PiOSoned POS - A Case Study in iOS based Mobile Point-of-Sale gone wrong

on YouTube ↗40m

" summary

Examines iOS-based mobile point-of-sale apps and card-reader hardware, using tests on a demo app (PiOSon POS) to show how coding errors, platform misunderstandings, weak card readers, and easy-to-hide jailbreaking let attackers capture cardholder track data. Describes attack techniques including jailbreak, method swizzling, installing malware and intercepting CHD, then contrasts insecure design with a safer example (AntidOte POS) and recommends coding best practices, card reader selection, and device-level controls such as MDM.

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 16:12Bad Transaction Handling, Part 3
3. 24:48Bad Credit Card Handling, Part 2
4. 27:22Better Choices in Design
5. 29:04Better Authentication and Storage Choices
6. 36:05Always make the following assumptions, part 2

" related talks

• 23mPoint of Sale System Architecture and SecurityLucas Zaichkowsky · Black Hat USA 2014
• 50mBreaking Payment Points of Interaction (POI)Nir Valtman, Patrick Watson · Black Hat USA 2016
• 38mMission mPOSsibleNils, Jon Butler · Black Hat USA 2014
• 59mA Journey to Protect Points-of-SaleNir Valtman · Black Hat USA 2014
• 49mHow to Hack Your Own Mobile AppAlec Tucker · NDC Sydney 2016
• 24mPicking Up My Tab...Zhe Zhou, XiaoFeng Wang, Kehuan Zhang, Xiaolong Bai, Nan Zhang, Zhou Li, Shi-Min Hu, Xianghang Mi, Tongxin Li · 26th USENIX Security Symposium (USENIX Security '17)
• 58mUncovering OWASP’s Mobile Risks in iOS AppsPatrick Wardle · AppSec California 2015
• 47mCommon security pitfalls in payment appsShadab Siddiqui · 50p 2018