Hacker News Reader

Comment by jessaustin | Hacker News Reader

"POS devices", ha!

Actually, they have my sympathy. Somehow I doubt the POS OS does any sort of signature verification. We might see that soon, however!

View on HN

It's likely Windows XP embedded, which doesn't enforce code signing.

I've worked around some Retalix (NCR) POS software (mentioned in the article, though in Canadian stores) and I can safely say that the security posture of the software of theirs that I've seen is simply horrible.

Perhaps Target has newer stuff than what I've worked with, but I'm talking about VB 6 code running in XP embedded using a "database" back-end that amounts to some Btrieve database files on an SMB share marked "Everyone / Full Control". Getting remote code execution on the POS machines would be trivial.

I was a contractor in Stores Dev at Target about 6 years ago, at that time the POS ran custom software running Win XP Embedded like the article mentioned. Most of the software was pretty ancient, the stuff I saw was first written in 1993.

In this context, is the POS device the cash register or the CC reader used by the customer? I was assuming it was the reader device they were referring to, but it seems like those would run software from the manufacturer, not Target.

I noticed that some Target stores have the Verifone MX925 [1] which seem to have been installed in the past year.

[1] http://www.verifone.com/products/hardware/multimedia/mx-925/

The POS systems that I've observed in a standard retail setting have three main components: the printer for receipts, the main terminal (POS system) in which items are scanned (which runs the Windows XP for POS), then the credit card reading machine for CC payment processing. So in this context, the POS device is the cash register.

The Verifone MX800 series, at least, can have Customer-supplied binaries installed. There's code-signing on the MX800-series devices, but I am aware of at least one version of the firmware that allows an attacker to get root access on the device pretty easily via the touchscreen UI and Ethernet port, assuming that default passwords aren't changed on the device.

Several of the POSes I've used have been based on Red Hat, so you never know...

Reply on news.ycombinator.com