camera, we're having issues because we cannot see the image here. The functionality of the kiosk- so whenever you went to buy wireless time, you had the ability to get flight information so you scan your boarding pass, the QR code in the boarding pass and then comparing it back with the web service, the flight if it's in time or your information if it's valid.  That means that kiosk has access to a service to confirm passengers,
if it turns back the flight information everything is valid.  Or if there is a possibility for the application.  Also there's a possibility to do net reports, to Skype, to wherever we go.  From what we saw it was possible to access whatever you wanted on the internet from that kiosk so I will tell you later and he will continue with the possible risks posed. 
>> So this talks more about the code.  Your tickets, a bar coded boarding pass.  It was a bar code introduced by the International Air Travel Association in 2005 and more than 200 airlines use them, and some of them have a mobile version. What we saw is that the more common is the PDF417 and for the digital type its Aztec code or Datamatrix and QR code because we couldn't extract all of them we decided to do one from paper and one from digital we talk about and prove our things in real life from the tool that we've developed
So information about PDF417.  The linear bar code we say use in transportation identification and inventory management, and what ticket looks like inside is like this, this is a QR code PDF417 code that I scanned from aerial ticket and it belongs to me and there's information inside it.  You can see the data under the QR code, under the bar code and I have broken down the information of each feed so you can see my name, my slide, my booking, where I'm sitting and from where I booked the ticket and which airline I'm using, passenger seat, everything is there.  So you know everything about my flight.  Also can you see if I am business class or what type of, first class or what class I'm flying.
Also again, without the code here we're talking about digital version of the same thing, it's usually present in mobile phones and handheld devices where you can see the eticket version of that.  You can see the standards, you can see again that it has less information of the previous one but again the code has lots of stuff thats useful to get out of a machine, so here is the attack vector all in the machine that we previously showed, we can do the following:  We will have a traveler going to kiosk scanning his ticket.  We have malware on that kiosk, the point of sale malware that we're going to discuss later about more.  it has RAM scrapping capabilities so whatever is in its RAM its ours, we're going to do is we can display that information and maybe clone the ticket if we want, so we can get through tax free area and get some alcohol.  So, okay, two things that are here, the first one is that we need malware to do these and then we need an application to do the duplication or other stuff that we'll explain later.
The malware must have full capabilities as most malware must have, and perform the RAM scrapping that we talked about before in order to get every ticket that was scanned before.  And what else, maybe exploited the webcam and get some picture of a guy scanning so we know who he is, and of course to do so you have to hook the barcode scanner so you can synchronize the picture taking otherwise you're taking random pictures and may have the ability of getting commands through a QR code so it would thus scan a specific QR code and get money out of the machine because we can do that.  And of course it would be great if you could have the connect back process. even if you didn't have that we could give commands to the QR code again so it's fine
So we would go through the, yes, so the image capturing is harder than you think, because we have to hook and synchronize with the code, scanner with the camera and it's not that easy because the RAM scrapping thing works asynchronous, it runs like every two hours and gets all the information so you have to just have them in place and then combine them to see who was scanning on a specific time it has some drawbacks so most of them will have to do with timing, correlating images with travelers data, and of course when you create files inside the system you might get noticed easier than without doing so. so its mostly detectable but you can actually do that.
I believe the most interesting part and it's what characterizes this attack as a point of sales attack. its the RAM scrapping feat, so you have 3 things you do in the point of sales attack.  You extract the RAM of the process that you want, probably the bar code scanner.  Also it's interesting to attack the explorer process and you should do it periodically around every two hours maybe because it's a time consuming process so you can do it every 5 seconds and the second thing you do is you search, you search for the string thats interesting, in our case the QR code with your traveler's information so with the code inside RAM so you are looking for specific values which are fixed sizes, specific values, which are specific in our case, using regular expressions you get the information.  Sometimes youll have false positives but get them too because you can you know clear things later, and you store them
and the third thing is the exfiltration, it's a bit harder because  if you have connectivity it will send back to you try not to get caught.  And if not you just store them locally and you go there physically and send a command to the QR code and it brings back all of the information you needed.  You get them by some, you know maybe scan them again or write them down or whatever.
