Breaking Payment Points of Interaction (POI)
summary
Demonstrates that a production pinpad can be compromised without OS exploits by placing a man‑in‑the‑middle device (Raspberry Pi) on Ethernet or by monitoring serial, capturing clear track data and EMV tags, translating EMV tags into mag‑stripe track and flipping the service code to enable offline fraud, and injecting signed‑looking forms to harvest CVV and PIN (DLL replacement also shown). All demos work against unmodified field firmware; fixes require true point‑to‑point encryption, signed form updates, TLS/TPM and anti‑downgrade controls.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:22Challenge
- 2:44Security through obscurity
- 4:46Architecture types
- 7:17How payments work
- 9:06Exploiting payment flows
- 10:24Demo
- 20:03Getting EMV Data
- 25:49Active Attacks
- 27:22Demonstration
- 39:03Mitigation
- 39:18Pointtopoint Encryption
- 39:53PIN Pad Encryption
- 42:18Offline
- 42:31Encryption
- 42:43Authentication
- 43:00Consumer Perspective
- 43:25Unusual Prompts
- 44:08Summary
- 44:35Questions
related talks
23mPoint of Sale System Architecture and Security
59mA Journey to Protect Points-of-Sale
38mMission mPOSsible
59mHow Smartcard Payment Systems Fail
40mPiOSoned POS - A Case Study in iOS based Mobile Point-of-Sale gone wrong
24mPicking Up My Tab...
45mATMS how to break them to stop the fraud
42mHack Your ATM with Friend's Raspberry.Py