Hotel POS and Magstripe Cards Vulnerable to Attacks, Brute-Forcing

Magnetic stripe readers, you are the gift that keeps on giving. Unfortunately.

Researchers from Rapid7 Inc. will demonstrate how point-of-sale systems and hotel keys with magstripe technology can be hacked and used in brute-force attacks as part of a DefCon presentation this weekend.

Building on work from Samy Kamkar and his MagSpoof techniques, along with integrated bad barcode from Tencent, Rapid7's Weston Hecker will show how to inject OS commands into a Windows-based POS system with the magstripe reader.

"Often a magstripe reader is configured as a general-purpose device, so you can drop in commands to open a register, open a window, or download malware and install," said Tod Beardsley, senior security research manager at Rapid7, in a phone interview with Dark Reading.

With a device that's programmable via an electromagnetic field, the hacker has lots of options: open a cash register drawer, open a window on the computer, or download and install malware. "You only need to distract the operator for a couple seconds -- it all happens very quickly," Beardsley explained.

In effect, the attack turns the magstripe reader into a keyboard. "If you've seen the rubber ducky attacks with the exposed USB ports, you know that something that mimics a keyboard gives you direct access to the [POS] device," Beardsley added. The vulnerability affects everything from hotel keys to loyalty cards, gas cards, or special access cards for first responders to use elevators.

Rapid7 has already notified the manufacturer, Samsung, but the vulnerability affects nearly all vendors' POS devices, which aren’t that different from one another, according to Beardsley. There's also been no official response from Samsung, though Beardsley assumes they're doing their own testing and due diligence. Rapid7 is also working with CERT for handling the vulnerability disclosure.

Beardsley and Weston point to two areas that need to be fixed. The first is not to allow magstripe readers to be used as a keyboard, which can be addressed by new driver definitions, "an OS fix," Beardsley said. Secondly, because the devices can be tricked into taking certain types of commands, the applications they use should limit the kind of data they're expecting. "Credit card data is ASCII, not anything exciting. But the fact I can inject keystrokes, like the F8 key, is unexpected," Beardley said. "It's a fundamental design flaw in how these Windows-enabled systems run."

Brute-forcing a magstripe hotel card is also remarkably simple; the data it contains is encoded but not encrypted, Beardsley said. An attacker with a magstripe hotel card will look for the folio number associated with check-in, which is usually six digits and tends to be assigned incrementally (123456, 123457, 123458…) rather than randomly. The attacker will also look for the room number on the magstripe card and the checkout date. All three pieces of data have to be accurate for a room doorlock to open.

"Once you have a device, it's short work to guess a number on the fly that opens a lock – the doors to guest rooms," Beardsley said. By replacing incremental IDs with random ones and expanding the number of digits in the data fields, hotels and other affected industries can help address the vulnerabilities – a cheaper, easier fix than using encrypted cards. "Encryption will happen at some point, but today it's pretty much the same basic technology from the 1970s," Beardsley said.

Related Content From Black Hat 2016: