How I got a Root Shell on a Credit Card Terminal

Re:How I got a Root Shell on a Credit Card Terminal by lelanthran on Sunday June 01, 2025 @03:00PM (#44153019)

> Kind of, but if you control the card reader you could charge more for the transaction without showing the amount, for instance.

Not supposed to be possible on a certified terminal. The certification tests this particular case (the transaction is a hash of the keys, amount and a few other things. The display of the swipe/tap/insert screen and the pin-entry are under control of the certified kernel, so the userspacve application has no control of the amount that is displayed).

> And maybe even send the money to a different account.

Not from the card reader.

[ Parent | on HN ]

Re:How I got a Root Shell on a Credit Card Terminal by cesarb on Sunday June 01, 2025 @05:16PM (#44153807)

I've heard of it happening here in Brazil. In the simplest variant, something is glued on top of the screen to hide the higher digits, making the value appear to be lower; supposedly, some more advanced variants of the scam have a damaged or tampered screen.

[ Parent | on HN ]

Re:How I got a Root Shell on a Credit Card Terminal by clait on Monday June 02, 2025 @04:06AM (#44156624)

I was victim on this attack in Argentina. Paid a taxi with my card, and got charged 50x the amount shown on the display.

[ Parent | on HN ]