DEF CON 24 - Weston Hecker - Hacking Hotel Keys and Point of Sale Systems

Take a look at weaknesses in Point of sale systems and the foundation of hotel key data and the Property management systems that manage the keys. Using a modified MST injection method Weston will demonstrate several attacks on POS and Hotel keys including brute forcing other guest’s keys from your card information as a start point. And methods of injecting keystrokes into POS systems just as if you had a keyboard plugged into the system. This includes injecting keystrokes to open cash drawer and abusing Magstripe based rewards programs that are used a variety of environments from retail down to rewards programs in Slot Machines.

11 Years Pen-testing, 12 years’ security research and programming experience. Working for a security Company in the Midwest Weston has recently Spoken at DEF CON 22 & 23, Black Hat USA 2016, Enterprise Connect 2016 ISC2-Security Congress, SC-Congress Toronto, HOPE11, BSIDES Boston and over 50 other speaking engagements from telecom Regional events to University’s on security subject matter. Working with A Major University's research project with Department of Homeland Security on 911 emergency systems and attack mitigation. Attended school in Minneapolis Minnesota. Computer Science and Geophysics. Found several vulnerabilities’ in very popular software and firmware. Including Microsoft, Qualcomm, Samsung, HTC, Verizon.

[Frosty-ojhw]

This was my first Defcon and was in this audience, it was awesome.

[JeffNoel]

This video is a goldmine of information. Thank you very much, the FAQ in the end was awesome too.

[blackneos]

I thought his shirt said "I Love My XD

[MrVNCNVG]

Great content. Tips:
1. Make sure your demo works (and doesn't inject F1 for help each time)
2. SLOW down (But this is a common issue within the hacking community that I've seen...it seems the faster you talk the smarter you think you appear)
3. Echo questions from the audience back before answering
4. Watch word repetition (so, actually, literally)

That being said, I'd probably freeze up on-stage. ;)

[therugburnz]

I found a similar non-hack a bit more than Ten years ago. My fiance' purchased on of those pre-pay credit cards from CardCo that u buy if you don't have a bank or credit card. When you buy gas and do a pay at the pump CardCo authorizes and dings you$100.00 then refunds the difference later. I bought $20.00 in gas knowing what I'd be $80.00 down until my refund. The next day I check to see if I got my refund and found that they refunded MY$80.00 a mere second later AND then refunded the full $100.00 as well. I was scared s#!bless until I recalled that the card was absolutely not connected to ANYONE at all much less me. I figured wow I made $100.00 and told my wife we were going out for dinner.
She questioned where I got a the hundred dollars I claimed to have. I told her what happened she got scared and checked the card on her throw away phone only to tell me we gained $180.00. The reader Authorized but NEVER dinged the hundred dollars, but did do the 80 refund then also gave us the 100 cuz the transaction "didn't happen". Wow I found out the next day it did it again. Every time I bought gas at that franchise in that state this happened. The less I bought the more money we got. So I put $3.00 in every day until the tank was full then started having co-workers drive me to jobs saying I'd buy the gas . Made a few grand unit one day it stopped. And that was Okay.
Sorry CardCo but Karma is a bitch. A big happy beeyach gunning for you CardCo.

[murrij]

as I said on Twitter this is an awesome example of taking someone's work and expanding on it (i.e. Sam's magspoof repurposed) so we can learn more.

[kds]

One thing - I used to install POS systems. Most retailers will go for the very least expensive hardware. And most of the time there's not much security in the least expensive things. Oh and the other thing - they tend to hold on to that hardware for a VERY long time.

And another vector is the bar code reader attached to many POS systems. They'll accept all sorts of different bar code formats too. All depends on how they were setup. And this particularly more acute with self checkout these days.

[NolePTR]

My university's cardreaders are just our account numbers... If you swipe it instead of entering text into a field it just types the

[PiezPiedPy]

you needs to change a couple of component's on the mp3 player to impedance match the coil to the speaker/headphone driver output, then you get no burnouts

[batmanbob]

CAN'T FUCKING WAIT FOR ALL THE TALKS

[zachhilton]

Great content, but the presentation was quite disjunctive. I had a hard time following what subject you were talking about. When I did key in, it was great work. Thanks for the talk. Also, laughing during a talk is fine, but be more confident. The nervous chuckle was distracting.

[Gunbudder]

nothing like watching your company install vulnerable POS systems and having nothing you can do about it. still makes me grind my teeth when the next thing i warned about becomes public

[Aftermth]

its too bad the demo didnt go as smooth as i could have, but even so, excellent talk!

[daverobertson]

What's with the video speed? Video/Audio is in sync, but clearly speed up maybe 1.25x speed.
Great presentation!

[dspism]

So couldn't you use the card reader to inject keystrokes to load the malware via URL?

[ericnyamu]

wount dare digitally piss anybody here, the wifi here must be the most dangerous place on earth, lol

[JordanShackelford]

I'm a security guard and we use this thing called a "toco wand" and we press buttons placed around the post. I'm sure there is a way to spoof this data?

[IIREHII]

I was watching a series on Youtube that showed how to open doors without picking locks. They talked about how the glass doors in California usually had gaps in them that you could push a tool through to unlock it, or how to use cigarette smoke or compressed air to open a door with a sensor. I cannot seem to locate the series now. Anyone know the name of the series, it is simiar to Def Con but I only saw one of the vids in the series.

[blackneos]

As far as I've seen, this local Restaurant where I live still uses Windows XP for their :) They should at *LEAST* use Windows 7, if not :D

[MultiMonitorComputer]

is it me or this video is playing at 1.5x??