But you know how it looks when you do it thru volatility dumping a  the process, get the information, this is from a real machine.  And  a real process scanning a ticket and you discard what's not useful and you get what you want out of the machine and the third thing that we want our malware to do is get command from aztec code so you scan a specific QR code and then do stuff like example turn on and off the image capturing or exfiltrate a specific thing, or maybe send someone a few commands if you wanted to so that's another thing we want our malware to do
So we have on the one end we have the malware standing by on the machine that we hack, and then we have another tool, that's a multipurpose tool.  Can you use that tool in order to do two or three stuff.  I'll explain.  It works again, it's on android mobile, you will get that material after the conference, it has 3 modes, it supports PDF417 and Aztec code, and it has 3 modes the one is in order to duplicate stolen tickets.  And the second the PenTest one is the most interesting mode is fuzzing the barcode and I will explain later.  And you could use all your favorite commands that you can store in the text file and load to our fuzzer, ill explain later and  attack the barcode and the malware command mode where you would send from to the barcode to the malware installed from the kiosk, so the duplicator looks like this and we use it for impersonation reason. so you want to create the ticket that, like this so you input their information and you just create another ticket then you go to the check you show your ticket, it's valid, it's from another guy.  Try not to use a woman's ticket if you are a guy and probably you will go through that first check and get that free booze, more information about the fuzzing.
For the fuzzing we 4 kinds of fuzzing, we have string, integer, random string, predefined, you have all the SQL and XSS on there.  It won't actually work in other systems but it work and crash other systems so it's pretty useful.  You should try that download application and do your own research if you want. and hgow the fuzzing works, you just down there is the ticket you had.  You just place where you want the files to be and then you start.  It generates bar codes every five seconds.  You can set your own intervals because the QR code reader different intervals depending on that you are attacking this has generated QR codes attacking the QR code reader.  You can stop it at any time copy the code and use it later and then stop it and go one by one in your own pace in order to test the system better.
So, and the last one is the commands to talk about.  So you can choose what commands you want to send.  You actually send dump RAM commands and you can perform network scans so you can actually set on and off the image capturing thing or you can cash out money depending on the command you want to send the way you do it is you click the command, the command is enabled through mobile application, the malware is running on the machine you want and I'm sending lets say the last scanned person command and the malware responds back with a pop up window this is the guy this is hie picture this is the data.
So closing what you should do and what you should not do or what you should do, especially for those manufacturing jobs like this.  You should use strong passwords to access the point of sales  devices.  You should keep your point of sales software up to date.  This is the most important thing.  You should not use  buggy software.  You should firewalls to isolate the point of sales production networks from other networks on the internet and it's a good idea to have an antivirus there not that it will identify all malware running but probably some would.  Use limit access to the internet if possible and disable all remote access to the point of sales system and one good idea is to check both the hardware and the software running from the kiosk and not separately.  You should check them as a whole.  This is very important.  if you want to identify more and more attack vectors for the system and keep it secure so this is all from me.  I don't have ‑‑ you want to talk more about? 
>> Yes.  Furthermore, just to other point, you have a lot of uhm in all the airport alot of kiosks like that provide free internet access or they give you some functionality to have in the airport   to play games or Skype talk with your girlfriend and do stuff like that.
If you can imagine, if the attacker can own these machines which are on the same network how much time it will need to get deeper into the airport network okay because it's not a fact that you can just attack all the passengers or the machine surf the internet who put the credit cards.  It's not only that.  It's the fact that having an attacker being there for the infinite time, that means there will be a case that people go deeper into their network, that means a real threat to the airport.
Furthermore, we have another room next to us here where they are developing router exploits at the moment so I don't know if the router thats on the file is not enough so the best solution for these kind of problems if you have in a network, kiosks that provide user services, the best solution is have physically have different internet lines different equipment for this type of information from the airport. 
>> Furthermore I would like to point out that although this attack seems random it can get more specific and more personal if you want. using a little bit of social engineering So from what you see here it's like okay, I would like to say you are attacking a random strangers that are traveling but you are not liking this specific person that you want to get information from, well if it's not true if you get some social engineering in that, since you own the machine  And most of the people traveling would probably think its a safe machine to use and we can run anything on that.  I could run a campaign like a phishing campaign on that machine and then go around to a line of people awaiting to get their ticket, one of them is the guy that I want to attack.  And I will be like oh sir, you are traveling?  Here is a QRcode you can use that on that machine and maybe get free wi‑fi.  All you have to do is scan this code and your ticket and you will get free wi‑fi.
Even worse I would be like you get some free money 
>> 50 bucks. 
>> So he would be like "oh cool guy" but I get information.  Yes it seems random but it's not that random if you own the machine and people trust the machine.  You can get them to use a machine you can get that machine to work for you in your favor and you will get what you want.  It's not at random.  It seems random but it's not.  That's all from us.  Do you have any questions?
[Applause]