News for hackers. Stuff that matters.

A comment on How I got a Root Shell on a Credit Card Terminal. Parent comment

Re:How I got a Root Shell on a Credit Card Terminal by stgl on Sunday June 01, 2025 @12:29PM (#44152018)
No, it cannot load a separate bootloader. I tried to tamper with the loadercode (the "secure" bootloader), but it wouldn't boot. So I am guessing there is some third party (boot ROM) that verifies it.

Also, I think Linux always loads loadercode + mp1.img, regardless of the tamper state. The different code paths depending on tamper state are taken within the (integrity protected) loadercode.

[ Parent | on HN ]
Re:How I got a Root Shell on a Credit Card Terminal by ComputerGuru on Sunday June 01, 2025 @12:59PM (#44152242)
Keep in mind that no tamper mode will be set if you use the external debug interface. If Linux is used for networking then maybe you could MITM payments.
[ Parent | on HN ]
Re:How I got a Root Shell on a Credit Card Terminal by _djo_ on Sunday June 01, 2025 @05:17PM (#44153813)
The card details and payment are encrypted and then signed by the firmware running in the secure/trusted zone, using public keys provided by the acquirer.
[ Parent | on HN ]