Hacker News Reader

Comment by sp332 | Hacker News Reader

"The important fact to point out is that even knowing this password, sensitive payment information or PII (personally identifiable information) cannot be captured," Verifone said. "What the password allows someone to do is to configure some settings on the terminal; all executables have to be file signed, and it is not possible to enter malware just by knowing passwords."

View on HN

I wonder what is available in the settings interface? For example, is there some gateway address that could be changed to a MITM transparent proxy? They act like this is no big deal, but 9/10 of these machines has the same password!

Yeah but if the password is for an account that doesn't have any access, who cares? I guess some kind of privilege escalation would be news, but that's a separate vulnerability.

Presumably (and I have worked on devices like these, but not for Verifone) there is some sort of encryption going on.

I.E. some protocols I've worked with have had all sensitive data protected by ANSI X9.24 Appendix 1 (I think...) derived keys, or keys derived by various other standard means, such that being able to read the data stream is pretty irrelevant.

  > Presumably ... there is some sort of encryption going on.

Color me skeptical. I would presume similarly, but I also would have presumed that they did not have the same password, either. A failure of that scope seems like it could be indicative of a systemic disregard for security.

>> A failure of that scope seems like it could be indicative of a systemic disregard for security.

Well, all the security systems have to be audited and signed-off by third-party testing labs approved by the payment card industry body (PCI) so your cynicism should be unwarranted.

But then I've seen code that got through those labs that I would be thoroughly ashamed of, so who knows really...

Reply on news.ycombinator.com