Hacker News Reader

In this context, is the POS device the cash register or the CC reader used by the customer? I was assuming it was the reader device they were referring to, but it seems like those would run software from the manufacturer, not Target.

I noticed that some Target stores have the Verifone MX925 [1] which seem to have been installed in the past year.

[1] http://www.verifone.com/products/hardware/multimedia/mx-925/

View on HN

The Verifone MX800 series, at least, can have Customer-supplied binaries installed. There's code-signing on the MX800-series devices, but I am aware of at least one version of the firmware that allows an attacker to get root access on the device pretty easily via the touchscreen UI and Ethernet port, assuming that default passwords aren't changed on the device.

The POS systems that I've observed in a standard retail setting have three main components: the printer for receipts, the main terminal (POS system) in which items are scanned (which runs the Windows XP for POS), then the credit card reading machine for CC payment processing. So in this context, the POS device is the cash register.

Reply on news.ycombinator.com